@zhivex-ai/harness 0.5.0 → 0.6.1

package/dist/workspace.d.ts

@@ -53,6 +53,12 @@ export declare class Workspace {
         content: string;
         truncated: boolean;
     }>;
+    inspectFile(relativePath: string): Promise<{
+        path: string;
+        digest: string;
+        mode: number;
+        bytes: number;
+    }>;
     searchFiles(query: string, relativePath?: string, options?: SearchFilesOptions): Promise<{
         nextCursor?: string;
         matches: SearchMatch[];
@@ -63,6 +69,10 @@ export declare class Workspace {
     private secureWorkspaceDirectory;
     private stageFile;
     applyPatch(input: ApplyEditProposalInput): Promise<ApplyPatchResult>;
+    applyPatchWithModes(input: ApplyEditProposalInput, modes: ReadonlyMap<string, {
+        beforeMode?: number;
+        afterMode: number;
+    }>): Promise<ApplyPatchResult>;
     /** @deprecated Use applyPatch with an inspected expectedDigest. */
     writeFile(relativePath: string, content: string, overwrite?: boolean): Promise<{
         path: string;

package/docs/CLI.md

@@ -1,6 +1,6 @@
 # CLI contract
 
-Zhivex Harness `0.5.x` is Bun-first and exposes a human terminal interface plus versioned JSON documents for automation.
+Zhivex Harness `0.6.x` is Bun-first and exposes a human terminal interface plus versioned JSON documents for automation.
 
 ## Commands
 
@@ -20,7 +20,7 @@ zhivex-harness --version
 zhivex-harness --help
 ```
 
-`doctor` is local and makes no provider or MCP request. It checks the Bun version, workspace, Git, supported package scripts, state-directory safety, provider credential presence, endpoint shape, provider configuration, and the local MCP configuration file without returning secret or endpoint values.
+`doctor` is local and makes no provider or MCP request. It checks the Bun version, workspace, Git, supported package scripts, state-directory safety, provider credential presence, endpoint shape, provider configuration, the local MCP configuration file, and—when requested—the OCI runtime and preloaded image without returning secret or endpoint values.
 
 `--allow-check <script>` is repeatable and replaces the default check allowlist for that invocation. Values are declared `package.json` script names, never command text.
 
@@ -28,6 +28,25 @@ zhivex-harness --help
 
 `review` is application-owned parallelism and accepts only read-only explorer/reviewer members. Model-directed delegation occurs only inside `run` or `chat` when the parent invokes an enabled `delegate_<profile>` tool.
 
+Enforced execution is opt-in:
+
+```text
+--execution <none|oci>
+--oci-runtime <docker|podman>
+--oci-image <reference>
+--oci-allow-command <bare-name>
+--oci-max-process-runtime-ms <n>
+--oci-max-process-output-bytes <n>
+--oci-max-memory-mb <n>
+--oci-max-pids <n>
+--oci-max-cpus <n>
+--oci-max-workspace-bytes <n>
+--oci-max-file-write-bytes <n>
+--oci-tmpfs-mb <n>
+```
+
+`--oci-allow-command` is repeatable, replaces the default executable allowlist, and must include `bun` so declared package checks can run. Commands are exact argv arrays, never shell strings. See [EXECUTION_ENVIRONMENTS.md](./EXECUTION_ENVIRONMENTS.md).
+
 ## Exit codes
 
 | Code | Meaning |
@@ -39,6 +58,8 @@ zhivex-harness --help
 
 Agent results with status `failed` or `timed_out` return `1`. A paused approval is a valid durable result and does not imply a runtime failure.
 
+Every new CLI run persists its resolved, non-secret harness configuration with the durable state. The printed resume command includes the canonical workspace, state-store backend, and scope locator; after loading the run, `resume` restores the original execution policy, including every OCI image, runtime, allowlist, and resource limit, before validating the harness fingerprint. Explicit conflicting resume options still fail closed. Runs created before this metadata existed must repeat their original policy options manually.
+
 Operator commands do not construct a provider model and do not require provider credentials. They must use the workspace, state directory, backend, and scope that own the target run. `cancel` creates a cooperative cancellation request by default; `--final` writes a terminal cancellation. `cleanup` requires an explicit cutoff and defaults to terminal statuses only.
 
 ## JSON schemas
@@ -56,10 +77,10 @@ Additive fields may appear within schema version `1`. Removing a field, changing
 
 Provider diagnostics include credential variable names and boolean presence only. Endpoint diagnostics include validation booleans only. Neither contract contains credential values or endpoint URLs.
 
-`run-result.mutations` contains the mutation audit entries produced by the current harness process. `run-result.children` reports bounded child identity, status, steps, tool/error counts, and usage without raw child messages or tool payloads. Capability evidence and configured MCP server names are included. `review-group` contains a group ID and one bounded member result. Operational inspect/export documents are redacted and do not include raw messages, tool inputs/outputs, approval arguments, metadata, or full output text; `run-inspection.hierarchy` adds the redacted run tree. Tool-level repository-editing documents use their own schema version `1` and kinds such as `edit-proposal`, `patch-result`, `mutation-audit`, and `workspace-diff`; see [REPOSITORY_EDITING.md](./REPOSITORY_EDITING.md).
+`run-result.mutations` contains the mutation audit entries produced by the current harness process. `run-result.children` reports bounded child identity, status, steps, tool/error counts, and usage without raw child messages or tool payloads. Capability evidence, configured MCP server names, and the execution backend/binding/image are included. `review-group` contains a group ID and one bounded member result. Operational inspect/export documents are redacted and do not include raw messages, tool inputs/outputs, approval arguments, metadata, or full output text; `run-inspection.hierarchy` adds the redacted run tree. Tool-level repository-editing documents use their own schema version `1` and kinds such as `edit-proposal`, `patch-result`, `mutation-audit`, and `workspace-diff`; see [REPOSITORY_EDITING.md](./REPOSITORY_EDITING.md).
 
 ## Configuration schema
 
-Resolved library configuration includes `schemaVersion: 3`, an explicit `allowedChecks` array, `storeBackend`, `scope`, parent `budget`, `compaction`, `requiredCapabilities`, optional `mcpConfigPath`, and an `orchestration` object with profiles, child budget/timeout, and review concurrency. The check default is `test`, `typecheck`, `lint`, and `build`; `--allow-check` or `ZHIVEX_HARNESS_ALLOWED_CHECKS` replaces that set. Passing a different explicit schema version fails before a model or tool can run. During `0.x`, a minor release may add a new schema version with a documented migration; patch releases remain compatible.
+Resolved library configuration includes `schemaVersion: 4`, an explicit `allowedChecks` array, `storeBackend`, `scope`, parent `budget`, `compaction`, `requiredCapabilities`, optional `mcpConfigPath`, an `orchestration` object with profiles, child budget/timeout, and review concurrency, and a discriminated `execution` policy. The check default is `test`, `typecheck`, `lint`, and `build`; `--allow-check` or `ZHIVEX_HARNESS_ALLOWED_CHECKS` replaces that set. Execution defaults to `{ backend: "none" }`; an OCI policy records the runtime, image, allowed commands, and every resource ceiling. Passing a different explicit schema version fails before a model or tool can run. During `0.x`, a minor release may add a new schema version with a documented migration; patch releases remain compatible.
 
 The default state directory is `<workspace>/.zhivex-harness/runs` and the default backend is scoped SQLite at `operations.sqlite`. Explicit external state directories are supported, but the workspace root, filesystem root, sensitive workspace paths, regular files, and symbolic-link targets are rejected before the run store is created. See [DURABLE_OPERATIONS.md](./DURABLE_OPERATIONS.md) for state migration and operations, and [EXTENSIBILITY.md](./EXTENSIBILITY.md) for capability, MCP, subagent, and review-group configuration.

package/docs/DURABLE_OPERATIONS.md

@@ -1,6 +1,6 @@
 # Durable operations
 
-Zhivex Harness `0.4.x` makes local runs inspectable and recoverable across process restarts. The default store is Bun SQLite at `<workspace>/.zhivex-harness/runs/operations.sqlite`; `--store file` remains a migration fallback.
+Zhivex Harness durable operations make local runs inspectable and recoverable across process restarts. The default store is Bun SQLite at `<workspace>/.zhivex-harness/runs/operations.sqlite`; `--store file` remains a migration fallback.
 
 ## Scope and identity
 
@@ -10,7 +10,9 @@ Every durable key is isolated by:
 - optional user;
 - namespace: a SHA-256-derived canonical-workspace identifier by default.
 
-Use the same workspace, state directory, backend, tenant, user, and namespace for `run`, `resume`, and every `runs` command. A run fingerprint is bound to the canonical workspace, durable scope, provider/model, tool contract, approval policy, config schema, and harness version. Resume fails closed when a current binding differs.
+Use the same workspace, state directory, backend, tenant, user, and namespace for `run`, `resume`, and every `runs` command. A run fingerprint is bound to the canonical workspace, durable scope, provider/model, tool contract, approval policy, config schema, harness version, and execution-environment policy. Under OCI, the resolved image identity is also bound. Resume fails closed when a current binding differs.
+
+CLI-created runs persist the resolved non-secret harness configuration in versioned run metadata. The terminal prints a scope-complete locator command, and `resume` restores the original OCI policy before fingerprint validation, so approval restart does not silently fall back to `execution=none`. Explicit conflicting overrides are rejected by the existing binding check.
 
 ```bash
 zhivex-harness run \
@@ -107,6 +109,18 @@ ZHIVEX_HARNESS_OUTPUT_COST_PER_MILLION
 ZHIVEX_HARNESS_COMPACTION_MAX_MESSAGES
 ZHIVEX_HARNESS_COMPACTION_MAX_INPUT_TOKENS
 ZHIVEX_HARNESS_COMPACTION_KEEP_RECENT
+ZHIVEX_HARNESS_EXECUTION
+ZHIVEX_HARNESS_OCI_RUNTIME
+ZHIVEX_HARNESS_OCI_IMAGE
+ZHIVEX_HARNESS_OCI_ALLOWED_COMMANDS
+ZHIVEX_HARNESS_OCI_MAX_PROCESS_RUNTIME_MS
+ZHIVEX_HARNESS_OCI_MAX_PROCESS_OUTPUT_BYTES
+ZHIVEX_HARNESS_OCI_MAX_MEMORY_MB
+ZHIVEX_HARNESS_OCI_MAX_PIDS
+ZHIVEX_HARNESS_OCI_MAX_CPUS
+ZHIVEX_HARNESS_OCI_MAX_WORKSPACE_BYTES
+ZHIVEX_HARNESS_OCI_MAX_FILE_WRITE_BYTES
+ZHIVEX_HARNESS_OCI_TMPFS_MB
 ```
 
 ## Evaluation gate

package/docs/EXECUTION_ENVIRONMENTS.md

@@ -0,0 +1,130 @@
+# Enforced execution environments
+
+Zhivex Harness `0.6.x` adds an opt-in local OCI backend for shell-class work. The default remains `execution=none`: repository tools and declared checks keep their existing narrow contract, and no generic command tool is exposed. Selecting `execution=oci` acquires an SDK execution-environment session, copies an eligible workspace snapshot, and routes repository tools, checks, environment commands, and child agents through that session.
+
+This is a local enforced runner. It is not a hosted sandbox, a virtual machine, or a promise that a compromised container runtime cannot affect its host.
+
+## Trust boundary
+
+The harness trusts the operator, host OS, Docker or Podman daemon, configured image, Zhivex packages, and its own state directory. The model and code executed in the container are outside that trust boundary.
+
+The OCI policy is enforced per tool call with:
+
+- `--network none`;
+- a read-only container root filesystem;
+- every Linux capability dropped and `no-new-privileges` enabled;
+- the host numeric user/group rather than root;
+- a size-bounded writable `tmpfs` at `/workspace` plus a separate bounded `tmpfs` at `/tmp`;
+- an optional host `node_modules` directory mounted read-only at `/dependencies` and linked into the container workspace;
+- exact argv execution through the configured entrypoint, with no shell interpolation;
+- a fixed container environment containing only `HOME`, `TMPDIR`, `BUN_INSTALL_CACHE_DIR`, and `CI`;
+- time, output, memory, CPU, PID, workspace-size, and per-file patch limits.
+
+The snapshot is populated through the normal bounded workspace discovery contract. Git internals, harness state, dependency/build output, `.env`, `.npmrc`, private keys, secret-like paths, external symlinks, and special files are not copied. Provider credentials and arbitrary host environment variables are never passed to the container.
+
+When the backend is disabled, these OCI claims do not apply. The harness responds by omitting `run_environment_command`, not by falling back to an unrestricted host shell.
+
+## OCI configuration
+
+Preload the image intentionally; the harness never pulls or updates images:
+
+```bash
+docker pull oven/bun:1.3.7-slim
+bun run dev doctor --execution oci
+bun run dev run --execution oci --yes "implement the change, test it, inspect the environment patch, and import it"
+```
+
+Podman is also supported through `--oci-runtime podman`. Defaults are:
+
+| Setting | Default |
+| --- | ---: |
+| Backend | `none` |
+| Runtime | `docker` |
+| Image | `oven/bun:1.3.7-slim` |
+| Allowed commands | `bun` |
+| Process time | 120,000 ms |
+| Retained process output | 20,000 bytes |
+| Memory | 1,024 MB |
+| PIDs | 128 |
+| CPUs | 2 |
+| Snapshot | 64 MiB |
+| Imported file | 1 MiB |
+| `/tmp` tmpfs | 256 MB |
+
+CLI flags are listed in [CLI.md](./CLI.md). The matching environment variables are:
+
+```text
+ZHIVEX_HARNESS_EXECUTION
+ZHIVEX_HARNESS_OCI_RUNTIME
+ZHIVEX_HARNESS_OCI_IMAGE
+ZHIVEX_HARNESS_OCI_ALLOWED_COMMANDS
+ZHIVEX_HARNESS_OCI_MAX_PROCESS_RUNTIME_MS
+ZHIVEX_HARNESS_OCI_MAX_PROCESS_OUTPUT_BYTES
+ZHIVEX_HARNESS_OCI_MAX_MEMORY_MB
+ZHIVEX_HARNESS_OCI_MAX_PIDS
+ZHIVEX_HARNESS_OCI_MAX_CPUS
+ZHIVEX_HARNESS_OCI_MAX_WORKSPACE_BYTES
+ZHIVEX_HARNESS_OCI_MAX_FILE_WRITE_BYTES
+ZHIVEX_HARNESS_OCI_TMPFS_MB
+```
+
+`ZHIVEX_HARNESS_OCI_ALLOWED_COMMANDS` is comma-separated. `bun` is mandatory because `run_check` invokes declared scripts as `bun --no-env-file run <script>`. Adding an executable permits that bare entrypoint but does not add a shell or wildcard. Each environment command still requires normal high-risk interrupt approval unless the operator deliberately supplied `--yes`.
+
+The image is inspected before model construction. Its immutable image ID/digest, runtime/server version, complete policy, canonical workspace identity, and environment manifest contribute to the run binding. A missing daemon/image fails before model execution. A changed image or policy makes a paused resume fail closed.
+
+## Snapshot and patch import
+
+The acquired environment contains two owner-only copies under `<state-dir>/environments/<run-hash>`:
+
+- `base`: the immutable comparison snapshot;
+- `workspace`: the mutable snapshot used by repository tools and containers.
+
+For each successful command, the harness seeds a fresh, size-bounded `/workspace` tmpfs from the durable snapshot, pauses the container, copies the result into a new owner-only staging directory, rejects symlinks, hard links, special files, oversized workspaces, excessive entries, and oversized changed files, then atomically replaces the durable snapshot. The host snapshot is never mounted writable into an untrusted container. Failed, cancelled, timed-out, or output-limited commands do not publish partial filesystem mutations.
+
+`inspect_environment_patch` compares them deterministically and returns a run-bound patch identifier plus create/update/delete entries, content digests, and before/after permission modes. Content-identical mode changes remain visible, and modes are part of the reviewed `patchId`. It rejects binary changes, more than 50 files, a patch above 4 MiB, or a file above the configured import ceiling.
+
+`apply_environment_patch` is a different high-risk tool and approval. Immediately before import it recomputes the patch identifier and verifies every host precondition against the digest and mode captured at acquisition. Creates must still be absent; updates and deletes must still match. Writes publish content and mode atomically, including newly created executable files and mode-only updates; rollback restores both. Deletions use recoverable quarantine, and a deletion failure triggers best-effort rollback. The host remains unchanged until this import succeeds.
+
+Because repository tools are snapshot-scoped while OCI is active, `apply_patch`, moves, quarantine, and restore alter only the snapshot. The model-facing `git_diff` tool is omitted in this mode because it would read the canonical host outside the environment boundary; the caller still receives the canonical final host Git status/diff after any approved import.
+
+## Resource and network policy
+
+Every command receives the configured timeout and combined output ceiling. Cancellation, timeout, or output overflow kills the client process and force-removes the named container. The runtime also applies the memory, PID, CPU, read-only-root, workspace-tmpfs, `/tmp`-tmpfs, capability, and network controls listed above.
+
+The environment manifest declares zero network requests and bytes and denies undeclared tools. Consequently, all MCP configuration is rejected before discovery when OCI enforcement is active: executing a client on the host would bypass the environment boundary, while executing a network client inside the container would violate `network=deny`. Governed MCP remains available in a separate non-OCI run, with mandatory durable approval for network tools. `stdio` MCP remains unavailable.
+
+PID limits are the primary fork-bomb control. Memory and CPU limits constrain resource exhaustion, while the harness timeout and cancellation path bound command duration. These limits reduce impact; they are not a substitute for isolating the container daemon on a dedicated host when running actively hostile code.
+
+## Lifecycle and recovery
+
+Environment artifacts are keyed by a hash of the durable run ID and include an owner-only metadata file bound to that exact run, workspace, environment fingerprint, and image. Reacquisition reuses the same snapshot only when every binding matches.
+
+Each runtime container and temporary workspace volume carries `com.zhivex.harness.execution=v1` and a hashed run label. Session release force-removes resources for that run and records the terminal status and release timestamp. `runs cleanup --before <cutoff>` removes only released terminal artifact directories older than the cutoff; with OCI configured it also removes labeled containers in `created`, `exited`, `dead`, or `paused` state and unused labeled volumes. Unknown directories, symlinks, active resources, and unlabeled OCI resources are skipped.
+
+Crash recovery relies on the same labels and durable artifacts. An operator can rerun cleanup after a process crash. The harness does not issue broad container/volume prune commands and never deletes an unlabeled OCI resource.
+
+## Migration from 0.5.x
+
+Configuration schema version advances from `3` to `4`. Update schema-pinned callers and regenerated configuration snapshots. The run-store database schema does not require a rewrite.
+
+The default backend remains `none`, so upgrades do not unexpectedly start a container daemon or expose shell execution. Enable OCI explicitly and preload its image. Paused runs created with `0.5.x` have a different harness/tool fingerprint and should be completed with their original version rather than silently rebound.
+
+Applications constructing the harness can inject a `HarnessOciRuntimeAdapter` for a controlled runtime implementation. They should use the exported SDK environment rather than bypassing authorization or importing snapshot files directly.
+
+## Certification
+
+The deterministic tests use an injected runtime to cover acquisition, secret exclusion, snapshot-only mutation, patch binding/import, separate approvals, image-fingerprint resume rejection, release, and safe artifact cleanup. The installed-package smoke imports the public OCI API and proves that a consumer can perform the same snapshot/import flow.
+
+`bun run smoke:oci` exercises a real Docker/Podman daemon and preloaded image. It verifies secret exclusion, denied outbound network, denied root-filesystem writes, snapshot mutation, enforced workspace capacity, package checks, host non-mutation before import, approved import, cancellation, release, orphan cleanup, and artifact retention cleanup. It skips locally when no daemon is available unless `ZHIVEX_HARNESS_OCI_REQUIRED=1`; Linux CI, release validation, and live certification set that variable so absence is a failure.
+
+Provider certification is separate and billable. The live workflow runs the required OCI gate before the model-directed Meta, Qwen, and OpenAI matrices. A deterministic OCI pass does not by itself certify a provider, and live provider success does not replace exact installed-artifact or published-registry proof.
+
+## Known limits
+
+- Docker and Podman use different host security implementations; current gates certify behavior, not identical internals.
+- The default Bun image and read-only host `node_modules` mount optimize JavaScript/TypeScript checks. Other ecosystems need an explicit image and executable allowlist, and dependencies should be prepared without exposing secrets.
+- The local container daemon, kernel, image, and mounted dependency tree remain trusted. This backend is not a microVM boundary.
+- Network is deny-only in this policy version. Domain allowlists, package installation, browser automation, and network MCP require a future policy/backend rather than an implicit exception.
+- Patch import accepts bounded UTF-8 text changes only. Binary artifacts and large generated trees must use a future reviewed artifact-transfer contract.
+- Per-file atomic publication plus best-effort rollback is not a transaction across power loss or hostile concurrent host writers.
+- The harness does not build, pull, scan, sign, or attest the configured image. Operators should pin and govern images according to their deployment policy.

package/docs/EXTENSIBILITY.md

@@ -131,6 +131,6 @@ Human terminal mode reports child start and finish telemetry. `run-result` JSON
 - The built-in MCP transport implements bounded JSON-RPC over Streamable HTTP response forms; it does not support OAuth discovery, server-initiated sampling, roots, subscriptions, elicitation, or arbitrary SSE reconnection.
 - MCP prompt-injection detection is a safety filter, not a proof that remote content is trustworthy.
 - Parallel review groups have a durable shared parent identifier, but the group itself is not a standalone persisted agent state.
-- Subagents share the host process and workspace. They are policy boundaries, not OS isolation.
-- Generic shell, `stdio` MCP, containers, network namespaces, and remote workers remain `0.6.x` scope.
+- With `execution=none`, subagents share the host process and workspace and are policy boundaries rather than OS isolation. With `execution=oci`, they inherit the same acquired snapshot and environment authorization; this does not turn the local container runtime into a VM.
+- Generic host shell, `stdio` MCP, network-enabled OCI policies, and remote workers remain unavailable. The `0.6.x` OCI policy rejects all MCP before discovery rather than executing an undeclared client outside the acquired boundary.
 - Provider-specific orchestration behavior requires date-bound live certification and is separate from deterministic implementation evidence.

package/docs/HOSTILE_REPOSITORY_DEMO.md

@@ -0,0 +1,97 @@
+# Hostile repository demonstration
+
+The hostile-repository demo is a reproducible product proof for the governed change path in Zhivex Harness `0.6.x`. It uses a disposable repository with malicious instructions and a decoy `.env`; it never targets the checkout from which the command is launched.
+
+## What it proves
+
+One run exercises the real harness contracts in this order:
+
+1. create a secret-bearing hostile fixture under the operating-system temporary directory;
+2. request one allowlisted Bun command and stop at a durable `run_environment_command` approval;
+3. close and reopen the SQLite-backed harness before approving the command;
+4. verify from inside OCI that `.env` is absent and outbound network is denied;
+5. modify only the ephemeral snapshot and inspect the content- and run-bound patch;
+6. stop at a different durable `apply_environment_patch` approval while the host remains unchanged;
+7. reopen again, approve the exact patch, import it once, and inspect the redacted ledger; and
+8. create another reviewed patch, change its host target concurrently, and prove that import fails closed without overwriting the developer edit.
+
+The model in this demo is deterministic and scripted. That keeps the proof focused on control-plane behavior rather than model quality, latency, cost, or prompt-following variance.
+
+## Prerequisites
+
+- Bun 1.3.7 or newer;
+- Docker or Podman running locally; and
+- the configured image already present locally.
+
+The default command uses Docker and `oven/bun:1.3.7-slim`:
+
+```bash
+bun install --frozen-lockfile
+docker pull oven/bun:1.3.7-slim
+bun run build
+bun run demo:hostile
+```
+
+Use the existing OCI environment variables to select Podman, a different preloaded image, or narrower limits. The harness never pulls an image implicitly.
+
+## Expected evidence
+
+Progress is written to stderr. A successful run writes one JSON document to stdout:
+
+```json
+{
+  "schemaVersion": 1,
+  "kind": "hostile-repository-demo",
+  "ok": true,
+  "runId": "hostile-demo-approved",
+  "approvals": [
+    "run_environment_command",
+    "apply_environment_patch"
+  ],
+  "persistenceReopens": 2,
+  "secretExcluded": true,
+  "networkDenied": true,
+  "hostUnchangedUntilApprovedImport": true,
+  "exactlyOnceJournal": true,
+  "staleHostImportBlocked": true,
+  "redactedLedger": true
+}
+```
+
+The output also includes the immutable image digest used for the proof. Pass `--keep` to retain the disposable workspace and print its location:
+
+```bash
+bun run demo:hostile --keep
+```
+
+The kept directory contains only fixture data and harness-owned evidence. Remove it when inspection is complete.
+
+## Ninety-second recording outline
+
+1. Show the hostile README and decoy `.env` fixture description.
+2. Run `bun run demo:hostile`.
+3. Highlight the first command approval and SQLite reopen.
+4. Highlight `secretExcluded` and `networkDenied` from the OCI result.
+5. Show that the host file stays unchanged until the separate import approval.
+6. Highlight the completed exactly-once journal and redacted ledger.
+7. End on the rejected stale-host import and the final JSON proof.
+
+Suggested title: **Can your coding agent survive a hostile repository?**
+
+## Live provider follow-up
+
+The deterministic demo does not certify model-directed tool use. The billable live gate separately requires Meta, Qwen, and OpenAI to choose the exact OCI command, inspect the resulting patch, preserve both approvals, and import it:
+
+```bash
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:execution
+```
+
+Provider evidence is date-, model-, endpoint-, account-, and credential-dependent. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
+
+## Evidence limits
+
+- Docker/Podman containers are not virtual machines or a managed hostile-code sandbox.
+- The demo proves the documented policy against its exact fixture, runtime, image, and platform; it does not prove that arbitrary untrusted code is harmless.
+- A redacted operational export is a defensive boundary, not a substitute for controlling prompts, repository eligibility, or operator access.
+- The demo auto-approves only after asserting the expected pending operation inside a disposable fixture. Production operators should review each approval or use `--yes` only in an intentionally disposable environment.
+- Coding quality and broad task success belong to separate evaluation and live-provider gates.

package/docs/LIVE_CERTIFICATION.md

@@ -42,7 +42,7 @@ Optional model overrides are:
 
 Endpoint, Qwen workspace, and Qwen region overrides use the normal `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, and `OPENAI_BASE_URL` variables.
 
-The separate `0.5.x` delegation matrix uses the same opt-in, provider selection, credentials, and model overrides:
+The separate delegation matrix uses the same opt-in, provider selection, credentials, and model overrides:
 
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:orchestration
@@ -82,7 +82,7 @@ The complete delegation matrix passed at `2026-08-17T02:21:45.553Z`. Each provid
 
 This certifies the bounded reviewer-delegation path, not arbitrary task quality or every subagent profile.
 
-The separate controlled MCP interoperability gate passed at `2026-08-17T13:05:05.542Z` against a real loopback Streamable HTTP server. It exercised protocol `2025-06-18`, authorization and protocol headers, session negotiation, `initialize`, `notifications/initialized`, `tools/list`, `tools/call`, JSON and SSE responses, schema-backed discovery, bounded output, and the forced interrupt-approval policy for network tools. Run it with:
+The separate controlled MCP interoperability gate passed at `2026-08-17T16:48:09.043Z` against a real loopback Streamable HTTP server. It exercised protocol `2025-06-18`, authorization and protocol headers, session negotiation, `initialize`, `notifications/initialized`, `tools/list`, `tools/call`, JSON and SSE responses, schema-backed discovery, bounded output, and the forced interrupt-approval policy for network tools. Run it with:
 
 ```bash
 bun run smoke:mcp
@@ -90,6 +90,49 @@ bun run smoke:mcp
 
 This is stronger than an injected `fetch` fixture because it uses the operating system network stack and a running server. It certifies the harness transport contract against the controlled implementation; it does not claim compatibility with every third-party MCP server or unsupported `stdio` transport.
 
+## 0.6.0 execution and interoperability status
+
+`0.6.0` adds a third, independent MCP transport gate implemented with the official `@modelcontextprotocol/server@2.0.0` package. It passed at `2026-08-17T16:48:09.141Z` over a real loopback Streamable HTTP endpoint. The harness negotiated its supported `2025-06-18` protocol through the server's documented legacy-stateless compatibility mode, discovered one schema-backed tool, preserved the mandatory network approval, called it exactly once, and validated the bounded response.
+
+```bash
+bun run smoke:mcp:official
+```
+
+This is interoperability evidence for that exact SDK version and compatibility mode, not a claim that the harness implements the newer `2026-07-28` wire protocol or every official SDK feature.
+
+Enforced execution has separate evidence layers:
+
+- deterministic injected-runtime tests for environment/session semantics;
+- installed-package proof for the exported execution API;
+- `ZHIVEX_HARNESS_OCI_REQUIRED=1 bun run smoke:oci` for the real Docker/Podman boundary;
+- billable provider matrices for model-directed tools and delegation.
+
+The final real Docker gate passed on macOS/Docker Desktop at `2026-08-17T16:48Z` with Docker `29.7.2` and image digest `sha256:b7d0366ff1c11bd3897aeaca2e3d215ee1e5902932073434ffc9186ca0a3ac96`. It verified secret exclusion, denied outbound network, a read-only root, total-workspace and changed-file quotas, read-only dependency reuse without snapshot persistence, the configured cgroup PID ceiling under a spawn burst, memory exhaustion containment, combined-output termination, prompt cancellation with immediate container removal, transactional snapshot publication, isolated package checks, approved host patch import, terminal artifact cleanup, and zero remaining harness-labeled containers or volumes.
+
+The live workflow requires this real OCI gate before provider execution. Date-bound model-directed environment results are recorded only after the provider commands complete; implementation, credential presence, or the container result alone is not provider certification.
+
+The billable model-directed matrix is:
+
+```bash
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:execution
+```
+
+For each selected provider it requires exactly one approved argv-only environment command, one patch inspection, and one separately approved host import. It verifies exact tool order, durable journal completion, host contents, image/environment binding, and the provider-specific completion token.
+
+The complete Meta/Qwen/OpenAI enforced-execution matrix passed together against the final quota-backed workspace implementation at `2026-08-17T16:49:12.975Z` and image digest `sha256:b7d0366ff1c11bd3897aeaca2e3d215ee1e5902932073434ffc9186ca0a3ac96`.
+
+| Provider | Model | Result | Evidence |
+| --- | --- | --- | --- |
+| Meta | `muse-spark-1.2` | Certified | One approved OCI command, one patch inspection, one separately approved import, exact host contents, and environment binding. |
+| Qwen | `qwen3.8-max` | Certified | One approved OCI command, one patch inspection, one separately approved import, exact host contents, and environment binding. |
+| OpenAI | `gpt-5.4` | Certified | Responses mode persisted across both approval continuations; exact OCI tool order, host import, journal, and binding passed. |
+
+The base proposal/approval/process-restart matrix passed again for all three providers at `2026-08-17T16:22:34.885Z`. The reviewer-delegation/child-persistence/SQLite-reopen/hierarchy/aggregate-budget matrix passed again at `2026-08-17T16:24:14.381Z`. These refreshes cover the `0.6.0` dependency and harness artifact; registry publication is proved separately.
+
+The full deterministic gate then passed with 99 tests, 468 assertions, seven golden evaluations, both MCP implementations, real OCI, and installed-package smoke. The exact 31-file tarball passed SHA-512 inspection and isolated consumer execution. `@zhivex-ai/harness@0.6.0` was subsequently published through the protected OIDC workflow; on 2026-08-17 America/Argentina/Buenos_Aires, the downloaded registry tarball, `latest` tag, integrity, SLSA subject, repository, workflow, branch, and source commit were verified against `fd420f7560b2`.
+
+`0.6.1` does not change provider, tool, approval, execution, or streaming behavior, so it inherits this date-bound provider evidence subject to the normal exact-artifact and registry release gates. Its new hostile-repository demo is deterministic control-plane evidence, not a substitute for the billable provider matrix.
+
 ## 0.3.0 private-milestone evidence
 
 Evidence collected on 2026-08-16 with the default models and locally configured account. After aligning the gate with the required proposal-first workflow, Qwen and OpenAI passed together at `2026-08-16T23:37:23.791Z`. After upgrading to `@zhivex-ai/meta@0.2.1`, Meta passed four consecutive runs from `2026-08-16T23:32:50.716Z` through `2026-08-16T23:33:27.161Z`.

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
 # Release process
 
-`@zhivex-ai/harness@0.5.0` is configured as a public npm package, but publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, transfers, and publishes one exact tarball. Creating a tag alone does not publish anything.
+`@zhivex-ai/harness@0.6.0` is public on npm with exact registry integrity and SLSA workflow provenance verified against source tag `v0.6.0`. `0.6.1` is the next source candidate, but publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, transfers, and publishes one exact tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything.
 
 ## Deterministic gates
 
@@ -13,7 +13,7 @@ git diff --check
 git status --short
 ```
 
-`bun run release:check` performs documentation validation, typechecking, deterministic tests, the golden evaluation gate, a dependency-externalized build, package-content validation, clean tarball installation, direct binary execution, public import, SQLite restart/resume, redacted inspection, exactly-once side-effect verification, dependency audit, untrusted lifecycle-script inspection, dry-run packing, and release metadata validation.
+`bun run release:check` performs documentation validation, typechecking, deterministic tests, the golden evaluation gate, the required real-OCI boundary gate, a dependency-externalized build, package-content validation, clean tarball installation, direct binary execution, public import, SDK execution-environment import, SQLite restart/resume, redacted inspection, exactly-once side-effect verification, dependency audit, untrusted lifecycle-script inspection, dry-run packing, and release metadata validation.
 
 CI repeats the deterministic and installed-package gates on Linux and macOS. Build output is ignored and must not create tracked changes.
 
@@ -24,9 +24,11 @@ Provider behavior is certified separately because it is credential-, account-, m
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run scripts/live-provider-smoke.ts
 ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:orchestration
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:execution
+ZHIVEX_HARNESS_OCI_REQUIRED=1 bun run smoke:oci
 ```
 
-The base reviewed-edit gate and the separate `0.5.x` delegation gate must pass for every provider in the supported release matrix. Integrated provisional providers are reported separately and must not be described as certified. `bun run check` also runs the controlled loopback Streamable HTTP MCP interoperability gate; third-party server claims remain separate. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
+The base reviewed-edit gate and the separate delegation gate must pass for every provider in the supported release matrix. The `0.6.x` workflow must additionally pass the real OCI boundary before live model execution; model-directed environment use is recorded separately from deterministic container enforcement. Integrated provisional providers are reported separately and must not be described as certified. `bun run check` also runs controlled Streamable HTTP MCP interoperability gates; each external implementation claim remains bounded to the tested server/version. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
 
 ## Exact artifact gate
 
@@ -46,31 +48,24 @@ For a local artifact rehearsal after the source gate:
 
 ```bash
 mkdir -p release-artifacts
-bun pm pack --filename release-artifacts/zhivex-ai-harness-0.5.0.tgz --ignore-scripts
-bun run artifact:check -- release-artifacts/zhivex-ai-harness-0.5.0.tgz
-bun run smoke:artifact -- release-artifacts/zhivex-ai-harness-0.5.0.tgz
+bun pm pack --filename release-artifacts/zhivex-ai-harness-0.6.1.tgz --ignore-scripts
+bun run artifact:check -- release-artifacts/zhivex-ai-harness-0.6.1.tgz
+bun run smoke:artifact -- release-artifacts/zhivex-ai-harness-0.6.1.tgz
 ```
 
 `release-artifacts/`, `.npmrc`, `.env`, source tests, Git metadata, and local run state are excluded from the package.
 
 ## External prerequisites
 
-Before the first dispatch:
+Before a `0.6.1` dispatch, reverify rather than assuming the previous release state:
 
-- make `Zhivex/zhivex-harness` public; npm cannot generate public provenance from a private repository;
+- confirm `Zhivex/zhivex-harness` remains public; npm cannot generate public provenance from a private repository;
 - enable GitHub private vulnerability reporting;
 - protect the GitHub `npm` environment with required reviewers and restrict it to `main`/release tags;
-- verify an npm account with 2FA can create public packages in the `@zhivex-ai` scope; and
-- verify `@zhivex-ai/harness` is still unclaimed.
+- verify an npm account with 2FA still administers the public `@zhivex-ai/harness` package; and
+- confirm the npm Trusted Publisher is organization `Zhivex`, repository `zhivex-harness`, workflow `release.yml`, environment `npm`, allowed action `npm publish`.
 
-The package does not yet exist on npm, and npm requires a package to exist before Trusted Publishing can be configured. For `0.5.0` only, create a temporary granular npm token with the minimum available organization scope, store it as `NPM_TOKEN` in the protected `npm` environment, and remove it immediately after the first successful publication. The workflow still publishes from GitHub Actions with `--provenance`.
-
-After `0.5.0` exists:
-
-1. configure its npm Trusted Publisher as organization `Zhivex`, repository `zhivex-harness`, workflow `release.yml`, environment `npm`, allowed action `npm publish`;
-2. set package publishing access to require 2FA and disallow tokens;
-3. delete the GitHub `NPM_TOKEN` secret and revoke the temporary token; and
-4. use OIDC-only workflow publication for every later version.
+The one-time `0.5.0` bootstrap and the protected `0.6.0` publication are complete: the package exists, Trusted Publishing is configured, and the temporary token was removed/revoked. The release workflow intentionally supplies no `NODE_AUTH_TOKEN` or npm token. Do not reintroduce one as a fallback; a failed OIDC assertion is a stop condition to diagnose.
 
 Trusted Publishing currently requires npm CLI `11.5.1` or newer and Node `22.14.0` or newer. The workflow follows npm's current Node 24 guidance and uses npm only for the OIDC/provenance-aware registry transaction; dependency management, build, tests, packing, and artifact installation remain Bun-first.
 
@@ -79,10 +74,10 @@ Trusted Publishing currently requires npm CLI `11.5.1` or newer and Node `22.14.
 After the release commit is reviewed, merged, and pushed to `main`:
 
 ```bash
-git tag -a v0.5.0 -m "Release v0.5.0"
-git push origin v0.5.0
+git tag -a v0.6.1 -m "Release v0.6.1"
+git push origin v0.6.1
 gh workflow run release.yml \
-  -f tag=v0.5.0 \
+  -f tag=v0.6.1 \
   -f channel=latest \
   -f confirm_publication=true
 ```
@@ -100,7 +95,7 @@ Do not dispatch or approve publication when any of these is true:
 - package scope ownership, 2FA, the intended `public` access level, or the protected environment is unclear;
 - the inspected package contents and the to-be-published artifact are not the same file;
 - the package version already exists in npm;
-- the temporary first-release credential is broader or longer-lived than necessary;
+- an npm token or `NODE_AUTH_TOKEN` has been reintroduced into the OIDC-only workflow;
 - Trusted Publishing is expected but its repository, workflow filename, environment, or allowed action disagrees with the workflow; or
 - version, changelog, tag, registry metadata, source commit, integrity, or provenance disagree.
 

package/docs/REPOSITORY_EDITING.md

@@ -82,6 +82,8 @@ Checks do not load the workspace `.env` automatically. A non-zero exit, timeout,
 
 `git_diff` is read-only and reports the repository status, unstaged diff, and staged diff as separate results, including renamed, deleted, and untracked paths. `mutation_audit` returns the harness mutation history for the current workspace process.
 
+With enforced OCI execution, `git_diff` is intentionally omitted from the model tool set because the Git repository remains on the canonical host outside the snapshot boundary. The model reviews `mutation_audit` and the content-bound environment patch instead; the CLI/library result reports canonical host Git evidence after an approved import.
+
 Every mutation audit entry includes an identifier, operation, affected path, timestamp, and the available before/after digest evidence. Move and restore operations may include a destination; quarantine-related entries may include a quarantine identifier.
 
 Before completion, an editing run should report:
@@ -115,4 +117,4 @@ The new quarantine and audit state is harness-owned and must remain excluded fro
 - Git rename detection is heuristic and may display a delete plus add for heavily rewritten content.
 - Ignore evaluation and filesystem behavior can differ by platform; Linux and macOS fixtures are required release gates.
 - Quarantine does not replace version control or an external backup.
-- Checks execute with the local process permissions. Enforced shell and filesystem isolation is planned for `0.6.0`.
+- With the default `execution=none`, checks use the narrow host check runner and generic shell remains unavailable. With `execution=oci`, repository tools and checks operate on a secret-free snapshot and only a separately approved digest-bound environment patch may change the host workspace.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "0.5.0",
-  "description": "Provider-portable coding agent harness powered by Zhivex AI SDK.",
+  "version": "0.6.1",
+  "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -21,6 +21,14 @@
     "ai",
     "agents",
     "coding-agent",
+    "agent-runtime",
+    "agent-governance",
+    "sandbox",
+    "durable-workflows",
+    "mcp",
+    "docker",
+    "typescript",
+    "bun",
     "harness",
     "zhivex"
   ],
@@ -48,7 +56,7 @@
   "scripts": {
     "dev": "bun run src/cli.ts",
     "start": "bun run dist/cli.js",
-    "build": "bun build ./src/index.ts ./src/cli.ts --outdir ./dist --target bun --packages external && tsc --emitDeclarationOnly",
+    "build": "bun build ./src/index.ts ./src/cli.ts --outdir ./dist --target bun --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target bun --packages external && tsc --emitDeclarationOnly",
     "prepack": "bun run build",
     "docs:check": "bun run scripts/check-docs.ts",
     "typecheck": "tsc --noEmit",
@@ -57,24 +65,32 @@
     "smoke:package": "bun run build && bun run scripts/package-smoke.ts",
     "smoke:artifact": "bun run scripts/package-smoke.ts",
     "smoke:mcp": "bun run scripts/mcp-interoperability-smoke.ts",
+    "smoke:mcp:official": "bun run scripts/mcp-official-sdk-smoke.ts",
+    "smoke:oci": "bun run scripts/oci-execution-smoke.ts",
     "smoke:live": "bun --env-file=.env run scripts/live-provider-smoke.ts",
     "smoke:live:orchestration": "bun --env-file=.env run scripts/live-orchestration-smoke.ts",
+    "smoke:live:execution": "bun --env-file=.env run scripts/live-execution-smoke.ts",
+    "demo:hostile": "bun run dist/hostile-repository-demo.js",
     "artifact:check": "bun run scripts/check-release-artifact.ts",
     "pack:inspect": "bun run build && bun pm pack --dry-run --ignore-scripts",
-    "check": "bun run docs:check && bun run typecheck && bun test && bun run evaluate && bun run smoke:mcp && bun run smoke:package",
+    "check": "bun run docs:check && bun run typecheck && bun test && bun run evaluate && bun run smoke:mcp && bun run smoke:mcp:official && bun run smoke:oci && bun run smoke:package",
     "release:check": "bun run check && bun audit && bun pm untrusted && bun run pack:inspect && bun run scripts/check-release-readiness.ts",
     "release:status": "bun run scripts/check-registry-release-status.ts",
     "release:verify": "bun run scripts/verify-registry-release.ts"
   },
   "dependencies": {
     "@zhivex-ai/agents": "1.2.0",
-    "@zhivex-ai/core": "1.5.0",
+    "@zhivex-ai/core": "1.6.0",
     "@zhivex-ai/meta": "0.2.1",
-    "@zhivex-ai/openai": "0.9.4",
+    "@zhivex-ai/openai": "0.9.5",
     "@zhivex-ai/qwen": "0.10.1",
     "zod": "4.4.3"
   },
+  "overrides": {
+    "@zhivex-ai/core": "1.6.0"
+  },
   "devDependencies": {
+    "@modelcontextprotocol/server": "2.0.0",
     "@types/bun": "1.3.14",
     "typescript": "6.0.3"
   },