@zhivex-ai/harness 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.6.1 - 2026-08-17
+
+### Added
+
+- A reproducible hostile-repository demonstration that exercises two durable approval boundaries, SQLite reopen, secret-free OCI execution, denied outbound network, separate host patch import, exactly-once journal evidence, ledger redaction, and stale-host rejection.
+- A deterministic social-preview asset and a launch-oriented README path centered on governed repository change control.
+- Structured GitHub issue forms for reproducible bugs and bounded feature requests.
+
+### Changed
+
+- Repositioned the package as a governed, provider-portable runtime for coding agents instead of a generic coding-agent harness.
+- Expanded npm discovery metadata and documented the verified public `0.6.0` registry/provenance baseline.
+- Updated support, security, roadmap, release, and certification documentation to reflect that `0.6.0` is published.
+
+### Migration
+
+- No runtime, CLI, configuration, persisted-state, or public-library contract changes are required from `0.6.0`.
+
+### Security
+
+- The demo uses a disposable fixture and a decoy secret; it never reads or prints operator credentials.
+- The scripted proof does not weaken approvals: environment execution and host import remain separate interruptible operations.
+
 ## 0.6.0 - 2026-08-17
 
 ### Added

package/README.md

@@ -1,10 +1,44 @@
 # Zhivex Harness
 
-Zhivex Harness is a Bun-first coding-agent harness portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+**Governed execution for coding agents.**
 
-The model provides capability; the harness provides repository context, narrow tools, limits, approvals, durable state, diagnostics, and verification. Every provider uses the same agent loop and local-tool contract.
+[![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
+[![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
+[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
-Version `0.6.0` is the enforced-execution release candidate. `0.5.0` is already public on npm; `0.6.0` remains a source candidate until its exact artifact, live-provider, tag, provenance, and registry gates complete. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
+
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+
+The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
+
+Version `0.6.1` is the positioning and hostile-repository proof patch for the `0.6.x` enforced-execution line. `0.6.0` is public on npm; its exact tarball, `latest` tag, and SLSA workflow provenance were verified against source tag `v0.6.0`. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+
+## Why Zhivex Harness
+
+Provider choice, MCP, subagents, and containers are useful building blocks. Zhivex Harness focuses on the change-control path that connects them:
+
+1. copy an eligible, secret-free repository snapshot into an enforced OCI environment;
+2. execute only approved, allowlisted argv commands without host shell interpolation or container network;
+3. inspect a content- and run-bound patch while the host workspace remains unchanged;
+4. require a separate durable approval before importing that exact patch; and
+5. reject the import if either the reviewed patch or the host preconditions changed.
+
+Approvals, leases, idempotency claims, execution bindings, and exactly-once tool journals survive process restarts. Host deletions remain recoverable through quarantine, and operator exports are redacted by default.
+
+## Prove the boundary in five minutes
+
+The hostile-repository demo creates a disposable fixture containing malicious instructions and a decoy `.env`, then exercises the real OCI, approval, restart, patch-import, ledger, and stale-host boundaries:
+
+```bash
+bun install --frozen-lockfile
+docker pull oven/bun:1.3.7-slim
+bun run build
+bun run demo:hostile
+```
+
+The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
 ## What 0.6 includes
 
@@ -48,7 +82,7 @@ bun add @zhivex-ai/harness
 bunx zhivex-harness --version
 ```
 
-To exercise the unpublished `0.6.0` source candidate:
+To exercise the `0.6.1` source checkout:
 
 ```bash
 bun install --frozen-lockfile

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-17
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, `0.5.0` is published on npm, and `0.6.0` is implemented locally as the enforced-execution candidate. Publishing another immutable registry version remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` plus `0.6.0` are published on npm. `0.6.1` is the local positioning and hostile-repository proof patch; publishing it remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -38,7 +38,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.3.0` | Trusted repository editing | Reviewable and recoverable multi-file changes | Private checkpoint | M |
 | `0.4.0` | Durable operations | Inspectable, budgeted, cancellable, evaluable runs | Private checkpoint | L |
 | `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Published on npm | L |
-| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Implemented locally; certification pending | XL |
+| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
+| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Implemented locally | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -172,7 +173,7 @@ Validation snapshot (2026-08-17 UTC):
 
 Goal: introduce shell-class capabilities only when the declared filesystem, process, network, and resource controls are real.
 
-Status: 0.6.0 is implemented locally. Deterministic, exact installed-artifact, real-OCI, MCP-interoperability, and all-provider live gates pass. Publication remains distinct and has not been requested or claimed.
+Status: 0.6.0 is published on npm. Deterministic, exact installed-artifact, real-OCI, MCP-interoperability, all-provider live, registry-integrity, and SLSA provenance gates passed.
 
 Scope:
 
@@ -204,7 +205,13 @@ Implementation snapshot (2026-08-17):
 - Meta, Qwen, and OpenAI passed the final model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix together at `2026-08-17T16:49:12.975Z`;
 - the base approval/restart matrix and bounded reviewer-delegation/persistence/hierarchy matrix passed again at `2026-08-17T16:22:34.885Z` and `2026-08-17T16:24:14.381Z` respectively;
 - `@zhivex-ai/core@1.6.0` resolves as one runtime through the aligned dependency batch;
-- publication, tag, push, provenance, and registry proof for `0.6.0` remain pending the explicit release operation.
+- annotated tag `v0.6.0`, push, protected OIDC publication, exact registry integrity, the `latest` distribution tag, and SLSA workflow provenance agree with source commit `fd420f7560b2`.
+
+### 0.6.1 positioning patch
+
+`0.6.1` keeps the `0.6.0` runtime, CLI, configuration, state, and library contracts unchanged. It adds a launch-oriented package description, expanded discovery metadata, a deterministic social card, structured issue forms, and a hostile-repository demo that exposes the existing safety chain as one reproducible product proof.
+
+Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. Publication, a `v0.6.1` tag, registry integrity, and provenance are not claimed until the normal protected release workflow completes.
 
 ## 1.0.0 — Stable CLI and library contract
 
@@ -251,6 +258,7 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review the diff and create a clean release commit; the readiness checker currently blocks only on the intentionally dirty worktree.
-2. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.
-3. Merge/push the reviewed release commit, create the annotated `v0.6.0` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
+1. Review the `0.6.1` positioning/demo diff and run the full deterministic, real-OCI, and installed-artifact gates.
+2. Record the hostile-repository demo and publish the exact evidence output with the release notes.
+3. Merge/push the reviewed release commit, create the annotated `v0.6.1` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
+4. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.5.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
+Security fixes are provided for the latest published `0.6.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
+Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Supported baseline
 
@@ -10,7 +10,7 @@ Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observab
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.5.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.6.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels