@zhivex-ai/harness 0.6.0 → 0.6.1

package/docs/HOSTILE_REPOSITORY_DEMO.md

@@ -0,0 +1,97 @@
+# Hostile repository demonstration
+
+The hostile-repository demo is a reproducible product proof for the governed change path in Zhivex Harness `0.6.x`. It uses a disposable repository with malicious instructions and a decoy `.env`; it never targets the checkout from which the command is launched.
+
+## What it proves
+
+One run exercises the real harness contracts in this order:
+
+1. create a secret-bearing hostile fixture under the operating-system temporary directory;
+2. request one allowlisted Bun command and stop at a durable `run_environment_command` approval;
+3. close and reopen the SQLite-backed harness before approving the command;
+4. verify from inside OCI that `.env` is absent and outbound network is denied;
+5. modify only the ephemeral snapshot and inspect the content- and run-bound patch;
+6. stop at a different durable `apply_environment_patch` approval while the host remains unchanged;
+7. reopen again, approve the exact patch, import it once, and inspect the redacted ledger; and
+8. create another reviewed patch, change its host target concurrently, and prove that import fails closed without overwriting the developer edit.
+
+The model in this demo is deterministic and scripted. That keeps the proof focused on control-plane behavior rather than model quality, latency, cost, or prompt-following variance.
+
+## Prerequisites
+
+- Bun 1.3.7 or newer;
+- Docker or Podman running locally; and
+- the configured image already present locally.
+
+The default command uses Docker and `oven/bun:1.3.7-slim`:
+
+```bash
+bun install --frozen-lockfile
+docker pull oven/bun:1.3.7-slim
+bun run build
+bun run demo:hostile
+```
+
+Use the existing OCI environment variables to select Podman, a different preloaded image, or narrower limits. The harness never pulls an image implicitly.
+
+## Expected evidence
+
+Progress is written to stderr. A successful run writes one JSON document to stdout:
+
+```json
+{
+  "schemaVersion": 1,
+  "kind": "hostile-repository-demo",
+  "ok": true,
+  "runId": "hostile-demo-approved",
+  "approvals": [
+    "run_environment_command",
+    "apply_environment_patch"
+  ],
+  "persistenceReopens": 2,
+  "secretExcluded": true,
+  "networkDenied": true,
+  "hostUnchangedUntilApprovedImport": true,
+  "exactlyOnceJournal": true,
+  "staleHostImportBlocked": true,
+  "redactedLedger": true
+}
+```
+
+The output also includes the immutable image digest used for the proof. Pass `--keep` to retain the disposable workspace and print its location:
+
+```bash
+bun run demo:hostile --keep
+```
+
+The kept directory contains only fixture data and harness-owned evidence. Remove it when inspection is complete.
+
+## Ninety-second recording outline
+
+1. Show the hostile README and decoy `.env` fixture description.
+2. Run `bun run demo:hostile`.
+3. Highlight the first command approval and SQLite reopen.
+4. Highlight `secretExcluded` and `networkDenied` from the OCI result.
+5. Show that the host file stays unchanged until the separate import approval.
+6. Highlight the completed exactly-once journal and redacted ledger.
+7. End on the rejected stale-host import and the final JSON proof.
+
+Suggested title: **Can your coding agent survive a hostile repository?**
+
+## Live provider follow-up
+
+The deterministic demo does not certify model-directed tool use. The billable live gate separately requires Meta, Qwen, and OpenAI to choose the exact OCI command, inspect the resulting patch, preserve both approvals, and import it:
+
+```bash
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:execution
+```
+
+Provider evidence is date-, model-, endpoint-, account-, and credential-dependent. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
+
+## Evidence limits
+
+- Docker/Podman containers are not virtual machines or a managed hostile-code sandbox.
+- The demo proves the documented policy against its exact fixture, runtime, image, and platform; it does not prove that arbitrary untrusted code is harmless.
+- A redacted operational export is a defensive boundary, not a substitute for controlling prompts, repository eligibility, or operator access.
+- The demo auto-approves only after asserting the expected pending operation inside a disposable fixture. Production operators should review each approval or use `--yes` only in an intentionally disposable environment.
+- Coding quality and broad task success belong to separate evaluation and live-provider gates.

package/docs/LIVE_CERTIFICATION.md

@@ -127,9 +127,11 @@ The complete Meta/Qwen/OpenAI enforced-execution matrix passed together against
 | Qwen | `qwen3.8-max` | Certified | One approved OCI command, one patch inspection, one separately approved import, exact host contents, and environment binding. |
 | OpenAI | `gpt-5.4` | Certified | Responses mode persisted across both approval continuations; exact OCI tool order, host import, journal, and binding passed. |
 
-The base proposal/approval/process-restart matrix passed again for all three providers at `2026-08-17T16:22:34.885Z`. The reviewer-delegation/child-persistence/SQLite-reopen/hierarchy/aggregate-budget matrix passed again at `2026-08-17T16:24:14.381Z`. These refreshes cover the `0.6.0` dependency and harness candidate; they do not prove registry publication.
+The base proposal/approval/process-restart matrix passed again for all three providers at `2026-08-17T16:22:34.885Z`. The reviewer-delegation/child-persistence/SQLite-reopen/hierarchy/aggregate-budget matrix passed again at `2026-08-17T16:24:14.381Z`. These refreshes cover the `0.6.0` dependency and harness artifact; registry publication is proved separately.
 
-The full deterministic gate then passed with 99 tests, 468 assertions, seven golden evaluations, both MCP implementations, real OCI, and installed-package smoke. The exact local 31-file tarball also passed SHA-512 inspection and isolated consumer execution. npm still reports `0.5.0` as latest and no `0.6.0` version; registry publication/provenance remain deliberately unclaimed.
+The full deterministic gate then passed with 99 tests, 468 assertions, seven golden evaluations, both MCP implementations, real OCI, and installed-package smoke. The exact 31-file tarball passed SHA-512 inspection and isolated consumer execution. `@zhivex-ai/harness@0.6.0` was subsequently published through the protected OIDC workflow; on 2026-08-17 America/Argentina/Buenos_Aires, the downloaded registry tarball, `latest` tag, integrity, SLSA subject, repository, workflow, branch, and source commit were verified against `fd420f7560b2`.
+
+`0.6.1` does not change provider, tool, approval, execution, or streaming behavior, so it inherits this date-bound provider evidence subject to the normal exact-artifact and registry release gates. Its new hostile-repository demo is deterministic control-plane evidence, not a substitute for the billable provider matrix.
 
 ## 0.3.0 private-milestone evidence
 

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
 # Release process
 
-`@zhivex-ai/harness@0.5.0` is public on npm. `0.6.0` is implemented as the next source candidate, but publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, transfers, and publishes one exact tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything.
+`@zhivex-ai/harness@0.6.0` is public on npm with exact registry integrity and SLSA workflow provenance verified against source tag `v0.6.0`. `0.6.1` is the next source candidate, but publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, transfers, and publishes one exact tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything.
 
 ## Deterministic gates
 
@@ -48,16 +48,16 @@ For a local artifact rehearsal after the source gate:
 
 ```bash
 mkdir -p release-artifacts
-bun pm pack --filename release-artifacts/zhivex-ai-harness-0.6.0.tgz --ignore-scripts
-bun run artifact:check -- release-artifacts/zhivex-ai-harness-0.6.0.tgz
-bun run smoke:artifact -- release-artifacts/zhivex-ai-harness-0.6.0.tgz
+bun pm pack --filename release-artifacts/zhivex-ai-harness-0.6.1.tgz --ignore-scripts
+bun run artifact:check -- release-artifacts/zhivex-ai-harness-0.6.1.tgz
+bun run smoke:artifact -- release-artifacts/zhivex-ai-harness-0.6.1.tgz
 ```
 
 `release-artifacts/`, `.npmrc`, `.env`, source tests, Git metadata, and local run state are excluded from the package.
 
 ## External prerequisites
 
-Before a `0.6.0` dispatch, reverify rather than assuming the previous release state:
+Before a `0.6.1` dispatch, reverify rather than assuming the previous release state:
 
 - confirm `Zhivex/zhivex-harness` remains public; npm cannot generate public provenance from a private repository;
 - enable GitHub private vulnerability reporting;
@@ -65,7 +65,7 @@ Before a `0.6.0` dispatch, reverify rather than assuming the previous release st
 - verify an npm account with 2FA still administers the public `@zhivex-ai/harness` package; and
 - confirm the npm Trusted Publisher is organization `Zhivex`, repository `zhivex-harness`, workflow `release.yml`, environment `npm`, allowed action `npm publish`.
 
-The one-time `0.5.0` bootstrap is complete: the package exists, Trusted Publishing is configured, and the temporary token was removed/revoked. The release workflow intentionally supplies no `NODE_AUTH_TOKEN` or npm token. Do not reintroduce one as a fallback; a failed OIDC assertion is a stop condition to diagnose.
+The one-time `0.5.0` bootstrap and the protected `0.6.0` publication are complete: the package exists, Trusted Publishing is configured, and the temporary token was removed/revoked. The release workflow intentionally supplies no `NODE_AUTH_TOKEN` or npm token. Do not reintroduce one as a fallback; a failed OIDC assertion is a stop condition to diagnose.
 
 Trusted Publishing currently requires npm CLI `11.5.1` or newer and Node `22.14.0` or newer. The workflow follows npm's current Node 24 guidance and uses npm only for the OIDC/provenance-aware registry transaction; dependency management, build, tests, packing, and artifact installation remain Bun-first.
 
@@ -74,10 +74,10 @@ Trusted Publishing currently requires npm CLI `11.5.1` or newer and Node `22.14.
 After the release commit is reviewed, merged, and pushed to `main`:
 
 ```bash
-git tag -a v0.6.0 -m "Release v0.6.0"
-git push origin v0.6.0
+git tag -a v0.6.1 -m "Release v0.6.1"
+git push origin v0.6.1
 gh workflow run release.yml \
-  -f tag=v0.6.0 \
+  -f tag=v0.6.1 \
   -f channel=latest \
   -f confirm_publication=true
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "0.6.0",
-  "description": "Provider-portable coding agent harness powered by Zhivex AI SDK.",
+  "version": "0.6.1",
+  "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -21,6 +21,14 @@
     "ai",
     "agents",
     "coding-agent",
+    "agent-runtime",
+    "agent-governance",
+    "sandbox",
+    "durable-workflows",
+    "mcp",
+    "docker",
+    "typescript",
+    "bun",
     "harness",
     "zhivex"
   ],
@@ -48,7 +56,7 @@
   "scripts": {
     "dev": "bun run src/cli.ts",
     "start": "bun run dist/cli.js",
-    "build": "bun build ./src/index.ts ./src/cli.ts --outdir ./dist --target bun --packages external && tsc --emitDeclarationOnly",
+    "build": "bun build ./src/index.ts ./src/cli.ts --outdir ./dist --target bun --packages external && bun build ./scripts/hostile-repository-demo.ts --outfile ./dist/hostile-repository-demo.js --target bun --packages external && tsc --emitDeclarationOnly",
     "prepack": "bun run build",
     "docs:check": "bun run scripts/check-docs.ts",
     "typecheck": "tsc --noEmit",
@@ -62,6 +70,7 @@
     "smoke:live": "bun --env-file=.env run scripts/live-provider-smoke.ts",
     "smoke:live:orchestration": "bun --env-file=.env run scripts/live-orchestration-smoke.ts",
     "smoke:live:execution": "bun --env-file=.env run scripts/live-execution-smoke.ts",
+    "demo:hostile": "bun run dist/hostile-repository-demo.js",
     "artifact:check": "bun run scripts/check-release-artifact.ts",
     "pack:inspect": "bun run build && bun pm pack --dry-run --ignore-scripts",
     "check": "bun run docs:check && bun run typecheck && bun test && bun run evaluate && bun run smoke:mcp && bun run smoke:mcp:official && bun run smoke:oci && bun run smoke:package",