@zhivex-ai/harness 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.7.0 - 2026-08-20
+
+### Added
+
+- The short `zhx` executable while retaining `zhivex-harness` for command compatibility.
+- A durable interactive console backed by a scoped SQLite session index, including session list/inspect/rename/fork/archive and `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, and `/rename` commands.
+- A public, validated, injectable provider registry with built-in Meta, Qwen, OpenAI, and provisional Gemini registrations. Gemini uses `@zhivex-ai/gemini@0.10.4` and `gemini-3.6-flash` by default.
+- Repeatable per-role model routes for explorer, implementer, tester, and reviewer subagents.
+- A redacted, sequence-numbered JSON Lines stream contract through `--jsonl`.
+
+### Changed
+
+- Provider/model changes in the console create a new immutable run and compact/redact portable context rather than rebinding an old provider state.
+- Durable harness fingerprints now include a non-secret hash of provider endpoint/region/workspace transport configuration.
+- Provider diagnostics are registry-driven and continue to expose only declared variable names and booleans.
+- The final JSON schema and resolved configuration schema remain at version `1` and `4` respectively.
+
+### Migration from 0.6.x
+
+- Prefer `zhx` for interactive use; existing `zhivex-harness` commands continue to work.
+- Resolve or deny paused `0.6.x` approvals with the matching `0.6.x` artifact before upgrading. Harness-version binding intentionally rejects those resumes under `0.7.x`.
+- Gemini is integrated but provisional until all credentialed harness live gates pass. Local tests, adapter evidence, and credential detection do not certify it.
+- `--max-cost-usd` cannot be combined with per-role routes in `0.7.x`; pricing remains one operator-supplied pair and would misprice heterogeneous usage.
+
+### Security
+
+- Session metadata excludes prompts/messages/tool payloads and is isolated by canonical workspace and durable scope with bounded storage and optimistic SQLite transactions.
+- JSONL projection omits tool inputs/outputs, approval arguments, provider payloads, images, raw errors, and full durable states.
+- Provider/model handoff is blocked while an approval is pending and strips provider-specific tool payloads from future context.
+
+## 0.6.1 - 2026-08-17
+
+### Added
+
+- A reproducible hostile-repository demonstration that exercises two durable approval boundaries, SQLite reopen, secret-free OCI execution, denied outbound network, separate host patch import, exactly-once journal evidence, ledger redaction, and stale-host rejection.
+- A deterministic social-preview asset and a launch-oriented README path centered on governed repository change control.
+- Structured GitHub issue forms for reproducible bugs and bounded feature requests.
+
+### Changed
+
+- Repositioned the package as a governed, provider-portable runtime for coding agents instead of a generic coding-agent harness.
+- Expanded npm discovery metadata and documented the verified public `0.6.0` registry/provenance baseline.
+- Updated support, security, roadmap, release, and certification documentation to reflect that `0.6.0` is published.
+
+### Migration
+
+- No runtime, CLI, configuration, persisted-state, or public-library contract changes are required from `0.6.0`.
+
+### Security
+
+- The demo uses a disposable fixture and a decoy secret; it never reads or prints operator credentials.
+- The scripted proof does not weaken approvals: environment execution and host import remain separate interruptible operations.
+
 ## 0.6.0 - 2026-08-17
 
 ### Added

package/README.md

@@ -1,15 +1,51 @@
 # Zhivex Harness
 
-Zhivex Harness is a Bun-first coding-agent harness portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+**Governed execution for coding agents.**
 
-The model provides capability; the harness provides repository context, narrow tools, limits, approvals, durable state, diagnostics, and verification. Every provider uses the same agent loop and local-tool contract.
+[![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
+[![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
+[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
-Version `0.6.0` is the enforced-execution release candidate. `0.5.0` is already public on npm; `0.6.0` remains a source candidate until its exact artifact, live-provider, tag, provenance, and registry gates complete. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-## What 0.6 includes
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
 
-- one-shot execution and interactive chat;
-- provider and model selection through the CLI;
+The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
+
+Version `0.7.0` is the source release candidate for the multi-provider agent console. The currently verified public npm release remains `0.6.1`; local validation does not imply that `0.7.0` has been published or live-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+
+## Why Zhivex Harness
+
+Provider choice, MCP, subagents, and containers are useful building blocks. Zhivex Harness focuses on the change-control path that connects them:
+
+1. copy an eligible, secret-free repository snapshot into an enforced OCI environment;
+2. execute only approved, allowlisted argv commands without host shell interpolation or container network;
+3. inspect a content- and run-bound patch while the host workspace remains unchanged;
+4. require a separate durable approval before importing that exact patch; and
+5. reject the import if either the reviewed patch or the host preconditions changed.
+
+Approvals, leases, idempotency claims, execution bindings, and exactly-once tool journals survive process restarts. Host deletions remain recoverable through quarantine, and operator exports are redacted by default.
+
+## Prove the boundary in five minutes
+
+The hostile-repository demo creates a disposable fixture containing malicious instructions and a decoy `.env`, then exercises the real OCI, approval, restart, patch-import, ledger, and stale-host boundaries:
+
+```bash
+bun install --frozen-lockfile
+docker pull oven/bun:1.3.7-slim
+bun run build
+bun run demo:hostile
+```
+
+The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
+
+## What 0.7 includes
+
+- the short `zhx` command, with `zhivex-harness` retained as a compatible alias;
+- one-shot execution plus a durable interactive console with named sessions, fork/archive operations, safe resume, status, diff, review, and explicit context compaction;
+- an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
+- redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
 - a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
@@ -45,10 +81,10 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ```bash
 bun add @zhivex-ai/harness
-bunx zhivex-harness --version
+bunx --package @zhivex-ai/harness zhx --version
 ```
 
-To exercise the unpublished `0.6.0` source candidate:
+To exercise the `0.7.0` source checkout:
 
 ```bash
 bun install --frozen-lockfile
@@ -62,28 +98,39 @@ Configure only the providers you plan to use:
 OPENAI_API_KEY=...
 MODEL_API_KEY=...
 DASHSCOPE_API_KEY=...
+GEMINI_API_KEY=...
 ```
 
-`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence.
+`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence. Gemini also accepts `GOOGLE_GENERATIVE_AI_API_KEY`.
 
 ## Diagnose the environment
 
 `doctor` is local and does not contact provider endpoints:
 
 ```bash
-zhivex-harness doctor
-zhivex-harness doctor --provider qwen --json
+zhx doctor
+zhx doctor --provider qwen --json
 ```
 
 For a source checkout, replace `zhivex-harness` with `bun run dev`.
 
 ## Usage
 
+Start the durable console with the ergonomic command, or use the long alias in existing scripts:
+
+```bash
+zhx
+zhx chat --continue
+zhivex-harness --version
+```
+
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+
 Show providers and detected configuration without printing secrets:
 
 ```bash
-zhivex-harness providers
-zhivex-harness providers --json
+zhx providers
+zhx providers --json
 ```
 
 Run a task against the current directory:
@@ -92,6 +139,7 @@ Run a task against the current directory:
 zhivex-harness run --provider openai "review the repository and fix the tests"
 zhivex-harness run --provider meta "document the current architecture"
 zhivex-harness run --provider qwen "implement the pending endpoint"
+zhx run --provider gemini "review the proposed implementation"
 ```
 
 Operate on another workspace:
@@ -103,9 +151,20 @@ zhivex-harness run --provider qwen --workspace ../my-app "fix the typecheck erro
 Interactive mode:
 
 ```bash
-zhivex-harness chat --provider meta
+zhx chat --provider meta
+zhx chat --continue
+zhx sessions list
+```
+
+Route only selected subagent roles; credentials are required only for providers actually instantiated:
+
+```bash
+zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
+  "implement the change, then review it independently"
 ```
 
+Routing with `--max-cost-usd` is rejected in `0.7.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
 ```bash
@@ -151,6 +210,7 @@ Structured automation output uses schema version `1`:
 
 ```bash
 zhivex-harness run --provider qwen --json "analyze the issue without modifying files"
+zhx run --provider gemini --jsonl "analyze the issue without modifying files"
 ```
 
 The JSON shapes and exit codes are documented in [docs/CLI.md](./docs/CLI.md).
@@ -180,10 +240,11 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 | Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 | OpenAI | `gpt-5.4` | `OPENAI_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
+| Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
 
-Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, and `OPENAI_BASE_URL`.
+Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta, Qwen, and OpenAI completed the final `0.6.0` model-directed OCI command/review/import matrix together at `2026-08-17T16:49:12.975Z`, the proposal/approval/restart refresh at `2026-08-17T16:22:34.885Z`, and the delegation/persistence/hierarchy refresh at `2026-08-17T16:24:14.381Z`. Controlled Streamable HTTP MCP interoperability over a real loopback server passed at `2026-08-17T16:48:09.043Z`; independent interoperability with `@modelcontextprotocol/server@2.0.0` passed at `2026-08-17T16:48:09.141Z` in its legacy-stateless compatibility mode. These results do not imply compatibility with every server or protocol feature. Provider capability claims are date-bound by the [live certification gate](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta, Qwen, and OpenAI retain the published `0.6.x` support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -224,4 +285,5 @@ The live gate is opt-in and billable:
 
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run scripts/live-provider-smoke.ts
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:routing
 ```

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-17
+- Baseline date: 2026-08-20
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, `0.5.0` is published on npm, and `0.6.0` is implemented locally as the enforced-execution candidate. Publishing another immutable registry version remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0`, `0.6.0`, and `0.6.1` are published on npm. `0.7.0` is the source release candidate for the multi-provider agent console; publication and live certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -38,7 +38,9 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.3.0` | Trusted repository editing | Reviewable and recoverable multi-file changes | Private checkpoint | M |
 | `0.4.0` | Durable operations | Inspectable, budgeted, cancellable, evaluable runs | Private checkpoint | L |
 | `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Published on npm | L |
-| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Implemented locally; certification pending | XL |
+| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
+| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
+| `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Source release candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -98,7 +100,7 @@ Required release evidence:
 - migration and safety boundaries are documented without claiming host isolation or permanent deletion;
 - `0.3.0` remains private until an explicit publication decision is made.
 
-Validation snapshot (2026-08-16):
+Validation summary:
 
 - the trusted-editing implementation is merged into `main`;
 - deterministic, installed-package, and package-inspection CI gates pass on Linux and macOS;
@@ -129,7 +131,7 @@ Exit criteria:
 - Golden fixtures are deterministic and the regression gate runs in CI.
 - Exported operational artifacts are redacted by default and schema-versioned.
 
-Validation snapshot (2026-08-17):
+Validation summary:
 
 - deterministic tests, the five-case golden evaluation gate, typecheck, docs, build, and installed-tarball smoke pass;
 - migration, idempotency, concurrent ownership, expired-lease recovery, cancellation, retention, Qwen token enforcement, and export redaction have regression coverage;
@@ -159,20 +161,19 @@ Exit criteria:
 - MCP prompt injection and oversized/malformed result tests fail safely.
 - Provider-specific limitations are recorded in a live support matrix.
 
-Validation snapshot (2026-08-17 UTC):
+Validation summary:
 
 - deterministic tests, the seven-case golden evaluation gate, typecheck, docs, build, dependency audit, dry-run package inspection, and installed-tarball smoke pass;
 - malformed MCP, HTTP handshake/session, injection/output bounds, approval/restart, child mutation exactly-once, cancellation, scoped hierarchy, aggregate budget, and parallel review have regression coverage;
-- controlled Streamable HTTP MCP interoperability passed over a real loopback server with session negotiation, JSON and SSE responses, tool discovery, bounded execution, and forced network approval at `2026-08-17T16:48:09.043Z`;
-- independent interoperability with `@modelcontextprotocol/server@2.0.0` passed over loopback in its documented `2025-06-18` legacy-stateless compatibility mode at `2026-08-17T16:48:09.141Z`;
-- Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.4` passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix at `2026-08-17T02:21:45.553Z`;
+- controlled and official-SDK Streamable HTTP MCP interoperability passed over real loopback transports with session negotiation, bounded execution, and forced network approval;
+- the certified provider cohort passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix;
 - the exact `0.5.0` artifact was published and its post-publication registry/provenance verification completed; that evidence does not pre-certify `0.6.0`.
 
 ## 0.6.0 — Enforced execution environments
 
 Goal: introduce shell-class capabilities only when the declared filesystem, process, network, and resource controls are real.
 
-Status: 0.6.0 is implemented locally. Deterministic, exact installed-artifact, real-OCI, MCP-interoperability, and all-provider live gates pass. Publication remains distinct and has not been requested or claimed.
+Status: 0.6.0 is published on npm. Deterministic, exact installed-artifact, real-OCI, MCP-interoperability, all-provider live, registry-integrity, and SLSA provenance gates passed.
 
 Scope:
 
@@ -191,20 +192,56 @@ Exit criteria:
 - Installed-artifact and live-provider tests exercise the enforced backend.
 - The product is described as a local enforced runner, not a managed sandbox service.
 
-Implementation snapshot (2026-08-17):
+Implementation summary:
 
 - the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, per-tool-call isolation, manifest authorization, and run fingerprint binding;
 - the enforced policy denies network and undeclared tools, uses a non-root identity, read-only root, dropped capabilities, no-new-privileges, and bounded memory, CPU, PIDs, time, output, snapshot, imported-file, and tmpfs resources;
 - repository tools and subagents share an ephemeral secret-free snapshot; package checks and argv-only commands run inside OCI, while network MCP fails closed under the no-network policy;
 - content- and run-bound patch inspection plus a separate durable import approval are the only environment-to-host mutation path; deletes remain recoverable through quarantine;
 - lifecycle metadata, cancellation removal, run-labeled container and quota-volume cleanup, terminal artifact retention cleanup, deterministic regression tests, installed-package smoke, and required Linux OCI workflow gates are implemented;
-- the real Docker smoke passed again at `2026-08-17T16:48Z` against Docker `29.7.2` and the pinned Bun image digest, covering network/root/secret boundaries, total-workspace and per-file capacity, read-only dependency reuse, memory/PID/output limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
+- the real Docker smoke passed against the pinned image identity, covering network/root/secret boundaries, capacity and resource limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
 - the installed-package smoke passed with the public execution-environment API and snapshot/import flow;
 - the exact local `0.6.0` tarball passed the 31-file allowlist, SHA-512 generation, isolated consumer install, binary, public API, durability, and execution-environment smoke;
-- Meta, Qwen, and OpenAI passed the final model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix together at `2026-08-17T16:49:12.975Z`;
-- the base approval/restart matrix and bounded reviewer-delegation/persistence/hierarchy matrix passed again at `2026-08-17T16:22:34.885Z` and `2026-08-17T16:24:14.381Z` respectively;
+- the certified provider cohort passed the model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix;
+- the base approval/restart and bounded reviewer-delegation/persistence/hierarchy matrices passed against the release artifact;
 - `@zhivex-ai/core@1.6.0` resolves as one runtime through the aligned dependency batch;
-- publication, tag, push, provenance, and registry proof for `0.6.0` remain pending the explicit release operation.
+- the annotated tag, protected publication, registry integrity, distribution tag, and SLSA workflow provenance agree with the release source.
+
+### 0.6.1 positioning patch
+
+`0.6.1` keeps the `0.6.0` runtime, CLI, configuration, state, and library contracts unchanged. It adds a launch-oriented package description, expanded discovery metadata, a deterministic social card, structured issue forms, and a hostile-repository demo that exposes the existing safety chain as one reproducible product proof.
+
+Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. The annotated `v0.6.1` tag, npm artifact, registry integrity, and provenance were subsequently verified through the protected workflow.
+
+## 0.7.0 — Multi-provider agent console
+
+Status: 0.7.0 release candidate implemented in source. Deterministic and installed-artifact gates must pass before a release commit; Gemini and mixed-provider routing remain provisional until the required live validation is recorded.
+
+Goal: turn the harness from a collection of one-shot commands into an ergonomic local agent console while preserving immutable runs and provider portability.
+
+Scope:
+
+- Publish the short `zhx` command while retaining `zhivex-harness` for scripts.
+- Add a durable SQLite session index that links immutable runs without duplicating prompts, messages, tool payloads, or provider data.
+- Add a public validated provider registry and native Gemini integration without aliasing an OpenAI-compatible transport.
+- Route explorer, implementer, tester, and reviewer roles to explicit provider/model pairs.
+- Add safe console commands for provider/model/routes, status, diff, review, session resume/new/rename, and deterministic redacted compaction.
+- Add sequence-numbered redacted JSONL events for automation.
+- Bind non-secret provider transport configuration into durable resume fingerprints.
+
+Exit criteria:
+
+- Registry, Gemini factory/diagnostics, sessions/reopen/fork/archive, routing, approval restart, JSONL redaction, and both CLI aliases pass deterministic and installed-package tests.
+- Cross-provider handoff always starts a new run, is blocked by pending approvals, and carries no raw tool/provider payload.
+- Existing `run`, `review`, `resume`, `runs`, final JSON, configuration schema, and `zhivex-harness` commands remain compatible.
+- Gemini passes the base edit/restart, delegation, and OCI matrices before moving from provisional to certified.
+- The exact tarball, release tag, registry integrity, and provenance are verified separately; source readiness is not publication.
+
+Deferred after `0.7.0`:
+
+- Per-provider/per-role cost pricing and evidence-backed routing presets.
+- Additional hosted and local providers, added one by one through the same registry and certification contract.
+- Remote workers or microVM backends; the current console stays local and Bun-first.
 
 ## 1.0.0 — Stable CLI and library contract
 
@@ -251,6 +288,7 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review the diff and create a clean release commit; the readiness checker currently blocks only on the intentionally dirty worktree.
-2. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.
-3. Merge/push the reviewed release commit, create the annotated `v0.6.0` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
+1. Finish the `0.7.0` deterministic, real-OCI, and installed-artifact gates from a clean release commit.
+2. Complete the required live provider and mixed-routing certification; keep provisional paths provisional on any failure or missing evidence.
+3. Dogfood durable `zhx` sessions, provider handoff, role routing, and JSONL consumption on representative repositories.
+4. Only after those gates, complete the reviewed release workflow and verify registry integrity and provenance against the exact artifact.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.5.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
+Security fixes are provided for the latest published `0.6.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
+Zhivex Harness `0.7.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
@@ -10,7 +10,7 @@ Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observab
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.5.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published patch receives routine fixes. Meta, Qwen, and OpenAI retain their date-bound `0.6.x` certification; Gemini in `0.7.0` is provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels
 

package/dist/cli-stream.d.ts

@@ -0,0 +1,167 @@
+import type { AgentStreamEvent } from "@zhivex-ai/agents";
+export declare const CLI_JSON_SCHEMA_VERSION: 1;
+export declare const CLI_EVENT_SCHEMA_VERSION: 1;
+export interface StreamRunResultSource {
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals?: readonly ({
+        id: string;
+        kind: string;
+        name: string;
+        childRunId?: string;
+        childAgentId?: string;
+        [key: string]: unknown;
+    })[];
+    children?: readonly ({
+        runId: string;
+        status: string;
+        [key: string]: unknown;
+    })[];
+    [key: string]: unknown;
+}
+/**
+ * Convert runtime events into a stable, line-oriented CLI contract.
+ *
+ * Tool inputs, tool outputs, provider payloads, model messages, and error text
+ * are deliberately omitted: they can contain repository content or secrets.
+ */
+export declare const streamEventDocument: (event: AgentStreamEvent, sequence?: number) => {
+    textDelta: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    isError: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approvalKind: "provider" | "local-tool" | "subagent";
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approved: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    provider: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    index?: number;
+    id?: string;
+    provider: string;
+    partial: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    usage?: import("@zhivex-ai/core").TokenUsage;
+    finishReason?: import("@zhivex-ai/core").FinishReason;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    error: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    currentStep: number;
+    maxSteps: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    status: import("@zhivex-ai/core").AgentStepStatus;
+    toolCalls: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    compactionId: string;
+    reasons: import("@zhivex-ai/core").AgentCompactionReason[];
+    messageCountBefore: number;
+    messageCountAfter: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    runId: string;
+    status: import("@zhivex-ai/core").AgentStatus;
+    provider: string;
+    model: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+};
+export declare const serializeStreamEvent: (event: AgentStreamEvent, sequence?: number) => string;
+/**
+ * Project the rich final JSON document onto the redacted JSONL contract.
+ *
+ * This is deliberately a whitelist. Output text, mutations, approval
+ * arguments, scope, paths, provider payloads, and configuration bindings can
+ * contain repository or operator data and must remain exclusive to the
+ * separate final-document contract.
+ */
+export declare const streamResultDocument: (result: StreamRunResultSource, sequence?: number) => {
+    schemaVersion: 1;
+    kind: "run-result";
+    sequence: number;
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals: {
+        childAgentId?: string;
+        childRunId?: string;
+        id: string;
+        kind: string;
+        name: string;
+    }[];
+    children: {
+        runId: string;
+        status: string;
+    }[];
+};
+export declare const serializeStreamResult: (result: StreamRunResultSource, sequence?: number) => string;