@zhivex-ai/harness 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.7.0 - 2026-08-20
+
+### Added
+
+- The short `zhx` executable while retaining `zhivex-harness` for command compatibility.
+- A durable interactive console backed by a scoped SQLite session index, including session list/inspect/rename/fork/archive and `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, and `/rename` commands.
+- A public, validated, injectable provider registry with built-in Meta, Qwen, OpenAI, and provisional Gemini registrations. Gemini uses `@zhivex-ai/gemini@0.10.4` and `gemini-3.6-flash` by default.
+- Repeatable per-role model routes for explorer, implementer, tester, and reviewer subagents.
+- A redacted, sequence-numbered JSON Lines stream contract through `--jsonl`.
+
+### Changed
+
+- Provider/model changes in the console create a new immutable run and compact/redact portable context rather than rebinding an old provider state.
+- Durable harness fingerprints now include a non-secret hash of provider endpoint/region/workspace transport configuration.
+- Provider diagnostics are registry-driven and continue to expose only declared variable names and booleans.
+- The final JSON schema and resolved configuration schema remain at version `1` and `4` respectively.
+
+### Migration from 0.6.x
+
+- Prefer `zhx` for interactive use; existing `zhivex-harness` commands continue to work.
+- Resolve or deny paused `0.6.x` approvals with the matching `0.6.x` artifact before upgrading. Harness-version binding intentionally rejects those resumes under `0.7.x`.
+- Gemini is integrated but provisional until all credentialed harness live gates pass. Local tests, adapter evidence, and credential detection do not certify it.
+- `--max-cost-usd` cannot be combined with per-role routes in `0.7.x`; pricing remains one operator-supplied pair and would misprice heterogeneous usage.
+
+### Security
+
+- Session metadata excludes prompts/messages/tool payloads and is isolated by canonical workspace and durable scope with bounded storage and optimistic SQLite transactions.
+- JSONL projection omits tool inputs/outputs, approval arguments, provider payloads, images, raw errors, and full durable states.
+- Provider/model handoff is blocked while an approval is pending and strips provider-specific tool payloads from future context.
+
 ## 0.6.1 - 2026-08-17
 
 ### Added

package/README.md

@@ -9,11 +9,11 @@
 
 ![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.6.1` is the positioning and hostile-repository proof patch for the `0.6.x` enforced-execution line. `0.6.0` is public on npm; its exact tarball, `latest` tag, and SLSA workflow provenance were verified against source tag `v0.6.0`. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+Version `0.7.0` is the source release candidate for the multi-provider agent console. The currently verified public npm release remains `0.6.1`; local validation does not imply that `0.7.0` has been published or live-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -40,10 +40,12 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.6 includes
+## What 0.7 includes
 
-- one-shot execution and interactive chat;
-- provider and model selection through the CLI;
+- the short `zhx` command, with `zhivex-harness` retained as a compatible alias;
+- one-shot execution plus a durable interactive console with named sessions, fork/archive operations, safe resume, status, diff, review, and explicit context compaction;
+- an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
+- redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
 - a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
@@ -79,10 +81,10 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ```bash
 bun add @zhivex-ai/harness
-bunx zhivex-harness --version
+bunx --package @zhivex-ai/harness zhx --version
 ```
 
-To exercise the `0.6.1` source checkout:
+To exercise the `0.7.0` source checkout:
 
 ```bash
 bun install --frozen-lockfile
@@ -96,28 +98,39 @@ Configure only the providers you plan to use:
 OPENAI_API_KEY=...
 MODEL_API_KEY=...
 DASHSCOPE_API_KEY=...
+GEMINI_API_KEY=...
 ```
 
-`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence.
+`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence. Gemini also accepts `GOOGLE_GENERATIVE_AI_API_KEY`.
 
 ## Diagnose the environment
 
 `doctor` is local and does not contact provider endpoints:
 
 ```bash
-zhivex-harness doctor
-zhivex-harness doctor --provider qwen --json
+zhx doctor
+zhx doctor --provider qwen --json
 ```
 
 For a source checkout, replace `zhivex-harness` with `bun run dev`.
 
 ## Usage
 
+Start the durable console with the ergonomic command, or use the long alias in existing scripts:
+
+```bash
+zhx
+zhx chat --continue
+zhivex-harness --version
+```
+
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+
 Show providers and detected configuration without printing secrets:
 
 ```bash
-zhivex-harness providers
-zhivex-harness providers --json
+zhx providers
+zhx providers --json
 ```
 
 Run a task against the current directory:
@@ -126,6 +139,7 @@ Run a task against the current directory:
 zhivex-harness run --provider openai "review the repository and fix the tests"
 zhivex-harness run --provider meta "document the current architecture"
 zhivex-harness run --provider qwen "implement the pending endpoint"
+zhx run --provider gemini "review the proposed implementation"
 ```
 
 Operate on another workspace:
@@ -137,9 +151,20 @@ zhivex-harness run --provider qwen --workspace ../my-app "fix the typecheck erro
 Interactive mode:
 
 ```bash
-zhivex-harness chat --provider meta
+zhx chat --provider meta
+zhx chat --continue
+zhx sessions list
 ```
 
+Route only selected subagent roles; credentials are required only for providers actually instantiated:
+
+```bash
+zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
+  "implement the change, then review it independently"
+```
+
+Routing with `--max-cost-usd` is rejected in `0.7.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
 ```bash
@@ -185,6 +210,7 @@ Structured automation output uses schema version `1`:
 
 ```bash
 zhivex-harness run --provider qwen --json "analyze the issue without modifying files"
+zhx run --provider gemini --jsonl "analyze the issue without modifying files"
 ```
 
 The JSON shapes and exit codes are documented in [docs/CLI.md](./docs/CLI.md).
@@ -214,10 +240,11 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 | Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 | OpenAI | `gpt-5.4` | `OPENAI_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
+| Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
 
-Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, and `OPENAI_BASE_URL`.
+Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta, Qwen, and OpenAI completed the final `0.6.0` model-directed OCI command/review/import matrix together at `2026-08-17T16:49:12.975Z`, the proposal/approval/restart refresh at `2026-08-17T16:22:34.885Z`, and the delegation/persistence/hierarchy refresh at `2026-08-17T16:24:14.381Z`. Controlled Streamable HTTP MCP interoperability over a real loopback server passed at `2026-08-17T16:48:09.043Z`; independent interoperability with `@modelcontextprotocol/server@2.0.0` passed at `2026-08-17T16:48:09.141Z` in its legacy-stateless compatibility mode. These results do not imply compatibility with every server or protocol feature. Provider capability claims are date-bound by the [live certification gate](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta, Qwen, and OpenAI retain the published `0.6.x` support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -258,4 +285,5 @@ The live gate is opt-in and billable:
 
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run scripts/live-provider-smoke.ts
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:routing
 ```

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-17
+- Baseline date: 2026-08-20
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` plus `0.6.0` are published on npm. `0.6.1` is the local positioning and hostile-repository proof patch; publishing it remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0`, `0.6.0`, and `0.6.1` are published on npm. `0.7.0` is the source release candidate for the multi-provider agent console; publication and live certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -39,7 +39,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.4.0` | Durable operations | Inspectable, budgeted, cancellable, evaluable runs | Private checkpoint | L |
 | `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Published on npm | L |
 | `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
-| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Implemented locally | S |
+| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
+| `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Source release candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -99,7 +100,7 @@ Required release evidence:
 - migration and safety boundaries are documented without claiming host isolation or permanent deletion;
 - `0.3.0` remains private until an explicit publication decision is made.
 
-Validation snapshot (2026-08-16):
+Validation summary:
 
 - the trusted-editing implementation is merged into `main`;
 - deterministic, installed-package, and package-inspection CI gates pass on Linux and macOS;
@@ -130,7 +131,7 @@ Exit criteria:
 - Golden fixtures are deterministic and the regression gate runs in CI.
 - Exported operational artifacts are redacted by default and schema-versioned.
 
-Validation snapshot (2026-08-17):
+Validation summary:
 
 - deterministic tests, the five-case golden evaluation gate, typecheck, docs, build, and installed-tarball smoke pass;
 - migration, idempotency, concurrent ownership, expired-lease recovery, cancellation, retention, Qwen token enforcement, and export redaction have regression coverage;
@@ -160,13 +161,12 @@ Exit criteria:
 - MCP prompt injection and oversized/malformed result tests fail safely.
 - Provider-specific limitations are recorded in a live support matrix.
 
-Validation snapshot (2026-08-17 UTC):
+Validation summary:
 
 - deterministic tests, the seven-case golden evaluation gate, typecheck, docs, build, dependency audit, dry-run package inspection, and installed-tarball smoke pass;
 - malformed MCP, HTTP handshake/session, injection/output bounds, approval/restart, child mutation exactly-once, cancellation, scoped hierarchy, aggregate budget, and parallel review have regression coverage;
-- controlled Streamable HTTP MCP interoperability passed over a real loopback server with session negotiation, JSON and SSE responses, tool discovery, bounded execution, and forced network approval at `2026-08-17T16:48:09.043Z`;
-- independent interoperability with `@modelcontextprotocol/server@2.0.0` passed over loopback in its documented `2025-06-18` legacy-stateless compatibility mode at `2026-08-17T16:48:09.141Z`;
-- Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.4` passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix at `2026-08-17T02:21:45.553Z`;
+- controlled and official-SDK Streamable HTTP MCP interoperability passed over real loopback transports with session negotiation, bounded execution, and forced network approval;
+- the certified provider cohort passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix;
 - the exact `0.5.0` artifact was published and its post-publication registry/provenance verification completed; that evidence does not pre-certify `0.6.0`.
 
 ## 0.6.0 — Enforced execution environments
@@ -192,26 +192,56 @@ Exit criteria:
 - Installed-artifact and live-provider tests exercise the enforced backend.
 - The product is described as a local enforced runner, not a managed sandbox service.
 
-Implementation snapshot (2026-08-17):
+Implementation summary:
 
 - the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, per-tool-call isolation, manifest authorization, and run fingerprint binding;
 - the enforced policy denies network and undeclared tools, uses a non-root identity, read-only root, dropped capabilities, no-new-privileges, and bounded memory, CPU, PIDs, time, output, snapshot, imported-file, and tmpfs resources;
 - repository tools and subagents share an ephemeral secret-free snapshot; package checks and argv-only commands run inside OCI, while network MCP fails closed under the no-network policy;
 - content- and run-bound patch inspection plus a separate durable import approval are the only environment-to-host mutation path; deletes remain recoverable through quarantine;
 - lifecycle metadata, cancellation removal, run-labeled container and quota-volume cleanup, terminal artifact retention cleanup, deterministic regression tests, installed-package smoke, and required Linux OCI workflow gates are implemented;
-- the real Docker smoke passed again at `2026-08-17T16:48Z` against Docker `29.7.2` and the pinned Bun image digest, covering network/root/secret boundaries, total-workspace and per-file capacity, read-only dependency reuse, memory/PID/output limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
+- the real Docker smoke passed against the pinned image identity, covering network/root/secret boundaries, capacity and resource limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
 - the installed-package smoke passed with the public execution-environment API and snapshot/import flow;
 - the exact local `0.6.0` tarball passed the 31-file allowlist, SHA-512 generation, isolated consumer install, binary, public API, durability, and execution-environment smoke;
-- Meta, Qwen, and OpenAI passed the final model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix together at `2026-08-17T16:49:12.975Z`;
-- the base approval/restart matrix and bounded reviewer-delegation/persistence/hierarchy matrix passed again at `2026-08-17T16:22:34.885Z` and `2026-08-17T16:24:14.381Z` respectively;
+- the certified provider cohort passed the model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix;
+- the base approval/restart and bounded reviewer-delegation/persistence/hierarchy matrices passed against the release artifact;
 - `@zhivex-ai/core@1.6.0` resolves as one runtime through the aligned dependency batch;
-- annotated tag `v0.6.0`, push, protected OIDC publication, exact registry integrity, the `latest` distribution tag, and SLSA workflow provenance agree with source commit `fd420f7560b2`.
+- the annotated tag, protected publication, registry integrity, distribution tag, and SLSA workflow provenance agree with the release source.
 
 ### 0.6.1 positioning patch
 
 `0.6.1` keeps the `0.6.0` runtime, CLI, configuration, state, and library contracts unchanged. It adds a launch-oriented package description, expanded discovery metadata, a deterministic social card, structured issue forms, and a hostile-repository demo that exposes the existing safety chain as one reproducible product proof.
 
-Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. Publication, a `v0.6.1` tag, registry integrity, and provenance are not claimed until the normal protected release workflow completes.
+Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. The annotated `v0.6.1` tag, npm artifact, registry integrity, and provenance were subsequently verified through the protected workflow.
+
+## 0.7.0 — Multi-provider agent console
+
+Status: 0.7.0 release candidate implemented in source. Deterministic and installed-artifact gates must pass before a release commit; Gemini and mixed-provider routing remain provisional until the required live validation is recorded.
+
+Goal: turn the harness from a collection of one-shot commands into an ergonomic local agent console while preserving immutable runs and provider portability.
+
+Scope:
+
+- Publish the short `zhx` command while retaining `zhivex-harness` for scripts.
+- Add a durable SQLite session index that links immutable runs without duplicating prompts, messages, tool payloads, or provider data.
+- Add a public validated provider registry and native Gemini integration without aliasing an OpenAI-compatible transport.
+- Route explorer, implementer, tester, and reviewer roles to explicit provider/model pairs.
+- Add safe console commands for provider/model/routes, status, diff, review, session resume/new/rename, and deterministic redacted compaction.
+- Add sequence-numbered redacted JSONL events for automation.
+- Bind non-secret provider transport configuration into durable resume fingerprints.
+
+Exit criteria:
+
+- Registry, Gemini factory/diagnostics, sessions/reopen/fork/archive, routing, approval restart, JSONL redaction, and both CLI aliases pass deterministic and installed-package tests.
+- Cross-provider handoff always starts a new run, is blocked by pending approvals, and carries no raw tool/provider payload.
+- Existing `run`, `review`, `resume`, `runs`, final JSON, configuration schema, and `zhivex-harness` commands remain compatible.
+- Gemini passes the base edit/restart, delegation, and OCI matrices before moving from provisional to certified.
+- The exact tarball, release tag, registry integrity, and provenance are verified separately; source readiness is not publication.
+
+Deferred after `0.7.0`:
+
+- Per-provider/per-role cost pricing and evidence-backed routing presets.
+- Additional hosted and local providers, added one by one through the same registry and certification contract.
+- Remote workers or microVM backends; the current console stays local and Bun-first.
 
 ## 1.0.0 — Stable CLI and library contract
 
@@ -258,7 +288,7 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review the `0.6.1` positioning/demo diff and run the full deterministic, real-OCI, and installed-artifact gates.
-2. Record the hostile-repository demo and publish the exact evidence output with the release notes.
-3. Merge/push the reviewed release commit, create the annotated `v0.6.1` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
-4. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.
+1. Finish the `0.7.0` deterministic, real-OCI, and installed-artifact gates from a clean release commit.
+2. Complete the required live provider and mixed-routing certification; keep provisional paths provisional on any failure or missing evidence.
+3. Dogfood durable `zhx` sessions, provider handoff, role routing, and JSONL consumption on representative repositories.
+4. Only after those gates, complete the reviewed release workflow and verify registry integrity and provenance against the exact artifact.

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
+Zhivex Harness `0.7.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
@@ -10,7 +10,7 @@ Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observab
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.6.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published patch receives routine fixes. Meta, Qwen, and OpenAI retain their date-bound `0.6.x` certification; Gemini in `0.7.0` is provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels
 

package/dist/cli-stream.d.ts

@@ -0,0 +1,167 @@
+import type { AgentStreamEvent } from "@zhivex-ai/agents";
+export declare const CLI_JSON_SCHEMA_VERSION: 1;
+export declare const CLI_EVENT_SCHEMA_VERSION: 1;
+export interface StreamRunResultSource {
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals?: readonly ({
+        id: string;
+        kind: string;
+        name: string;
+        childRunId?: string;
+        childAgentId?: string;
+        [key: string]: unknown;
+    })[];
+    children?: readonly ({
+        runId: string;
+        status: string;
+        [key: string]: unknown;
+    })[];
+    [key: string]: unknown;
+}
+/**
+ * Convert runtime events into a stable, line-oriented CLI contract.
+ *
+ * Tool inputs, tool outputs, provider payloads, model messages, and error text
+ * are deliberately omitted: they can contain repository content or secrets.
+ */
+export declare const streamEventDocument: (event: AgentStreamEvent, sequence?: number) => {
+    textDelta: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    isError: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approvalKind: "provider" | "local-tool" | "subagent";
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approved: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    provider: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    index?: number;
+    id?: string;
+    provider: string;
+    partial: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    usage?: import("@zhivex-ai/core").TokenUsage;
+    finishReason?: import("@zhivex-ai/core").FinishReason;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    error: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    currentStep: number;
+    maxSteps: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    status: import("@zhivex-ai/core").AgentStepStatus;
+    toolCalls: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    compactionId: string;
+    reasons: import("@zhivex-ai/core").AgentCompactionReason[];
+    messageCountBefore: number;
+    messageCountAfter: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    runId: string;
+    status: import("@zhivex-ai/core").AgentStatus;
+    provider: string;
+    model: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+};
+export declare const serializeStreamEvent: (event: AgentStreamEvent, sequence?: number) => string;
+/**
+ * Project the rich final JSON document onto the redacted JSONL contract.
+ *
+ * This is deliberately a whitelist. Output text, mutations, approval
+ * arguments, scope, paths, provider payloads, and configuration bindings can
+ * contain repository or operator data and must remain exclusive to the
+ * separate final-document contract.
+ */
+export declare const streamResultDocument: (result: StreamRunResultSource, sequence?: number) => {
+    schemaVersion: 1;
+    kind: "run-result";
+    sequence: number;
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals: {
+        childAgentId?: string;
+        childRunId?: string;
+        id: string;
+        kind: string;
+        name: string;
+    }[];
+    children: {
+        runId: string;
+        status: string;
+    }[];
+};
+export declare const serializeStreamResult: (result: StreamRunResultSource, sequence?: number) => string;

package/dist/cli.d.ts

@@ -3,7 +3,9 @@ import { type AgentApprovalRequest, type AgentRunInput, type AgentRunOutput, typ
 import { providerAvailability, resolveHarnessConfig, type HarnessConfig, type HarnessConfigInput, type HarnessProvider, type HarnessSubagentProfile } from "./config.js";
 import { type ZhivexHarness } from "./harness.js";
 import { type HarnessOciRuntimeAdapter } from "./execution-environment.js";
-export declare const CLI_JSON_SCHEMA_VERSION: 1;
+import { type HarnessModelRoute } from "./routing.js";
+import { CLI_JSON_SCHEMA_VERSION } from "./cli-stream.js";
+export { CLI_JSON_SCHEMA_VERSION } from "./cli-stream.js";
 export declare const HARNESS_RESUME_METADATA_KEY: "zhivexHarnessResume";
 export declare const HARNESS_RESUME_METADATA_SCHEMA_VERSION: 1;
 export declare const CLI_EXIT_CODES: {
@@ -12,8 +14,9 @@ export declare const CLI_EXIT_CODES: {
     readonly usageError: 2;
     readonly doctorFailed: 3;
 };
-type Command = "run" | "review" | "chat" | "providers" | "doctor" | "resume" | "runs" | "help" | "version";
+type Command = "run" | "review" | "chat" | "providers" | "doctor" | "resume" | "runs" | "sessions" | "help" | "version";
 type RunsCommand = "list" | "inspect" | "cancel" | "cleanup" | "export";
+type SessionsCommand = "list" | "inspect" | "rename" | "fork" | "archive";
 export interface CliOptions {
     command: Command;
     provider?: string;
@@ -36,8 +39,9 @@ export interface CliOptions {
     outputCostPerMillion?: number;
     allowedChecks?: string[];
     requiredCapabilities?: string[];
-    subagentProfiles?: string[];
+    subagentProfiles?: HarnessSubagentProfile[];
     reviewers?: HarnessSubagentProfile[];
+    routes?: string[];
     subagentMaxSteps?: number;
     subagentMaxToolCalls?: number;
     subagentMaxToolErrors?: number;
@@ -63,6 +67,11 @@ export interface CliOptions {
     runId?: string;
     idempotencyKey?: string;
     runsCommand?: RunsCommand;
+    sessionsCommand?: SessionsCommand;
+    sessionId?: string;
+    sessionTitle?: string;
+    continueSession: boolean;
+    implicitCommand: boolean;
     statuses?: AgentStatus[];
     limit?: number;
     cursor?: string;
@@ -73,12 +82,14 @@ export interface CliOptions {
     yes: boolean;
     approve?: boolean;
     json: boolean;
+    jsonl: boolean;
 }
 export declare class CliUsageError extends Error {
     constructor(message: string);
 }
-export declare const createHarnessResumeMetadata: (config: HarnessConfig) => NonNullable<AgentRunInput["metadata"]>;
+export declare const createHarnessResumeMetadata: (config: HarnessConfig, routes?: ReadonlyMap<HarnessSubagentProfile, HarnessModelRoute>) => NonNullable<AgentRunInput["metadata"]>;
 export declare const readHarnessResumeConfig: (state: Pick<AgentRunState, "metadata">) => HarnessConfigInput | undefined;
+export declare const readHarnessResumeRoutes: (state: Pick<AgentRunState, "metadata">) => Map<"explorer" | "implementer" | "tester" | "reviewer", HarnessModelRoute>;
 export declare const resumeCommand: (runId: string, config: HarnessConfig, approve?: boolean) => string;
 export declare const parseCliArgs: (argv: string[]) => CliOptions;
 export declare const summarizeApproval: (approval: AgentApprovalRequest) => string;
@@ -149,30 +160,11 @@ export declare const runResultDocument: (result: AgentRunOutput, harness: Zhivex
     usage: import("@zhivex-ai/core").TokenUsage | undefined;
     budget: import("@zhivex-ai/core").AgentBudgetStatus;
 };
+export declare const withTemporaryHarnessProfiles: <T>(profiles: readonly HarnessSubagentProfile[], configure: (profiles: readonly HarnessSubagentProfile[]) => Promise<void>, operation: () => Promise<T>) => Promise<T>;
 export declare const providersDocument: (env?: NodeJS.ProcessEnv) => {
     schemaVersion: 1;
     kind: "providers";
-    providers: {
-        configured: boolean;
-        credentials: {
-            name: string;
-            present: boolean;
-        }[];
-        configuration: {
-            workspaceIdConfigured?: boolean;
-            regionConfigured?: boolean;
-            regionValid?: boolean;
-            customEndpoint: boolean;
-            endpointValid: boolean;
-            endpointSecure: boolean;
-        };
-        id: HarnessProvider;
-        name: string;
-        defaultModel: string;
-        credentialNames: readonly string[];
-        capabilities: readonly import("./config.js").ProviderCapability[];
-        support: import("./config.js").ProviderSupport;
-    }[];
+    providers: readonly import("./providers.js").ProviderAvailability[];
 };
 export type DoctorCheckStatus = "pass" | "warn" | "fail";
 export interface DoctorCheck {
@@ -215,6 +207,5 @@ export interface DoctorContext {
 }
 export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
 export declare const formatDoctorReport: (report: DoctorReport) => string;
-export declare const cliExitCodeForError: (error: unknown) => 2 | 1;
+export declare const cliExitCodeForError: (error: unknown) => 1 | 2;
 export declare const main: (argv?: string[]) => Promise<void>;
-export {};