@zhivex-ai/harness 0.6.1 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.8.0 - 2026-08-20
+
+### Changed
+
+- The coordinated SDK dependency batch now resolves one `@zhivex-ai/core@1.7.0` runtime with Agents `1.2.0`, Meta `0.2.2`, Qwen `0.10.2`, OpenAI `0.9.6`, and Gemini `0.10.5`.
+- Approval instructions now tell models to call the gated tool with reviewed arguments so the runtime can pause, instead of asking the operator for approval in prose before emitting the tool call.
+- OpenAI is now GPT-5.6-first, defaults to `gpt-5.6-luna`, and exposes `gpt-5.6-terra` and `gpt-5.6-sol` as explicit model choices. All three passed the local base certification gate, while unpublished worktree evidence remains separate from release certification.
+
+### Migration from 0.7.x
+
+- OpenAI runs without an explicit `--model` now resolve to `gpt-5.6-luna` instead of `gpt-5.4`. Pin the prior model explicitly before upgrading if a workflow depends on it; GPT-5.6 availability remains organization-dependent during limited preview.
+- Resolve or deny paused `0.7.x` approvals with the matching `0.7.x` artifact before upgrading. Harness-version binding intentionally rejects those resumes under `0.8.x`.
+
+## 0.7.0 - 2026-08-20
+
+### Added
+
+- The short `zhx` executable while retaining `zhivex-harness` for command compatibility.
+- A durable interactive console backed by a scoped SQLite session index, including session list/inspect/rename/fork/archive and `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, and `/rename` commands.
+- A public, validated, injectable provider registry with built-in Meta, Qwen, OpenAI, and provisional Gemini registrations. Gemini uses `@zhivex-ai/gemini@0.10.4` and `gemini-3.6-flash` by default.
+- Repeatable per-role model routes for explorer, implementer, tester, and reviewer subagents.
+- A redacted, sequence-numbered JSON Lines stream contract through `--jsonl`.
+
+### Changed
+
+- Provider/model changes in the console create a new immutable run and compact/redact portable context rather than rebinding an old provider state.
+- Durable harness fingerprints now include a non-secret hash of provider endpoint/region/workspace transport configuration.
+- Provider diagnostics are registry-driven and continue to expose only declared variable names and booleans.
+- The final JSON schema and resolved configuration schema remain at version `1` and `4` respectively.
+
+### Migration from 0.6.x
+
+- Prefer `zhx` for interactive use; existing `zhivex-harness` commands continue to work.
+- Resolve or deny paused `0.6.x` approvals with the matching `0.6.x` artifact before upgrading. Harness-version binding intentionally rejects those resumes under `0.7.x`.
+- Gemini is integrated but provisional until all credentialed harness live gates pass. Local tests, adapter evidence, and credential detection do not certify it.
+- `--max-cost-usd` cannot be combined with per-role routes in `0.7.x`; pricing remains one operator-supplied pair and would misprice heterogeneous usage.
+
+### Security
+
+- Session metadata excludes prompts/messages/tool payloads and is isolated by canonical workspace and durable scope with bounded storage and optimistic SQLite transactions.
+- JSONL projection omits tool inputs/outputs, approval arguments, provider payloads, images, raw errors, and full durable states.
+- Provider/model handoff is blocked while an approval is pending and strips provider-specific tool payloads from future context.
+
 ## 0.6.1 - 2026-08-17
 
 ### Added

package/README.md

@@ -9,11 +9,11 @@
 
 ![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.6.1` is the positioning and hostile-repository proof patch for the `0.6.x` enforced-execution line. `0.6.0` is public on npm; its exact tarball, `latest` tag, and SLSA workflow provenance were verified against source tag `v0.6.0`. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+Version `0.8.0` is the source release candidate for the coordinated SDK refresh and GPT-5.6-first OpenAI integration. The latest public npm release is `0.7.0`; local validation does not imply that `0.8.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -40,10 +40,18 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.6 includes
+## What 0.8 changes
 
-- one-shot execution and interactive chat;
-- provider and model selection through the CLI;
+- updates the coordinated Zhivex SDK batch while retaining a single Core runtime identity;
+- makes `gpt-5.6-luna` the OpenAI default, with Terra and Sol available through explicit model selection; and
+- clarifies that calling an approval-gated tool is the model's approval request, so the runtime can persist and resume it.
+
+## What 0.7 introduced
+
+- the short `zhx` command, with `zhivex-harness` retained as a compatible alias;
+- one-shot execution plus a durable interactive console with named sessions, fork/archive operations, safe resume, status, diff, review, and explicit context compaction;
+- an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
+- redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
 - a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
@@ -79,10 +87,10 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ```bash
 bun add @zhivex-ai/harness
-bunx zhivex-harness --version
+bunx --package @zhivex-ai/harness zhx --version
 ```
 
-To exercise the `0.6.1` source checkout:
+To exercise the `0.8.0` source checkout:
 
 ```bash
 bun install --frozen-lockfile
@@ -96,28 +104,39 @@ Configure only the providers you plan to use:
 OPENAI_API_KEY=...
 MODEL_API_KEY=...
 DASHSCOPE_API_KEY=...
+GEMINI_API_KEY=...
 ```
 
-`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence.
+`MODEL_API_KEY` is used by the Meta Model API. Qwen also accepts `QWEN_API_KEY`; `DASHSCOPE_API_KEY` takes precedence. Gemini also accepts `GOOGLE_GENERATIVE_AI_API_KEY`.
 
 ## Diagnose the environment
 
 `doctor` is local and does not contact provider endpoints:
 
 ```bash
-zhivex-harness doctor
-zhivex-harness doctor --provider qwen --json
+zhx doctor
+zhx doctor --provider qwen --json
 ```
 
 For a source checkout, replace `zhivex-harness` with `bun run dev`.
 
 ## Usage
 
+Start the durable console with the ergonomic command, or use the long alias in existing scripts:
+
+```bash
+zhx
+zhx chat --continue
+zhivex-harness --version
+```
+
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+
 Show providers and detected configuration without printing secrets:
 
 ```bash
-zhivex-harness providers
-zhivex-harness providers --json
+zhx providers
+zhx providers --json
 ```
 
 Run a task against the current directory:
@@ -126,6 +145,7 @@ Run a task against the current directory:
 zhivex-harness run --provider openai "review the repository and fix the tests"
 zhivex-harness run --provider meta "document the current architecture"
 zhivex-harness run --provider qwen "implement the pending endpoint"
+zhx run --provider gemini "review the proposed implementation"
 ```
 
 Operate on another workspace:
@@ -137,9 +157,20 @@ zhivex-harness run --provider qwen --workspace ../my-app "fix the typecheck erro
 Interactive mode:
 
 ```bash
-zhivex-harness chat --provider meta
+zhx chat --provider meta
+zhx chat --continue
+zhx sessions list
+```
+
+Route only selected subagent roles; credentials are required only for providers actually instantiated:
+
+```bash
+zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
+  "implement the change, then review it independently"
 ```
 
+Routing with `--max-cost-usd` is rejected in `0.8.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
 ```bash
@@ -185,6 +216,7 @@ Structured automation output uses schema version `1`:
 
 ```bash
 zhivex-harness run --provider qwen --json "analyze the issue without modifying files"
+zhx run --provider gemini --jsonl "analyze the issue without modifying files"
 ```
 
 The JSON shapes and exit codes are documented in [docs/CLI.md](./docs/CLI.md).
@@ -213,11 +245,12 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 | --- | --- | --- |
 | Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
-| OpenAI | `gpt-5.4` | `OPENAI_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
+| OpenAI | `gpt-5.6-luna` | `OPENAI_API_KEY` · GPT-5.6 Luna, Terra, and Sol base workflow passed locally; release recertification pending |
+| Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
 
-Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, and `OPENAI_BASE_URL`.
+Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta, Qwen, and OpenAI completed the final `0.6.0` model-directed OCI command/review/import matrix together at `2026-08-17T16:49:12.975Z`, the proposal/approval/restart refresh at `2026-08-17T16:22:34.885Z`, and the delegation/persistence/hierarchy refresh at `2026-08-17T16:24:14.381Z`. Controlled Streamable HTTP MCP interoperability over a real loopback server passed at `2026-08-17T16:48:09.043Z`; independent interoperability with `@modelcontextprotocol/server@2.0.0` passed at `2026-08-17T16:48:09.141Z` in its legacy-stateless compatibility mode. These results do not imply compatibility with every server or protocol feature. Provider capability claims are date-bound by the [live certification gate](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. OpenAI is GPT-5.6-first in `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. All three passed the local base approval/restart gate, but delegation, OCI execution, and release-artifact certification still require the release-candidate matrix. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -258,4 +291,5 @@ The live gate is opt-in and billable:
 
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run scripts/live-provider-smoke.ts
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:routing
 ```

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-17
+- Baseline date: 2026-08-20
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` plus `0.6.0` are published on npm. `0.6.1` is the local positioning and hostile-repository proof patch; publishing it remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.7.0` are published on npm. `0.8.0` is the source release candidate for the coordinated SDK refresh and GPT-5.6-first OpenAI integration; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -39,7 +39,9 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.4.0` | Durable operations | Inspectable, budgeted, cancellable, evaluable runs | Private checkpoint | L |
 | `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Published on npm | L |
 | `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
-| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Implemented locally | S |
+| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
+| `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
+| `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Source release candidate | M |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -99,7 +101,7 @@ Required release evidence:
 - migration and safety boundaries are documented without claiming host isolation or permanent deletion;
 - `0.3.0` remains private until an explicit publication decision is made.
 
-Validation snapshot (2026-08-16):
+Validation summary:
 
 - the trusted-editing implementation is merged into `main`;
 - deterministic, installed-package, and package-inspection CI gates pass on Linux and macOS;
@@ -130,7 +132,7 @@ Exit criteria:
 - Golden fixtures are deterministic and the regression gate runs in CI.
 - Exported operational artifacts are redacted by default and schema-versioned.
 
-Validation snapshot (2026-08-17):
+Validation summary:
 
 - deterministic tests, the five-case golden evaluation gate, typecheck, docs, build, and installed-tarball smoke pass;
 - migration, idempotency, concurrent ownership, expired-lease recovery, cancellation, retention, Qwen token enforcement, and export redaction have regression coverage;
@@ -160,13 +162,12 @@ Exit criteria:
 - MCP prompt injection and oversized/malformed result tests fail safely.
 - Provider-specific limitations are recorded in a live support matrix.
 
-Validation snapshot (2026-08-17 UTC):
+Validation summary:
 
 - deterministic tests, the seven-case golden evaluation gate, typecheck, docs, build, dependency audit, dry-run package inspection, and installed-tarball smoke pass;
 - malformed MCP, HTTP handshake/session, injection/output bounds, approval/restart, child mutation exactly-once, cancellation, scoped hierarchy, aggregate budget, and parallel review have regression coverage;
-- controlled Streamable HTTP MCP interoperability passed over a real loopback server with session negotiation, JSON and SSE responses, tool discovery, bounded execution, and forced network approval at `2026-08-17T16:48:09.043Z`;
-- independent interoperability with `@modelcontextprotocol/server@2.0.0` passed over loopback in its documented `2025-06-18` legacy-stateless compatibility mode at `2026-08-17T16:48:09.141Z`;
-- Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.4` passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix at `2026-08-17T02:21:45.553Z`;
+- controlled and official-SDK Streamable HTTP MCP interoperability passed over real loopback transports with session negotiation, bounded execution, and forced network approval;
+- the certified provider cohort passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix;
 - the exact `0.5.0` artifact was published and its post-publication registry/provenance verification completed; that evidence does not pre-certify `0.6.0`.
 
 ## 0.6.0 — Enforced execution environments
@@ -192,26 +193,75 @@ Exit criteria:
 - Installed-artifact and live-provider tests exercise the enforced backend.
 - The product is described as a local enforced runner, not a managed sandbox service.
 
-Implementation snapshot (2026-08-17):
+Implementation summary:
 
 - the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, per-tool-call isolation, manifest authorization, and run fingerprint binding;
 - the enforced policy denies network and undeclared tools, uses a non-root identity, read-only root, dropped capabilities, no-new-privileges, and bounded memory, CPU, PIDs, time, output, snapshot, imported-file, and tmpfs resources;
 - repository tools and subagents share an ephemeral secret-free snapshot; package checks and argv-only commands run inside OCI, while network MCP fails closed under the no-network policy;
 - content- and run-bound patch inspection plus a separate durable import approval are the only environment-to-host mutation path; deletes remain recoverable through quarantine;
 - lifecycle metadata, cancellation removal, run-labeled container and quota-volume cleanup, terminal artifact retention cleanup, deterministic regression tests, installed-package smoke, and required Linux OCI workflow gates are implemented;
-- the real Docker smoke passed again at `2026-08-17T16:48Z` against Docker `29.7.2` and the pinned Bun image digest, covering network/root/secret boundaries, total-workspace and per-file capacity, read-only dependency reuse, memory/PID/output limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
+- the real Docker smoke passed against the pinned image identity, covering network/root/secret boundaries, capacity and resource limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
 - the installed-package smoke passed with the public execution-environment API and snapshot/import flow;
 - the exact local `0.6.0` tarball passed the 31-file allowlist, SHA-512 generation, isolated consumer install, binary, public API, durability, and execution-environment smoke;
-- Meta, Qwen, and OpenAI passed the final model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix together at `2026-08-17T16:49:12.975Z`;
-- the base approval/restart matrix and bounded reviewer-delegation/persistence/hierarchy matrix passed again at `2026-08-17T16:22:34.885Z` and `2026-08-17T16:24:14.381Z` respectively;
+- the certified provider cohort passed the model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix;
+- the base approval/restart and bounded reviewer-delegation/persistence/hierarchy matrices passed against the release artifact;
 - `@zhivex-ai/core@1.6.0` resolves as one runtime through the aligned dependency batch;
-- annotated tag `v0.6.0`, push, protected OIDC publication, exact registry integrity, the `latest` distribution tag, and SLSA workflow provenance agree with source commit `fd420f7560b2`.
+- the annotated tag, protected publication, registry integrity, distribution tag, and SLSA workflow provenance agree with the release source.
 
 ### 0.6.1 positioning patch
 
 `0.6.1` keeps the `0.6.0` runtime, CLI, configuration, state, and library contracts unchanged. It adds a launch-oriented package description, expanded discovery metadata, a deterministic social card, structured issue forms, and a hostile-repository demo that exposes the existing safety chain as one reproducible product proof.
 
-Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. Publication, a `v0.6.1` tag, registry integrity, and provenance are not claimed until the normal protected release workflow completes.
+Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. The annotated `v0.6.1` tag, npm artifact, registry integrity, and provenance were subsequently verified through the protected workflow.
+
+## 0.7.0 — Multi-provider agent console
+
+Status: published on npm. Gemini and mixed-provider routing remain provisional until their required live validation is recorded in a later release artifact.
+
+Goal: turn the harness from a collection of one-shot commands into an ergonomic local agent console while preserving immutable runs and provider portability.
+
+Scope:
+
+- Publish the short `zhx` command while retaining `zhivex-harness` for scripts.
+- Add a durable SQLite session index that links immutable runs without duplicating prompts, messages, tool payloads, or provider data.
+- Add a public validated provider registry and native Gemini integration without aliasing an OpenAI-compatible transport.
+- Route explorer, implementer, tester, and reviewer roles to explicit provider/model pairs.
+- Add safe console commands for provider/model/routes, status, diff, review, session resume/new/rename, and deterministic redacted compaction.
+- Add sequence-numbered redacted JSONL events for automation.
+- Bind non-secret provider transport configuration into durable resume fingerprints.
+
+Exit criteria:
+
+- Registry, Gemini factory/diagnostics, sessions/reopen/fork/archive, routing, approval restart, JSONL redaction, and both CLI aliases pass deterministic and installed-package tests.
+- Cross-provider handoff always starts a new run, is blocked by pending approvals, and carries no raw tool/provider payload.
+- Existing `run`, `review`, `resume`, `runs`, final JSON, configuration schema, and `zhivex-harness` commands remain compatible.
+- Gemini passes the base edit/restart, delegation, and OCI matrices before moving from provisional to certified.
+- The exact tarball, release tag, registry integrity, and provenance are verified separately; source readiness is not publication.
+
+Deferred after `0.7.0`:
+
+- Per-provider/per-role cost pricing and evidence-backed routing presets.
+- Additional hosted and local providers, added one by one through the same registry and certification contract.
+- Remote workers or microVM backends; the current console stays local and Bun-first.
+
+## 0.8.0 — SDK refresh and GPT-5.6-first OpenAI
+
+Status: source release candidate. Deterministic, installed-artifact, live-provider, and publication evidence remain separate gates.
+
+Goal: adopt the coordinated SDK release batch without duplicating Core contracts, make the current GPT-5.6 family the primary OpenAI experience, and keep approval pauses reliable across provider behavior changes.
+
+Scope:
+
+- Pin Core `1.7.0`, Agents `1.2.0`, Meta `0.2.2`, Qwen `0.10.2`, OpenAI `0.9.6`, and Gemini `0.10.5`, with one overridden Core runtime.
+- Default OpenAI to `gpt-5.6-luna`, with explicit Terra and Sol selection.
+- Tell models to emit the reviewed approval-gated tool call so the runtime, rather than prose, owns the pause and restart boundary.
+- Document migration from the `0.7.x` OpenAI default and durable version binding.
+
+Exit criteria:
+
+- Frozen install, dependency deduplication, documentation, typecheck, tests, evaluation, build, package inspection, and installed-tarball smoke pass.
+- Luna, Terra, and Sol pass the base proposal/approval/restart/exactly-once live gate with date-bound evidence.
+- The exact release artifact, annotated tag, registry integrity, and provenance are verified independently before claiming publication.
 
 ## 1.0.0 — Stable CLI and library contract
 
@@ -258,7 +308,7 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review the `0.6.1` positioning/demo diff and run the full deterministic, real-OCI, and installed-artifact gates.
-2. Record the hostile-repository demo and publish the exact evidence output with the release notes.
-3. Merge/push the reviewed release commit, create the annotated `v0.6.1` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
-4. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.
+1. Finish the `0.8.0` deterministic, real-OCI, and installed-artifact gates from a clean release commit.
+2. Complete the remaining GPT-5.6 and provisional-provider live matrices; keep uncertified paths provisional on any failure or missing evidence.
+3. Dogfood the GPT-5.6 default, durable `zhx` sessions, provider handoff, role routing, and JSONL consumption on representative repositories.
+4. Only after those gates, complete the reviewed release workflow and verify registry integrity and provenance against the exact artifact.

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
+Zhivex Harness `0.8.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
@@ -10,7 +10,7 @@ Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observab
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.6.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published patch receives routine fixes. Meta and Qwen retain their date-bound certification, OpenAI GPT-5.6 has local `0.8.0` base-gate evidence, and Gemini remains provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels
 

package/dist/cli-stream.d.ts

@@ -0,0 +1,167 @@
+import type { AgentStreamEvent } from "@zhivex-ai/agents";
+export declare const CLI_JSON_SCHEMA_VERSION: 1;
+export declare const CLI_EVENT_SCHEMA_VERSION: 1;
+export interface StreamRunResultSource {
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals?: readonly ({
+        id: string;
+        kind: string;
+        name: string;
+        childRunId?: string;
+        childAgentId?: string;
+        [key: string]: unknown;
+    })[];
+    children?: readonly ({
+        runId: string;
+        status: string;
+        [key: string]: unknown;
+    })[];
+    [key: string]: unknown;
+}
+/**
+ * Convert runtime events into a stable, line-oriented CLI contract.
+ *
+ * Tool inputs, tool outputs, provider payloads, model messages, and error text
+ * are deliberately omitted: they can contain repository content or secrets.
+ */
+export declare const streamEventDocument: (event: AgentStreamEvent, sequence?: number) => {
+    textDelta: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    toolCallId: string;
+    toolName: string;
+    isError: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approvalKind: "provider" | "local-tool" | "subagent";
+    toolName: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    approvalRequestId: string;
+    approved: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    provider: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    index?: number;
+    id?: string;
+    provider: string;
+    partial: boolean;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    usage?: import("@zhivex-ai/core").TokenUsage;
+    finishReason?: import("@zhivex-ai/core").FinishReason;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    error: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    currentStep: number;
+    maxSteps: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    stepIndex: number;
+    status: import("@zhivex-ai/core").AgentStepStatus;
+    toolCalls: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    compactionId: string;
+    reasons: import("@zhivex-ai/core").AgentCompactionReason[];
+    messageCountBefore: number;
+    messageCountAfter: number;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+} | {
+    runId: string;
+    status: import("@zhivex-ai/core").AgentStatus;
+    provider: string;
+    model: string;
+    schemaVersion: 1;
+    kind: "run-event";
+    sequence: number;
+    type: "text-delta" | "tool-call" | "tool-result" | "tool-approval-request" | "provider-data" | "image-generation" | "finish" | "error" | "agent-run-start" | "agent-step-start" | "agent-step-finish" | "agent-approval-request" | "agent-approval-resolved" | "agent-compaction" | "agent-run-finish";
+};
+export declare const serializeStreamEvent: (event: AgentStreamEvent, sequence?: number) => string;
+/**
+ * Project the rich final JSON document onto the redacted JSONL contract.
+ *
+ * This is deliberately a whitelist. Output text, mutations, approval
+ * arguments, scope, paths, provider payloads, and configuration bindings can
+ * contain repository or operator data and must remain exclusive to the
+ * separate final-document contract.
+ */
+export declare const streamResultDocument: (result: StreamRunResultSource, sequence?: number) => {
+    schemaVersion: 1;
+    kind: "run-result";
+    sequence: number;
+    runId: string;
+    status: string;
+    provider: string;
+    model: string;
+    steps: number;
+    toolCalls: number;
+    pendingApprovals: {
+        childAgentId?: string;
+        childRunId?: string;
+        id: string;
+        kind: string;
+        name: string;
+    }[];
+    children: {
+        runId: string;
+        status: string;
+    }[];
+};
+export declare const serializeStreamResult: (result: StreamRunResultSource, sequence?: number) => string;