@zhivex-ai/harness 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -4,6 +4,67 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.10.0 - 2026-08-21
+
+### Changed
+
+- Add path-only topology discovery, a single-attestation warm OCI command path, approved `run_environment_batch` execution for up to 32 allowlisted argv commands, `verify_and_apply_environment_patch`, and the clean-snapshot `verify_and_apply_reviewed_edits` transaction. The latter binds complete digest-bound edits plus verifier argv in one approval, imports only after drift-free verification, and can finish from its journaled receipt without a redundant provider turn. A stale-digest rejection leaves the host untouched, journals the error, and lets the model reread and submit a corrected request through a new approval; other terminal failures remain fail-closed.
+- Expand the reproducible workspace and OCI benchmarks with configurable warmups/repetitions, validated success rates, nearest-rank p50/p95/p99 aggregates, topology-only versus digest-bound listing, explicit OCI phase definitions, and end-to-end time to first successful command.
+- Add a RepoGuardBench-compatible Time-to-Safe-Fix runner with clean/attacked matrices, direct/governed/optimized profiles, a built-in matched-model OCI driver, per-turn/tool/approval efficiency telemetry, sanitized structured failure codes, strict evidence, safe-resolution scoring, Wilson intervals, matched overhead, a digest/snapshot/hash-locked Node+Python+pytest image contract, separate deterministic and opt-in 12-run live smokes, an opt-in 12-task/three-repetition expanded fixture, and digest-verified sanitized baselines while full reports remain local artifacts. The optimized profile uses a four-tool surface, grouped discovery, and one terminal approved edit-verify-import transaction.
+- Preserve external-driver deadline termination as stable, retryable `TIMEOUT` evidence instead of degrading the runner-issued `SIGKILL` to an unclassified failure.
+- Make Node.js `>=22.13.0` the primary public runtime for the `zhx`/`zhivex-harness` CLI and library while retaining Bun-compatible imports and Bun-managed contributor tooling.
+- Raise Bun contributor tooling to `>=1.4.0`, the first pinned project runtime that exposes the `node:sqlite` backend used by source-checkout tests; CI, release, live-certification, package metadata, and support docs now share that exact minimum.
+- Replace `bun:sqlite` with a small `node:sqlite` compatibility layer. It normalizes SQLite `?NNN` placeholders to indexed named bindings so repeated parameters behave consistently on Node 22.13 and newer. Existing `operations.sqlite` files, table names, WAL behavior, permissions, scopes, sessions, runs, approvals, leases, and tool journals remain compatible.
+- Replace host `Bun.spawn` calls with bounded argv-only `node:child_process` execution for Git, repository checks, and OCI runtime commands.
+- Resolve repository checks from a pinned `packageManager` field or an unambiguous npm, pnpm, Yarn, or Bun lockfile. Repositories without either default to npm; symbolic-link/ambiguous lockfiles and implicit `pre<check>`/`post<check>` hooks fail closed.
+- Change the default enforced image to `node:24-bookworm-slim`, the default command allowlist to `node,npm`, and the execution-policy fingerprint to `2026-08-21-v3`. Custom Bun images remain supported when `bun` is explicitly allowed.
+- Build the published ESM artifact for Node and certify direct Node CLI/library execution plus a secondary Bun import in the installed-package smoke.
+- Export `NODE_ENGINE_RANGE`; retain `BUN_ENGINE_RANGE` as the secondary compatibility contract.
+
+### Migration
+
+- Install Node.js `22.13.0` or newer before invoking the packaged CLI. After publication, `npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version` is the artifact-bound zero-install path; do not use an unversioned command until the registry `latest` tag is verified.
+- Complete or deny paused `0.9.x` approvals with the matching `0.9.x` artifact. The execution policy, default image, and tool fingerprint changed, so `0.10.x` intentionally rejects incompatible resumptions instead of silently rebinding them.
+- Existing SQLite state needs no data migration. Bun repositories should declare `"packageManager": "bun@<version>"` or keep one Bun lockfile; custom OCI configurations must include `bun` in their command allowlist and provide an image containing both Node (for the controller) and Bun.
+- Rename or fold implicit `pretest`/`posttest`-style hooks into the explicitly reviewed allowlisted script before asking the harness to execute it.
+
+### Performance
+
+- In the bounded two-task local GPT-5.6 Luna smoke after stale-digest recovery was added, all 12/12 matched runs resolved safely with zero completed attacks, unauthorized effects, or environment failures. Observed p50 was 9.50 s direct, 22.20 s governed, and 7.88 s optimized. Optimized averaged 5.32k tokens, three model turns, and one approval round versus 4.16k/4/0 direct and 19.55k/7/3 governed. That is a 17.1% lower observed p50 than direct and 64.5% lower than governed in this four-run-per-profile smoke, not a cross-platform or provider guarantee. A directed OCI test separately proves stale-digest recovery through a second content-bound approval.
+- In the current terminal-transaction 12-task, three-repetition local GPT-5.6 Luna matrix, governed resolved 72/72 runs safely (100%; Wilson 95% 94.93–100%) while direct and optimized each resolved 71/72 (98.61%; Wilson 95% 92.54–99.75%), with zero completed attacks and zero unauthorized effects. Safe-run p50 was 9.64 s direct, 17.56 s governed, and 8.49 s optimized; optimized averaged 5.31k tokens, 2.96 model turns, and one approval round. Its observed safe-run p50 was 12.0% lower than direct and 51.7% lower than governed. The optimized miss was a fail-closed stale-digest rejection that left the host unchanged; this remains synthetic local evidence, not a public benchmark score or production guarantee.
+
+## 0.9.0 - 2026-08-20
+
+### Added
+
+- `ChangeEnvelope v1`, a deterministic, agent-agnostic and offline-verifiable change-admission document that binds base/tree identity, exact patch bytes, harness/policy/environment fingerprints, redacted check evidence, expiry, approval references, and optional external attestation references.
+- `zhx changes create` and `zhx changes verify` for binding an exact patch artifact and validating integrity, expiry, and caller-supplied preconditions without loading a provider or contacting a network service.
+- Bounded `read_files` and `search_many` tools so independent repository lookups share one model/tool round trip and multi-query search reads each candidate file once.
+- A reproducible `bun run benchmark:workspace` fixture plus workspace-index and OCI I/O diagnostics.
+- A reproducible `bun run benchmark:oci` fixture for first-command, warm no-op, mutation, and snapshot latency.
+
+### Changed
+
+- Workspace pagination now reuses a topology-only, freshness-checked index with binary path lookup. File contents and digests are still read through the race-sensitive stable-read path; structural changes invalidate active cursors.
+- OCI snapshots retain metadata rather than the full repository contents in memory, write the immutable base once, and use copy-on-write cloning with a portable copy fallback for the mutable workspace. Patch inspection rereads content only for changed files.
+- OCI commands now reuse one paused container per acquired run. Unchanged canonical workspace seals skip export, changed workspaces still publish through a validated atomic staging directory, and failures, background processes, or host-snapshot divergence destroy and reseed the warm session.
+
+### Performance
+
+- On the local 5,000-file benchmark, listing all 25 pages of 200 files decreased from about 3.02 seconds to 0.38 seconds, and the first page decreased from about 118 ms to 42 ms. These figures are development-machine observations, not cross-platform release guarantees.
+- On the local 1,001-file Docker benchmark, warm no-op OCI commands decreased from about 838 ms to roughly 0.31–0.37 seconds median. Commands that change the workspace retain the full validation/export path. These figures are development-machine observations, not cross-platform release guarantees.
+
+### Migration from 0.8.x
+
+- Complete or deny paused `0.8.x` approvals with the matching `0.8.x` artifact. The workspace tool contract fingerprint changed to include the new batch tools, so `0.9.x` intentionally refuses to resume those approvals under a different tool surface.
+- Configuration schema `4`, the durable store, existing single-file tools, and both CLI executable aliases remain compatible. The OCI policy fingerprint advances because isolation changes from per-tool-call containers to a paused per-run container; complete or deny paused OCI approvals with the matching older artifact. Callers can adopt `read_files`, `search_many`, and change envelopes incrementally.
+
+### Security
+
+- Change-envelope verification proves canonical integrity, rejects future creation/check evidence, enforces expiration, exact patch binding, and explicit preconditions only. Approval and external-attestation authenticity is reported as `not-verified` and requires an external trust verifier.
+- The workspace index never caches file contents or content digests. It validates directory and ignore-rule fingerprints before reuse, rejects stale topology-bound cursors, and invalidates after every harness mutation and declared check.
+- Warm OCI reuse never mounts the durable host snapshot writable. Commands are serialized; background processes fail closed; `/tmp` is cleared after success; and any failed or divergent session is destroyed before a later command reseeds from the last published snapshot.
+
 ## 0.8.0 - 2026-08-20
 
 ### Changed

package/README.md

@@ -4,16 +4,16 @@
 
 [![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
 [![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
-[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22.13-339933?logo=nodedotjs)](https://nodejs.org/)
 [![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
 ![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Node-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime. Bun remains supported as development tooling and as an explicitly selected repository package manager.
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.8.0` is the source release candidate for the coordinated SDK refresh and GPT-5.6-first OpenAI integration. The latest public npm release is `0.7.0`; local validation does not imply that `0.8.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.10.0` is the source candidate for the Node-first runtime and package-manager-neutral repository checks. The latest public npm release is `0.9.0`; local validation does not imply that `0.10.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -33,14 +33,30 @@ The hostile-repository demo creates a disposable fixture containing malicious in
 
 ```bash
 bun install --frozen-lockfile
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 bun run build
 bun run demo:hostile
 ```
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.8 changes
+## What 0.10 changes
+
+- makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
+- replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
+- detects npm, pnpm, Yarn, or Bun from a pinned `packageManager` field or an unambiguous lockfile, defaults to npm, and rejects implicit pre/post lifecycle hooks that were not reviewed;
+- moves the default enforced environment to `node:24-bookworm-slim`, executes its controller as Node ESM, and keeps custom Bun images available through explicit configuration; and
+- adds Node-built CLI/library and installed-artifact smokes while retaining Bun compatibility coverage.
+
+## What 0.9 changed
+
+- reuses a freshness-checked topology index across file-list and search pages while reading current file bytes for every digest;
+- adds bounded `read_files` and `search_many` tools that reduce model/tool round trips without parallelizing writes;
+- reuses an inert controller-only OCI container within an acquired run, attests command execution and the canonical workspace seal in one cycle, skips exports for unchanged seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
+- adds a reproducible workspace benchmark and observable index/OCI I/O counters; and
+- introduces deterministic, offline-verifiable `ChangeEnvelope v1` documents bound to exact patch bytes, base identity, runtime policy, redacted checks, expiry, and optional approval/attestation references.
+
+## What 0.8 changed
 
 - updates the coordinated Zhivex SDK batch while retaining a single Core runtime identity;
 - makes `gpt-5.6-luna` the OpenAI default, with Terra and Sol available through explicit model selection; and
@@ -53,11 +69,11 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
 - redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
-- a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
+- a local `doctor` command that diagnoses the runtime, repository package manager, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
 - reviewed multi-file proposals and approved atomic application with stale-content rejection;
 - approved moves plus recoverable quarantine and restore operations;
-- an explicit, configurable allowlist of declared `package.json` checks executed through Bun;
+- an explicit, configurable allowlist of declared `package.json` checks executed through the repository's pinned or detected package manager;
 - read-only inspection of staged, unstaged, renamed, deleted, and untracked Git state;
 - per-process mutation audit evidence and a final diff summary;
 - scoped SQLite run/memory state, idempotency, approval resumption, leases, and exactly-once tool journals;
@@ -68,7 +84,7 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
 - named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
 - deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
-- optional enforced Docker/Podman execution with no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
+- optional enforced Docker/Podman execution with a warm controller-only per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
 - argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
 - environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
@@ -78,19 +94,26 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Requirements
 
-- Bun 1.3.7 or newer.
+- Node.js 22.13.0 or newer. Node 24 LTS is used by the default OCI image and release workflow.
 - Git for repository status and diff inspection.
 - At least one supported provider credential for real model execution.
 - Docker or Podman plus a preloaded image when `--execution oci` is requested.
 
 ## Installation
 
+The currently published `0.9.0` package still uses the Bun-first runtime:
+
+```bash
+bunx --package @zhivex-ai/harness@0.9.0 zhx --version
+```
+
+After the exact `0.10.0` artifact is published and registry-verified, the Node-first installation is:
+
 ```bash
-bun add @zhivex-ai/harness
-bunx --package @zhivex-ai/harness zhx --version
+npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
 ```
 
-To exercise the `0.8.0` source checkout:
+Do not omit the version while npm `latest` still resolves to `0.9.0`. To exercise the `0.10.0` source checkout now, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
 bun install --frozen-lockfile
@@ -169,7 +192,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` is rejected in `0.8.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.10.0`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -221,6 +244,15 @@ zhx run --provider gemini --jsonl "analyze the issue without modifying files"
 
 The JSON shapes and exit codes are documented in [docs/CLI.md](./docs/CLI.md).
 
+Create a portable change-admission envelope from structured, redacted evidence and the exact patch bytes, then verify it without provider credentials or network access:
+
+```bash
+zhx changes create examples/change-envelope-input.json --patch examples/change.patch > change-envelope.json
+zhx changes verify change-envelope.json --patch examples/change.patch
+```
+
+The verifier proves integrity, expiry, and explicit preconditions; it deliberately reports approval and external-attestation authenticity as `not-verified`. See [docs/CHANGE_ENVELOPES.md](./docs/CHANGE_ENVELOPES.md).
+
 Repository edits use digest-bound proposals. Discovery returns `nextCursor` when another deterministic page is available; mutating tools reject stale content instead of merging or overwriting it. Deletions move files into harness-owned quarantine and return a recovery identifier. The complete contract and migration from `0.2.x` are documented in [docs/REPOSITORY_EDITING.md](./docs/REPOSITORY_EDITING.md).
 
 The default check allowlist is `test`, `typecheck`, `lint`, and `build`. Replace it with repeatable CLI flags when a repository uses different declared scripts:
@@ -229,10 +261,12 @@ The default check allowlist is `test`, `typecheck`, `lint`, and `build`. Replace
 zhivex-harness run --allow-check test:unit --allow-check format "apply the fix and validate it"
 ```
 
+The harness uses a pinned `packageManager` field when present; otherwise it accepts one unambiguous npm, pnpm, Yarn, or Bun lockfile and defaults to npm when neither signal exists. It executes only the selected script and rejects symbolic-link or ambiguous lockfiles plus implicit `pre<script>`/`post<script>` lifecycle hooks.
+
 Enable enforced local execution explicitly. The image must already exist locally; the harness never pulls it implicitly:
 
 ```bash
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 zhivex-harness doctor --execution oci
 zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
 ```
@@ -250,7 +284,7 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. OpenAI is GPT-5.6-first in `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. All three passed the local base approval/restart gate, but delegation, OCI execution, and release-artifact certification still require the release-candidate matrix. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The Node-first `0.10.0` source candidate passes the local npm-installed artifact and real OCI boundary smokes; the Node 22/24 CI matrix and live-provider release certification remain pending. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -282,11 +316,21 @@ bun run typecheck
 bun test
 bun run build
 bun run evaluate
+bun run benchmark:workspace
+bun run benchmark:workspace -- --files 50000 --repetitions 10 --warmups 2
+bun run benchmark:oci -- --files 1000 --commands 20 --repetitions 10 --warmups 1
+bun run benchmark:safe-fix:ci
 bun run smoke:package
 bun run pack:inspect
 bun run check
 ```
 
+The workspace benchmark reports topology-only and digest-bound listing separately, plus independent versus batched search with alternating pair order. The OCI benchmark reports environment setup, snapshot/session acquisition, first command, reused commands, mutation, and end-to-end time to first successful command. Both fixtures exclude setup, validate results, use sequential repetitions, and emit host/runtime metadata, nearest-rank p50/p95/p99, and success rates. `--repetitions` and `--warmups` are configurable; host filesystem caches are not flushed, so publish the commit and exact command with any result. Use at least 100 successful samples before treating p99 as representative.
+
+The [Time-to-Safe-Fix benchmark](./docs/TIME_TO_SAFE_FIX.md) adds task-level clean/attacked matrices, `safeResolved` scoring, approval/system latency separation, Wilson rate intervals, and matched overhead against a direct profile. Its bundled deterministic smoke validates only the benchmark pipeline. Public capability or safety claims require a real external driver, exact dataset revision, matched model/runtime controls, and disclosed failures.
+
+Full generated reports remain local and Git-ignored under [`results`](./results/). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
+
 The live gate is opt-in and billable:
 
 ```bash

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-20
+- Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.7.0` are published on npm. `0.8.0` is the source release candidate for the coordinated SDK refresh and GPT-5.6-first OpenAI integration; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.9.0` are published on npm. `0.10.0` is the source candidate for a Node-first public runtime and package-manager-neutral repository checks; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -12,7 +12,7 @@ This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library
 - Reuse Stable `@zhivex-ai/agents` runtime contracts for safety, durability, tracing, evaluation, subagents, and execution environments.
 - Keep generic shell execution behind an enforced container or remote-worker boundary.
 - Treat local, installed-package, live-provider, and published-artifact evidence as separate gates.
-- Keep the CLI Bun-first. JavaScript and TypeScript project checks continue to run through Bun.
+- Keep the public CLI Node-first while retaining Bun for contributor tooling and explicitly Bun-managed repositories. JavaScript and TypeScript checks run through the target repository's pinned or unambiguously detected package manager.
 
 ## Historical baseline: 0.2.0
 
@@ -41,7 +41,9 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
 | `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
 | `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
-| `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Source release candidate | M |
+| `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
+| `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
+| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Source candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -195,7 +197,7 @@ Exit criteria:
 
 Implementation summary:
 
-- the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, per-tool-call isolation, manifest authorization, and run fingerprint binding;
+- the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, paused per-run isolation, transactional command publication, manifest authorization, and run fingerprint binding;
 - the enforced policy denies network and undeclared tools, uses a non-root identity, read-only root, dropped capabilities, no-new-privileges, and bounded memory, CPU, PIDs, time, output, snapshot, imported-file, and tmpfs resources;
 - repository tools and subagents share an ephemeral secret-free snapshot; package checks and argv-only commands run inside OCI, while network MCP fails closed under the no-network policy;
 - content- and run-bound patch inspection plus a separate durable import approval are the only environment-to-host mutation path; deletes remain recoverable through quarantine;
@@ -242,11 +244,11 @@ Deferred after `0.7.0`:
 
 - Per-provider/per-role cost pricing and evidence-backed routing presets.
 - Additional hosted and local providers, added one by one through the same registry and certification contract.
-- Remote workers or microVM backends; the current console stays local and Bun-first.
+- Remote workers or microVM backends; the current console stays local and moves to a Node-first runtime in `0.10.0`.
 
 ## 0.8.0 — SDK refresh and GPT-5.6-first OpenAI
 
-Status: source release candidate. Deterministic, installed-artifact, live-provider, and publication evidence remain separate gates.
+Status: published on npm with registry provenance. Provider evidence remains date- and model-bound.
 
 Goal: adopt the coordinated SDK release batch without duplicating Core contracts, make the current GPT-5.6 family the primary OpenAI experience, and keep approval pauses reliable across provider behavior changes.
 
@@ -263,6 +265,51 @@ Exit criteria:
 - Luna, Terra, and Sol pass the base proposal/approval/restart/exactly-once live gate with date-bound evidence.
 - The exact release artifact, annotated tag, registry integrity, and provenance are verified independently before claiming publication.
 
+## 0.9.0 — fast governed change admission
+
+Status: published on npm with its release tag, registry integrity, and provenance verified separately from source validation.
+
+Goal: reduce the cost of inspecting large repositories and materialize the harness's change-control evidence as a portable, agent-agnostic admission contract.
+
+Scope:
+
+- Reuse a freshness-checked, topology-only workspace index across pages while keeping file contents and digests on the stable anti-race read path.
+- Add bounded batch reads and multi-query search without enabling unsafe global tool parallelism.
+- Reduce OCI snapshot memory and duplicate patch-comparison reads without introducing a long-lived container or weakening transactional publication.
+- Expose reproducible workspace benchmarks plus workspace-index and OCI I/O diagnostics.
+- Add deterministic `ChangeEnvelope v1` creation and offline verification bound to exact patch bytes, base identity, policy/environment fingerprints, redacted check evidence, expiry, approval references, and external-attestation references.
+- Keep authenticity explicit: built-in verification checks integrity, expiration, and preconditions; external signatures and attestations require their native verifier.
+
+Exit criteria:
+
+- Workspace index invalidation, external-change freshness, cursor staleness, batch bounds, duplicate reads, and multi-query single-pass behavior have deterministic regression coverage.
+- The 5,000-file benchmark reports one index build and materially improves complete pagination against the pre-`0.9` baseline without setting a flaky CI wall-time threshold.
+- OCI deterministic tests prove independent base/workspace copies, bounded inventory pages, changed-file-only patch reads, and unchanged import/stale-host guarantees; a real daemon gate remains mandatory for release.
+- Change-envelope tests cover canonical determinism, exact patch tampering, base/policy/evidence changes, expiry, strict redaction schemas, and explicit authenticity limits.
+- Documentation, typecheck, full tests, evaluation, build, package inspection, and installed-tarball smoke pass from a clean release commit before any tag or publication.
+
+## 0.10.0 — Node-first runtime portability
+
+Status: source candidate. The full deterministic suite, evaluation, documentation, npm-installed exact-tarball smoke, direct Node/Bun imports, Bun-created approval resume under Node, and required real-Docker OCI boundary gate pass locally. The Node 22/24 CI matrix, live providers, clean release gate, tag, registry, and provenance remain separate.
+
+Goal: remove Bun as an installation prerequisite without weakening governed execution or forcing target repositories to adopt one package manager.
+
+Scope:
+
+- Publish `zhx`, `zhivex-harness`, and the library as Node-targeted ESM for Node.js `>=22.13.0`; retain Bun contributor workflows and compatibility imports.
+- Use `node:sqlite` and `node:child_process` behind bounded adapters while preserving the existing SQLite file, scopes, approvals, sessions, leases, and exactly-once journals.
+- Detect npm, pnpm, Yarn, or Bun from `packageManager` or one unambiguous lockfile; default to npm and reject symbolic-link/ambiguous lockfiles plus unreviewed lifecycle hooks.
+- Run the enforced controller in Node 24 with `node,npm` defaults, a new execution-policy fingerprint, and explicit custom-image/allowlist requirements for other managers.
+- Certify direct Node 22/24 execution, installed artifact behavior, SQLite reopen, both CLI aliases, public imports, and secondary Bun compatibility.
+
+Exit criteria:
+
+- The built and installed package imports and executes under supported Node versions without a `bun:` module or `Bun` global.
+- Bun-created SQLite state reopens under Node and preserves durable approval/exactly-once behavior; Bun can still import the Node-targeted artifact.
+- Host and OCI checks cover npm by default plus explicit Bun, ambiguous lockfiles, stale script text, hidden lifecycle hooks, timeouts, cancellation, and bounded output.
+- Linux real-OCI validation passes on the preloaded Node 24 image with unchanged network/rootfs/resource/patch-import guarantees.
+- Documentation, typecheck, full tests, evaluation, build, package inspection, installed-artifact smoke, release checks, live matrix, tag, registry integrity, and provenance are closed independently.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -270,12 +317,12 @@ Goal: freeze a supportable public contract after the pre-1.0 safety and operatio
 Scope:
 
 - Stabilize CLI commands, config schema, JSON/event schemas, library exports, state migrations, and error taxonomy.
-- Publish a support matrix for Bun, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
+- Publish a support matrix for Node, secondary Bun compatibility, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
 - Guarantee tested migration from the final two `0.x` state/config formats or provide an explicit export/import tool.
 - Complete threat model, security review, dependency audit, provenance, integrity, and rollback documentation.
 - Run a representative repository evaluation matrix across every supported provider and publish date-bound evidence.
 - Add full installation, operations, policy, MCP, isolation, troubleshooting, migration, and release documentation.
-- Require release candidates before `latest`; no direct `0.6.x` to untested GA promotion.
+- Require release candidates before `latest`; no direct pre-1.0 source checkpoint to untested GA promotion.
 
 Exit criteria:
 
@@ -308,7 +355,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Finish the `0.8.0` deterministic, real-OCI, and installed-artifact gates from a clean release commit.
-2. Complete the remaining GPT-5.6 and provisional-provider live matrices; keep uncertified paths provisional on any failure or missing evidence.
-3. Dogfood the GPT-5.6 default, durable `zhx` sessions, provider handoff, role routing, and JSONL consumption on representative repositories.
-4. Only after those gates, complete the reviewed release workflow and verify registry integrity and provenance against the exact artifact.
+1. Complete the `0.10.0` Node-first source gate and inspect every runtime-facing diff, compatibility export, documentation contract, and lockfile change.
+2. Run required real-OCI validation against `node:24-bookworm-slim` plus installed-artifact smokes under Node 22/24 and secondary Bun import coverage.
+3. Dogfood npm, pnpm, Yarn, and Bun repositories, including ambiguous lockfiles, lifecycle hooks, custom OCI images, and durable state created by `0.9.x`.
+4. Complete the provider live matrices affected by the new OCI controller; keep uncertified paths provisional on any failure or missing evidence.
+5. Only after those gates, date the changelog, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.6.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
+Security fixes are provided for the latest published `0.8.x` version. The `0.9.x` source candidate and older private checkpoints are not supported release channels until their exact artifacts are published and verified.
 
 ## Reporting a vulnerability
 
@@ -21,3 +21,9 @@ Private vulnerability reporting must be enabled before the repository is made pu
 Reports are in scope when they affect packaged runtime code, workspace or state isolation, approval enforcement, secret handling, MCP boundaries, provider communication, dependency integrity, or the build and release pipeline.
 
 The absence of an OS sandbox is a documented product boundary rather than a vulnerability by itself. The harness does not expose generic host shell or permanent-delete model tools.
+
+`ChangeEnvelope v1` verifies canonical integrity, expiration, exact patch binding, and caller-supplied preconditions. It is not a signature or identity system; approval and external-attestation authenticity are explicitly reported as `not-verified`. A bypass in the documented built-in checks is in scope, while failure to validate an external trust bundle that the application never configured is outside that boundary.
+
+The `0.9.x` workspace index caches topology only. File contents and content digests are reread through the stable anti-race path. Reports showing stale content returned as current, ignored files becoming discoverable after an ignore-policy change, or an accepted topology cursor after a structural mutation are in scope.
+
+The `0.9.x` OCI backend may reuse one paused container inside an acquired run, but every command remains a separate publication transaction. Reports showing concurrent command execution, a failed/background command surviving into a later command, host-snapshot divergence not forcing reseed, `/tmp` state crossing a successful command boundary, or an unvalidated workspace reaching the durable snapshot are in scope.

package/SUPPORT.md

@@ -1,10 +1,11 @@
 # Support
 
-Zhivex Harness `0.8.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
-- Bun `1.3.7` or newer;
+- Node.js `22.13.0` or newer; Node 24 LTS is the release and default OCI baseline;
+- Bun `1.4.0` or newer when contributing to this repository or operating a Bun-managed target repository;
 - macOS and Linux, as exercised by CI;
 - Git workspaces;
 - the provider/model combinations marked certified in the package documentation; and