@zhivex-ai/harness 0.8.0 → 0.10.0

package/dist/zhx.js

@@ -1,23 +1,24 @@
-#!/usr/bin/env bun
-// @bun
+#!/usr/bin/env node
 
 // src/cli.ts
-import { createInterface } from "readline/promises";
-import { randomUUID as randomUUID5 } from "crypto";
-import { constants as fsConstants } from "fs";
-import { access, lstat as lstat7, readFile as readFile4, stat as stat4 } from "fs/promises";
-import path9 from "path";
+import { createInterface } from "node:readline/promises";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { constants as fsConstants2, realpathSync as realpathSync2 } from "node:fs";
+import { access, lstat as lstat8, readFile as readFile4, stat as stat4 } from "node:fs/promises";
+import path10 from "node:path";
+import { fileURLToPath } from "node:url";
+import { z as z5 } from "zod";
 import {
   getAgentBudgetStatus as getAgentBudgetStatus3
 } from "@zhivex-ai/agents";
 
 // src/config.ts
-import { createHash as createHash2 } from "crypto";
-import { realpathSync } from "fs";
-import path from "path";
+import { createHash as createHash2 } from "node:crypto";
+import { realpathSync } from "node:fs";
+import path from "node:path";
 
 // src/providers.ts
-import { createHash } from "crypto";
+import { createHash } from "node:crypto";
 import { createGemini } from "@zhivex-ai/gemini";
 import { createMeta } from "@zhivex-ai/meta";
 import { createOpenAI } from "@zhivex-ai/openai";
@@ -371,11 +372,11 @@ var HARNESS_CONFIG_SCHEMA_VERSION = 4;
 var HARNESS_STORE_BACKENDS = ["sqlite", "file"];
 var HARNESS_EXECUTION_BACKENDS = ["none", "oci"];
 var HARNESS_OCI_RUNTIMES = ["docker", "podman"];
-var HARNESS_EXECUTION_POLICY_VERSION = "2026-08-17-v1";
+var HARNESS_EXECUTION_POLICY_VERSION = "2026-08-21-v3";
 var DEFAULT_OCI_EXECUTION = {
   runtime: "docker",
-  image: "oven/bun:1.3.7-slim",
-  allowedCommands: ["bun"],
+  image: "node:24-bookworm-slim",
+  allowedCommands: ["node", "npm"],
   maxProcessRuntimeMs: 120000,
   maxProcessOutputBytes: 20000,
   maxMemoryMb: 1024,
@@ -500,8 +501,8 @@ var resolveOciAllowedCommands = (configured) => {
   if (invalid) {
     throw new Error(`Invalid OCI command name: ${invalid}. Use a bare executable name without a path.`);
   }
-  if (!commands.includes("bun")) {
-    throw new Error("ociAllowedCommands must include bun so declared package checks remain available.");
+  if (!commands.some((command) => ["npm", "pnpm", "yarn", "bun"].includes(command))) {
+    throw new Error("ociAllowedCommands must include npm, pnpm, yarn, or bun so declared package checks remain available.");
   }
   return commands;
 };
@@ -656,7 +657,7 @@ var createProviderModel = (config, env = process.env, registry = DEFAULT_PROVIDE
 var providerAvailability = (env = process.env, registry = DEFAULT_PROVIDER_REGISTRY) => registry.availability(env);
 
 // src/harness.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash7 } from "node:crypto";
 import {
   Agent,
   applySafetyPolicyToAgent as applySafetyPolicyToAgent2,
@@ -726,8 +727,8 @@ var selectHarnessModel = (candidates, required) => {
 };
 
 // src/edit-contracts.ts
-import { createHash as createHash3 } from "crypto";
-import path2 from "path";
+import { createHash as createHash3 } from "node:crypto";
+import path2 from "node:path";
 import { z } from "zod";
 var EDIT_CONTRACT_SCHEMA_VERSION = 1;
 var EDIT_DIGEST_ALGORITHM = "sha256";
@@ -861,27 +862,278 @@ var editContractDocument = (kind, result) => ({
 });
 
 // src/workspace.ts
-import { createHash as createHash4, randomUUID } from "crypto";
-import { link, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "fs/promises";
-import path3 from "path";
+import { createHash as createHash4, randomUUID } from "node:crypto";
+import { link, lstat as lstat2, mkdir, open, readFile, readdir, realpath, rename, stat, unlink } from "node:fs/promises";
+import path4 from "node:path";
+
+// src/package-manager.ts
+import { lstat } from "node:fs/promises";
+import path3 from "node:path";
+var HARNESS_PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+var LOCKFILES = {
+  npm: ["package-lock.json", "npm-shrinkwrap.json"],
+  pnpm: ["pnpm-lock.yaml"],
+  yarn: ["yarn.lock"],
+  bun: ["bun.lock", "bun.lockb"]
+};
+var isPackageManager = (value) => HARNESS_PACKAGE_MANAGERS.includes(value);
+var parsePackageManager = (value) => {
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    throw new Error("package.json packageManager must be a string when present.");
+  }
+  const match = /^(npm|pnpm|yarn|bun)@([^\s]+)$/.exec(value.trim());
+  if (!match?.[1] || !match[2]) {
+    throw new Error("package.json packageManager must pin npm, pnpm, yarn, or bun using <manager>@<version>.");
+  }
+  if (!isPackageManager(match[1])) {
+    throw new Error(`Unsupported package manager: ${match[1]}.`);
+  }
+  return match[1];
+};
+var existingLockfiles = async (root) => {
+  const matches = [];
+  for (const manager of HARNESS_PACKAGE_MANAGERS) {
+    for (const file of LOCKFILES[manager]) {
+      try {
+        const entry = await lstat(path3.join(root, file));
+        if (entry.isSymbolicLink()) {
+          throw new Error(`Package-manager lockfile must not be a symbolic link: ${file}.`);
+        }
+        if (entry.isFile())
+          matches.push({ manager, file });
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
+  }
+  return matches;
+};
+var resolvePackageManager = async (root, manifest) => {
+  const declared = parsePackageManager(manifest.packageManager);
+  if (declared) {
+    return {
+      manager: declared,
+      source: "packageManager",
+      evidence: manifest.packageManager
+    };
+  }
+  const lockfiles = await existingLockfiles(root);
+  const managers = [...new Set(lockfiles.map((entry) => entry.manager))];
+  if (managers.length > 1) {
+    throw new Error(`Ambiguous package manager: found lockfiles for ${managers.join(", ")}; declare packageManager explicitly.`);
+  }
+  const detected = managers[0];
+  if (detected) {
+    return {
+      manager: detected,
+      source: "lockfile",
+      evidence: lockfiles.filter((entry) => entry.manager === detected).map((entry) => entry.file).join(",")
+    };
+  }
+  return { manager: "npm", source: "default" };
+};
+var runCommand = (manager, check) => {
+  switch (manager) {
+    case "bun":
+      return ["bun", "--no-env-file", "run", check];
+    case "npm":
+      return ["npm", "--ignore-scripts", "run", check];
+    case "pnpm":
+      return ["pnpm", "--ignore-scripts", "run", check];
+    case "yarn":
+      return ["yarn", "run", check];
+  }
+};
+var resolvePackageCheckCommand = async (root, manifest, check, expectedScript, allowedChecks) => {
+  if (!/^[A-Za-z0-9:_-]+$/.test(check) || !allowedChecks.includes(check)) {
+    throw new Error(`The check "${check}" is not in the explicit allowlist.`);
+  }
+  const scripts = manifest.scripts && typeof manifest.scripts === "object" ? manifest.scripts : {};
+  const actual = scripts[check];
+  if (typeof actual !== "string") {
+    throw new Error(`package.json does not define the "${check}" script.`);
+  }
+  if (actual !== expectedScript) {
+    throw new Error(`The "${check}" script changed or does not match expectedScript.`);
+  }
+  for (const lifecycleName of [`pre${check}`, `post${check}`]) {
+    if (typeof scripts[lifecycleName] === "string") {
+      throw new Error(`The approved "${check}" check has an implicit ${lifecycleName} lifecycle script; approve a standalone script instead.`);
+    }
+  }
+  const resolution = await resolvePackageManager(root, manifest);
+  return { ...resolution, command: runCommand(resolution.manager, check) };
+};
+
+// src/process-runtime.ts
+import { spawn } from "node:child_process";
+var DEFAULT_MAX_OUTPUT_CHARACTERS = 20000;
+var DEFAULT_TERMINATION_GRACE_MS = 1000;
+var PORTABLE_ENVIRONMENT_KEYS = [
+  "CI",
+  "FORCE_COLOR",
+  "LANG",
+  "LC_ALL",
+  "NO_COLOR",
+  "PATH",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR"
+];
+
+class BoundedTextCapture {
+  decoder = new TextDecoder;
+  maxCharacters;
+  output = "";
+  totalCharacters = 0;
+  constructor(maxCharacters) {
+    this.maxCharacters = maxCharacters;
+  }
+  write(chunk) {
+    this.append(this.decoder.decode(chunk, { stream: true }));
+  }
+  finish() {
+    this.append(this.decoder.decode());
+    return this.totalCharacters <= this.maxCharacters ? this.output : `${this.output}
+… output truncated (${this.totalCharacters - this.maxCharacters} characters omitted)`;
+  }
+  append(value) {
+    this.totalCharacters += value.length;
+    if (this.output.length < this.maxCharacters) {
+      this.output += value.slice(0, this.maxCharacters - this.output.length);
+    }
+  }
+}
+var processEnvironment = (additional) => {
+  const env = {};
+  for (const key of PORTABLE_ENVIRONMENT_KEYS) {
+    const value = process.env[key];
+    if (value !== undefined)
+      env[key] = value;
+  }
+  for (const [key, value] of Object.entries(additional ?? {})) {
+    if (value === undefined)
+      delete env[key];
+    else
+      env[key] = value;
+  }
+  return env;
+};
+var exitCodeForSignal = (signal) => {
+  if (signal === "SIGKILL")
+    return 137;
+  if (signal === "SIGTERM")
+    return 143;
+  return 1;
+};
+var abortReason = (signal) => signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
+var runPortableProcess = async (command, options = {}) => {
+  if (command.length === 0 || !command[0])
+    throw new Error("The process command must not be empty.");
+  if (options.signal?.aborted)
+    throw abortReason(options.signal);
+  const maxOutputCharacters = options.maxOutputCharacters ?? DEFAULT_MAX_OUTPUT_CHARACTERS;
+  if (!Number.isSafeInteger(maxOutputCharacters) || maxOutputCharacters < 0) {
+    throw new Error("maxOutputCharacters must be a non-negative safe integer.");
+  }
+  if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0)) {
+    throw new Error("timeoutMs must be a positive safe integer.");
+  }
+  const argv = [...command];
+  const stdout = new BoundedTextCapture(maxOutputCharacters);
+  const stderr = new BoundedTextCapture(maxOutputCharacters);
+  const child = spawn(argv[0], argv.slice(1), {
+    ...options.cwd ? { cwd: options.cwd } : {},
+    env: processEnvironment(options.env),
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let timedOut = false;
+  let aborted = false;
+  let terminationTimer;
+  child.stdout.on("data", (chunk) => stdout.write(chunk));
+  child.stderr?.on("data", (chunk) => stderr.write(chunk));
+  const terminate = () => {
+    if (child.exitCode !== null || child.signalCode !== null)
+      return;
+    child.kill("SIGTERM");
+    terminationTimer = setTimeout(() => {
+      if (child.exitCode === null && child.signalCode === null)
+        child.kill("SIGKILL");
+    }, DEFAULT_TERMINATION_GRACE_MS);
+    terminationTimer.unref?.();
+  };
+  const handleAbort = () => {
+    aborted = true;
+    terminate();
+  };
+  options.signal?.addEventListener("abort", handleAbort, { once: true });
+  const timeout = options.timeoutMs === undefined ? undefined : setTimeout(() => {
+    timedOut = true;
+    terminate();
+  }, options.timeoutMs);
+  timeout?.unref?.();
+  try {
+    return await new Promise((resolve, reject) => {
+      let processError;
+      child.once("error", (error) => {
+        processError = error;
+      });
+      child.once("close", (exitCode, signal) => {
+        if (processError) {
+          reject(processError);
+          return;
+        }
+        if (aborted && options.signal) {
+          reject(abortReason(options.signal));
+          return;
+        }
+        resolve({
+          command: argv,
+          exitCode: exitCode ?? exitCodeForSignal(signal),
+          stdout: stdout.finish(),
+          stderr: options.stderr === "ignore" ? "" : stderr.finish(),
+          timedOut
+        });
+      });
+    });
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+    if (terminationTimer)
+      clearTimeout(terminationTimer);
+    options.signal?.removeEventListener("abort", handleAbort);
+  }
+};
+
+// src/workspace.ts
 var HARD_IGNORES = new Set([".git", ".next", ".turbo", ".zhivex-harness", "coverage", "dist", "node_modules"]);
 var IGNORE_FILES = [".gitignore", ".zhivex-harnessignore"];
 var DEFAULT_CHECKS = ["test", "typecheck", "lint", "build"];
 var MAX_FILE_BYTES = 1024 * 1024;
 var MAX_TOOL_OUTPUT = 20000;
+var MAX_READ_BATCH_FILES = 20;
+var MAX_READ_BATCH_BYTES = 2 * MAX_FILE_BYTES;
+var MAX_SEARCH_MANY_QUERIES = 10;
+var MAX_SEARCH_MANY_MATCHES = 500;
 var isSensitiveName = (name) => {
   const normalized = name.toLocaleLowerCase();
   return normalized === ".env" || normalized.startsWith(".env.") && normalized !== ".env.example" || normalized === ".npmrc" || normalized === "id_rsa" || normalized === "id_ed25519" || normalized.endsWith(".key") || normalized.endsWith(".pem") || normalized.endsWith(".p12") || normalized.endsWith(".pfx");
 };
 var isHardIgnored = (relativePath) => relativePath.split("/").some((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
 var isInside = (root, candidate) => {
-  const relative = path3.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path3.sep}`) && relative !== ".." && !path3.isAbsolute(relative);
+  const relative = path4.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path4.sep}`) && relative !== ".." && !path4.isAbsolute(relative);
 };
-var wirePath = (value) => value.split(path3.sep).join("/");
+var wirePath = (value) => value.split(path4.sep).join("/");
 var digestBytes = (value) => `sha256:${createHash4("sha256").update(value).digest("hex")}`;
 var truncate = (value, maxLength = MAX_TOOL_OUTPUT) => value.length <= maxLength ? value : `${value.slice(0, maxLength)}
-\u2026 output truncated (${value.length - maxLength} characters omitted)`;
+… output truncated (${value.length - maxLength} characters omitted)`;
 var cursorEncode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
 var cursorDecode = (value) => {
   try {
@@ -890,6 +1142,30 @@ var cursorDecode = (value) => {
     throw new Error("The pagination cursor is invalid.");
   }
 };
+var firstPathAtLeast = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") < target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
+var firstPathAfter = (files, target) => {
+  let low = 0;
+  let high = files.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if ((files[middle]?.path ?? "") <= target)
+      low = middle + 1;
+    else
+      high = middle;
+  }
+  return low;
+};
 var escapeRegex = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
 var globRegex = (pattern) => {
   let source = "";
@@ -958,34 +1234,22 @@ var isIgnoredByRules = (relativePath, isDirectory, rules) => {
   return ignored;
 };
 var spawnBounded = async (command, cwd, timeoutMs = 120000) => {
-  const allowed = ["CI", "FORCE_COLOR", "LANG", "LC_ALL", "NO_COLOR", "PATH", "TEMP", "TERM", "TMP", "TMPDIR"];
-  const env = Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
-  const child = Bun.spawn(command, { cwd, env, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
-  let timedOut = false;
-  const timeout = setTimeout(() => {
-    timedOut = true;
-    child.kill();
-  }, timeoutMs);
-  try {
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-      child.exited
-    ]);
-    return { command, exitCode, stdout: truncate(stdout), stderr: truncate(stderr), timedOut };
-  } finally {
-    clearTimeout(timeout);
-  }
+  return await runPortableProcess(command, { cwd, timeoutMs });
 };
 
 class Workspace {
   root;
   auditEntries = [];
+  indexIdentity = randomUUID();
+  indexRevision = 0;
+  workspaceIndex;
+  indexBuild;
+  indexMetrics = { builds: 0, reuses: 0, stableFileReads: 0 };
   constructor(root) {
     this.root = root;
   }
   static async open(root) {
-    const resolved = await realpath(path3.resolve(root));
+    const resolved = await realpath(path4.resolve(root));
     if (!(await stat(resolved)).isDirectory())
       throw new Error(`The workspace is not a directory: ${root}`);
     return new Workspace(resolved);
@@ -993,10 +1257,10 @@ class Workspace {
   lexicalPath(relativePath) {
     if (!relativePath || relativePath.includes("\x00"))
       throw new Error("The path must be a valid relative path.");
-    const candidate = path3.resolve(this.root, relativePath);
+    const candidate = path4.resolve(this.root, relativePath);
     if (!isInside(this.root, candidate))
       throw new Error(`The path escapes the workspace: ${relativePath}`);
-    const relative = wirePath(path3.relative(this.root, candidate));
+    const relative = wirePath(path4.relative(this.root, candidate));
     if (relative && isHardIgnored(relative)) {
       const blocked = relative.split("/").find((segment) => HARD_IGNORES.has(segment.toLocaleLowerCase()) || isSensitiveName(segment));
       throw new Error(`The path is protected by the harness policy: ${blocked}`);
@@ -1007,13 +1271,13 @@ class Workspace {
     const candidate = this.lexicalPath(relativePath);
     if (candidate === this.root && options.requireFile)
       throw new Error("The workspace root is not a regular file.");
-    const segments = path3.relative(this.root, candidate).split(path3.sep).filter(Boolean);
+    const segments = path4.relative(this.root, candidate).split(path4.sep).filter(Boolean);
     let current = this.root;
     for (let index = 0;index < segments.length; index += 1) {
-      current = path3.join(current, segments[index]);
+      current = path4.join(current, segments[index]);
       let entry;
       try {
-        entry = await lstat(current);
+        entry = await lstat2(current);
       } catch (error) {
         if (options.allowMissing && error.code === "ENOENT") {
           return { path: candidate, exists: false };
@@ -1032,33 +1296,60 @@ class Workspace {
     return { path: candidate, exists: true };
   }
   async readStableFile(relativePath, allowBinary = true) {
+    this.indexMetrics.stableFileReads += 1;
     const safe = await this.safePath(relativePath, { requireFile: true });
-    const before = await lstat(safe.path);
+    const before = await lstat2(safe.path);
     if (before.size > MAX_FILE_BYTES)
       throw new Error(`The file exceeds the ${MAX_FILE_BYTES}-byte limit.`);
     const contents = await readFile(safe.path);
-    const after = await lstat(safe.path);
+    const after = await lstat2(safe.path);
     if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
       throw new Error(`The file changed while it was being read: ${relativePath}`);
     }
     if (!allowBinary && contents.includes(0))
       throw new Error("The file appears to be binary and cannot be read as text.");
     return {
-      path: wirePath(path3.relative(this.root, safe.path)),
+      path: wirePath(path4.relative(this.root, safe.path)),
       absolutePath: safe.path,
       contents,
       digest: digestBytes(contents),
       mode: before.mode & 511
     };
   }
-  async rulesForDirectory(directory, base, inherited) {
+  fingerprint(relativePath, kind, entry, digest2) {
+    return {
+      path: relativePath || ".",
+      kind,
+      dev: entry.dev,
+      ino: entry.ino,
+      size: entry.size,
+      mtimeMs: entry.mtimeMs,
+      ctimeMs: entry.ctimeMs,
+      ...digest2 ? { digest: digest2 } : {}
+    };
+  }
+  sameFingerprint(entry, fingerprint) {
+    return entry.dev === fingerprint.dev && entry.ino === fingerprint.ino && entry.size === fingerprint.size && entry.mtimeMs === fingerprint.mtimeMs && entry.ctimeMs === fingerprint.ctimeMs;
+  }
+  async rulesForDirectory(directory, base, inherited, ignoreFiles) {
     const rules = [...inherited];
     for (const filename of IGNORE_FILES) {
       try {
-        const ignorePath = path3.join(directory, filename);
-        const entry = await lstat(ignorePath);
-        if (entry.isFile() && entry.size <= MAX_FILE_BYTES) {
-          rules.push(...parseIgnoreRules(await readFile(ignorePath, "utf8"), base));
+        const ignorePath = path4.join(directory, filename);
+        const before = await lstat2(ignorePath);
+        if (before.isSymbolicLink() || !before.isFile())
+          continue;
+        if (before.size <= MAX_FILE_BYTES) {
+          const contents = await readFile(ignorePath);
+          const after = await lstat2(ignorePath);
+          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, this.fingerprint("", "ignore-file", before))) {
+            throw new Error(`The ignore file changed while the workspace was being indexed: ${wirePath(path4.relative(this.root, ignorePath))}`);
+          }
+          const digest2 = digestBytes(contents);
+          ignoreFiles.push(this.fingerprint(wirePath(path4.relative(this.root, ignorePath)), "ignore-file", after, digest2));
+          rules.push(...parseIgnoreRules(contents.toString("utf8"), base));
+        } else {
+          ignoreFiles.push(this.fingerprint(wirePath(path4.relative(this.root, ignorePath)), "ignore-file", before));
         }
       } catch (error) {
         if (error.code !== "ENOENT")
@@ -1067,65 +1358,189 @@ class Workspace {
     }
     return rules;
   }
-  async collectFiles() {
+  async collectFiles(version) {
     const files = [];
+    const directories = [];
+    const ignoreFiles = [];
     const walk = async (directory, base, inherited) => {
-      const rules = await this.rulesForDirectory(directory, base, inherited);
+      const directoryEntry = await lstat2(directory);
+      if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
+        throw new Error(`A workspace directory changed while it was being indexed: ${base || "."}`);
+      }
+      directories.push(this.fingerprint(base, "directory", directoryEntry));
+      const rules = await this.rulesForDirectory(directory, base, inherited, ignoreFiles);
       const entries = (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
       for (const entry of entries) {
         const relative = base ? `${base}/${entry.name}` : entry.name;
         if (isHardIgnored(relative) || entry.isSymbolicLink() || isIgnoredByRules(relative, entry.isDirectory(), rules))
           continue;
-        const absolute = path3.join(directory, entry.name);
+        const absolute = path4.join(directory, entry.name);
         if (entry.isDirectory())
           await walk(absolute, relative, rules);
         else if (entry.isFile())
-          files.push({ path: relative, size: (await lstat(absolute)).size });
+          files.push({ path: relative });
       }
     };
     await walk(this.root, "", []);
-    return files;
+    files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    return { version, files, directories, ignoreFiles };
+  }
+  async isWorkspaceIndexFresh(index) {
+    try {
+      for (const fingerprint of index.directories) {
+        const absolute = fingerprint.path === "." ? this.root : path4.join(this.root, fingerprint.path);
+        const entry = await lstat2(absolute);
+        if (entry.isSymbolicLink() || !entry.isDirectory() || !this.sameFingerprint(entry, fingerprint))
+          return false;
+      }
+      for (const fingerprint of index.ignoreFiles) {
+        const absolute = path4.join(this.root, fingerprint.path);
+        const before = await lstat2(absolute);
+        if (before.isSymbolicLink() || !before.isFile() || !this.sameFingerprint(before, fingerprint))
+          return false;
+        if (fingerprint.digest) {
+          const contents = await readFile(absolute);
+          const after = await lstat2(absolute);
+          if (after.isSymbolicLink() || !after.isFile() || !this.sameFingerprint(after, fingerprint) || digestBytes(contents) !== fingerprint.digest)
+            return false;
+        }
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  invalidateWorkspaceIndex() {
+    this.indexRevision += 1;
+    this.workspaceIndex = undefined;
+  }
+  async buildWorkspaceIndex(revision) {
+    const version = `${this.indexIdentity}:${revision}`;
+    for (let attempt = 0;attempt < 3; attempt += 1) {
+      try {
+        const index = await this.collectFiles(version);
+        if (await this.isWorkspaceIndexFresh(index))
+          return index;
+      } catch (error) {
+        const code = error.code;
+        const changedDuringIndexing = error instanceof Error && error.message.includes("while the workspace was being indexed");
+        if (attempt === 2 || code !== "ENOENT" && !changedDuringIndexing)
+          throw error;
+      }
+    }
+    throw new Error("The workspace kept changing while its file index was being built.");
+  }
+  async getWorkspaceIndex() {
+    const cached = this.workspaceIndex;
+    if (cached) {
+      if (await this.isWorkspaceIndexFresh(cached)) {
+        this.indexMetrics.reuses += 1;
+        return cached;
+      }
+      this.invalidateWorkspaceIndex();
+    }
+    const revision = this.indexRevision;
+    if (!this.indexBuild || this.indexBuild.revision !== revision) {
+      const promise = this.buildWorkspaceIndex(revision);
+      this.indexBuild = { revision, promise };
+    }
+    const build = this.indexBuild;
+    let index;
+    try {
+      index = await build.promise;
+    } catch (error) {
+      if (this.indexBuild === build)
+        this.indexBuild = undefined;
+      throw error;
+    }
+    if (revision !== this.indexRevision)
+      return this.getWorkspaceIndex();
+    if (this.indexBuild === build)
+      this.indexBuild = undefined;
+    if (this.workspaceIndex?.version !== index.version) {
+      this.workspaceIndex = index;
+      this.indexMetrics.builds += 1;
+    }
+    return this.workspaceIndex;
+  }
+  workspaceIndexDiagnostics() {
+    const index = this.workspaceIndex;
+    return {
+      ...this.indexMetrics,
+      ...index ? { version: index.version } : {},
+      files: index?.files.length ?? 0,
+      directories: index?.directories.length ?? 0
+    };
   }
   async listFiles(relativePath = ".", options = {}) {
     const start = await this.safePath(relativePath);
-    if (!(await lstat(start.path)).isDirectory())
+    if (!(await lstat2(start.path)).isDirectory())
       throw new Error("list_files requires a directory.");
-    const requestPath = wirePath(path3.relative(this.root, start.path)) || ".";
+    const requestPath = wirePath(path4.relative(this.root, start.path)) || ".";
     const input = typeof options === "number" ? { limit: options } : options;
     const limit = input.limit ?? 200;
+    const includeDigests = input.includeDigests ?? true;
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 5000)
       throw new Error("limit must be between 1 and 5000.");
     let after = "";
+    let cursorIndexVersion;
     if (input.cursor) {
       const parsed = cursorDecode(input.cursor);
-      if (parsed.v !== 1 || parsed.kind !== "list" || parsed.path !== requestPath || parsed.limit !== limit || typeof parsed.after !== "string") {
+      if (parsed.v !== 2 || parsed.kind !== "list" || parsed.path !== requestPath || parsed.limit !== limit || parsed.includeDigests !== includeDigests || typeof parsed.indexVersion !== "string" || typeof parsed.after !== "string") {
         throw new Error("The pagination cursor does not match this list request.");
       }
       after = parsed.after;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const index = await this.getWorkspaceIndex();
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new Error("The pagination cursor is stale because the workspace changed.");
     }
     const prefix = requestPath === "." ? "" : `${requestPath}/`;
-    const candidates = (await this.collectFiles()).filter((file) => (requestPath === "." || file.path.startsWith(prefix)) && file.path > after);
-    const selected = candidates.slice(0, limit);
+    let candidateIndex = after ? firstPathAfter(index.files, after) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    const selected = [];
+    while (candidateIndex < index.files.length && selected.length <= limit) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
+      selected.push(candidate);
+      candidateIndex += 1;
+    }
+    const truncated = selected.length > limit;
+    if (truncated)
+      selected.pop();
     const files = [];
-    for (const candidate of selected) {
-      const file = await this.readStableFile(candidate.path);
-      files.push({ path: file.path, size: file.contents.byteLength, digest: file.digest });
+    if (includeDigests) {
+      for (const candidate of selected) {
+        const file = await this.readStableFile(candidate.path);
+        files.push({ path: file.path, size: file.contents.byteLength, digest: file.digest });
+      }
+    } else {
+      files.push(...selected.map(({ path: candidatePath }) => ({ path: candidatePath })));
     }
-    const truncated = candidates.length > selected.length;
     const last = selected.at(-1);
     return {
       files,
       truncated,
-      ...truncated && last ? { nextCursor: cursorEncode({ v: 1, kind: "list", path: requestPath, limit, after: last.path }) } : {}
+      ...truncated && last ? {
+        nextCursor: cursorEncode({
+          v: 2,
+          kind: "list",
+          path: requestPath,
+          limit,
+          includeDigests,
+          after: last.path,
+          indexVersion: index.version
+        })
+      } : {}
     };
   }
-  async readFile(relativePath, startLine = 1, endLine) {
+  renderReadFile(file, startLine = 1, endLine) {
     if (!Number.isSafeInteger(startLine) || startLine < 1)
       throw new Error("startLine must be a positive integer.");
     if (endLine !== undefined && (!Number.isSafeInteger(endLine) || endLine < startLine)) {
       throw new Error("endLine must be greater than or equal to startLine.");
     }
-    const file = await this.readStableFile(relativePath, false);
     const lines = file.contents.toString("utf8").split(/\r?\n/);
     const boundedEnd = Math.min(endLine ?? startLine + 399, startLine + 1999, lines.length);
     return {
@@ -1139,6 +1554,37 @@ class Workspace {
       truncated: boundedEnd < lines.length
     };
   }
+  async readFile(relativePath, startLine = 1, endLine) {
+    return this.renderReadFile(await this.readStableFile(relativePath, false), startLine, endLine);
+  }
+  async readFiles(requests) {
+    if (!Array.isArray(requests) || requests.length < 1 || requests.length > MAX_READ_BATCH_FILES) {
+      throw new Error(`readFiles requires between 1 and ${MAX_READ_BATCH_FILES} file requests.`);
+    }
+    const ordered = requests.map((request) => ({
+      ...request,
+      path: wirePath(path4.relative(this.root, this.lexicalPath(request.path)))
+    })).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0) || (a.startLine ?? 1) - (b.startLine ?? 1) || (a.endLine ?? 0) - (b.endLine ?? 0));
+    const stableFiles = new Map;
+    let totalBytes = 0;
+    for (const request of ordered) {
+      if (!Number.isSafeInteger(request.startLine ?? 1) || (request.startLine ?? 1) < 1 || request.endLine !== undefined && (!Number.isSafeInteger(request.endLine) || request.endLine < (request.startLine ?? 1))) {
+        throw new Error(`Invalid line range for ${request.path}.`);
+      }
+      if (stableFiles.has(request.path))
+        continue;
+      const file = await this.readStableFile(request.path, false);
+      totalBytes += file.contents.byteLength;
+      if (totalBytes > MAX_READ_BATCH_BYTES) {
+        throw new Error(`readFiles exceeds the aggregate ${MAX_READ_BATCH_BYTES}-byte source limit.`);
+      }
+      stableFiles.set(request.path, file);
+    }
+    return {
+      files: ordered.map((request) => this.renderReadFile(stableFiles.get(request.path), request.startLine ?? 1, request.endLine)),
+      sourceBytes: totalBytes
+    };
+  }
   async inspectFile(relativePath) {
     const file = await this.readStableFile(relativePath);
     return {
@@ -1152,30 +1598,38 @@ class Workspace {
     if (!query || query.length > 200)
       throw new Error("The search query must be between 1 and 200 characters.");
     const start = await this.safePath(relativePath);
-    if (!(await lstat(start.path)).isDirectory())
+    if (!(await lstat2(start.path)).isDirectory())
       throw new Error("search_files requires a directory.");
-    const requestPath = wirePath(path3.relative(this.root, start.path)) || ".";
+    const requestPath = wirePath(path4.relative(this.root, start.path)) || ".";
     const limit = options.limit ?? options.maxMatches ?? 100;
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500)
       throw new Error("limit must be between 1 and 500.");
     const caseSensitive = options.caseSensitive ?? false;
     let afterPath = "";
     let afterLine = 0;
+    let cursorIndexVersion;
     if (options.cursor) {
       const parsed = cursorDecode(options.cursor);
-      if (parsed.v !== 1 || parsed.kind !== "search" || parsed.path !== requestPath || parsed.query !== query || parsed.caseSensitive !== caseSensitive || parsed.limit !== limit || typeof parsed.afterPath !== "string" || !Number.isSafeInteger(parsed.afterLine)) {
+      if (parsed.v !== 2 || parsed.kind !== "search" || parsed.path !== requestPath || parsed.query !== query || parsed.caseSensitive !== caseSensitive || parsed.limit !== limit || typeof parsed.afterPath !== "string" || !Number.isSafeInteger(parsed.afterLine) || typeof parsed.indexVersion !== "string") {
         throw new Error("The pagination cursor does not match this search request.");
       }
       afterPath = parsed.afterPath;
       afterLine = parsed.afterLine;
+      cursorIndexVersion = parsed.indexVersion;
+    }
+    const index = await this.getWorkspaceIndex();
+    if (cursorIndexVersion && cursorIndexVersion !== index.version) {
+      throw new Error("The pagination cursor is stale because the workspace changed.");
     }
     const prefix = requestPath === "." ? "" : `${requestPath}/`;
     const needle = caseSensitive ? query : query.toLocaleLowerCase();
     const matches = [];
     let hasMore = false;
-    for (const candidate of await this.collectFiles()) {
-      if (requestPath !== "." && !candidate.path.startsWith(prefix) || candidate.size > MAX_FILE_BYTES || candidate.path < afterPath)
-        continue;
+    let candidateIndex = afterPath ? firstPathAtLeast(index.files, afterPath) : requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    for (;candidateIndex < index.files.length; candidateIndex += 1) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
       let file;
       try {
         file = await this.readStableFile(candidate.path, false);
@@ -1183,11 +1637,11 @@ class Workspace {
         continue;
       }
       const lines = file.contents.toString("utf8").split(/\r?\n/);
-      for (let index = 0;index < lines.length; index += 1) {
-        const lineNumber = index + 1;
+      for (let index2 = 0;index2 < lines.length; index2 += 1) {
+        const lineNumber = index2 + 1;
         if (candidate.path === afterPath && lineNumber <= afterLine)
           continue;
-        const line = lines[index] ?? "";
+        const line = lines[index2] ?? "";
         if (!(caseSensitive ? line : line.toLocaleLowerCase()).includes(needle))
           continue;
         if (matches.length >= limit) {
@@ -1204,10 +1658,88 @@ class Workspace {
       matches,
       truncated: hasMore,
       ...hasMore && last ? {
-        nextCursor: cursorEncode({ v: 1, kind: "search", path: requestPath, query, caseSensitive, limit, afterPath: last.path, afterLine: last.line })
+        nextCursor: cursorEncode({
+          v: 2,
+          kind: "search",
+          path: requestPath,
+          query,
+          caseSensitive,
+          limit,
+          afterPath: last.path,
+          afterLine: last.line,
+          indexVersion: index.version
+        })
       } : {}
     };
   }
+  async searchMany(queries, relativePath = ".", options = {}) {
+    if (!Array.isArray(queries) || queries.length < 1 || queries.length > MAX_SEARCH_MANY_QUERIES) {
+      throw new Error(`searchMany requires between 1 and ${MAX_SEARCH_MANY_QUERIES} queries.`);
+    }
+    const limitPerQuery = options.limitPerQuery ?? 50;
+    if (!Number.isSafeInteger(limitPerQuery) || limitPerQuery < 1 || limitPerQuery > MAX_SEARCH_MANY_MATCHES || limitPerQuery * queries.length > MAX_SEARCH_MANY_MATCHES) {
+      throw new Error(`searchMany allows at most ${MAX_SEARCH_MANY_MATCHES} aggregate matches.`);
+    }
+    const seen = new Set;
+    const states = queries.map((input) => {
+      if (!input.query || input.query.length > 200)
+        throw new Error("Each search query must be between 1 and 200 characters.");
+      const caseSensitive = input.caseSensitive ?? false;
+      const key = `${caseSensitive ? "1" : "0"}\x00${input.query}`;
+      if (seen.has(key))
+        throw new Error("searchMany queries must be unique.");
+      seen.add(key);
+      return {
+        query: input.query,
+        caseSensitive,
+        needle: caseSensitive ? input.query : input.query.toLocaleLowerCase(),
+        matches: [],
+        truncated: false
+      };
+    });
+    const start = await this.safePath(relativePath);
+    if (!(await lstat2(start.path)).isDirectory())
+      throw new Error("searchMany requires a directory.");
+    const requestPath = wirePath(path4.relative(this.root, start.path)) || ".";
+    const prefix = requestPath === "." ? "" : `${requestPath}/`;
+    const index = await this.getWorkspaceIndex();
+    let candidateIndex = requestPath === "." ? 0 : firstPathAtLeast(index.files, prefix);
+    for (;candidateIndex < index.files.length; candidateIndex += 1) {
+      const candidate = index.files[candidateIndex];
+      if (!candidate || requestPath !== "." && !candidate.path.startsWith(prefix))
+        break;
+      let file;
+      try {
+        file = await this.readStableFile(candidate.path, false);
+      } catch {
+        continue;
+      }
+      const lines = file.contents.toString("utf8").split(/\r?\n/);
+      for (let lineIndex = 0;lineIndex < lines.length; lineIndex += 1) {
+        const line = lines[lineIndex] ?? "";
+        const foldedLine = line.toLocaleLowerCase();
+        for (const state of states) {
+          if (state.truncated || !(state.caseSensitive ? line : foldedLine).includes(state.needle))
+            continue;
+          if (state.matches.length >= limitPerQuery) {
+            state.truncated = true;
+            continue;
+          }
+          state.matches.push({
+            path: candidate.path,
+            line: lineIndex + 1,
+            text: truncate(line, 500),
+            digest: file.digest
+          });
+        }
+      }
+      if (states.every((state) => state.truncated))
+        break;
+    }
+    return {
+      results: states.map(({ needle: _needle, ...state }) => state)
+    };
+  }
   audit(entry) {
     const record = { id: randomUUID(), timestamp: new Date().toISOString(), ...entry };
     this.auditEntries.push(record);
@@ -1217,16 +1749,16 @@ class Workspace {
     return this.auditEntries.map((entry) => ({ ...entry }));
   }
   async secureWorkspaceDirectory(directory, mode = 493) {
-    const resolvedInput = path3.resolve(directory);
+    const resolvedInput = path4.resolve(directory);
     if (!isInside(this.root, resolvedInput)) {
       throw new Error("A mutation directory escapes the workspace.");
     }
-    const segments = path3.relative(this.root, resolvedInput).split(path3.sep).filter(Boolean);
+    const segments = path4.relative(this.root, resolvedInput).split(path4.sep).filter(Boolean);
     let current = this.root;
     for (const segment of segments) {
-      current = path3.join(current, segment);
+      current = path4.join(current, segment);
       try {
-        const entry = await lstat(current);
+        const entry = await lstat2(current);
         if (entry.isSymbolicLink())
           throw new Error("A mutation directory must not contain a symbolic link.");
         if (!entry.isDirectory())
@@ -1239,7 +1771,7 @@ class Workspace {
         } catch (mkdirError) {
           if (mkdirError.code !== "EEXIST")
             throw mkdirError;
-          const raced = await lstat(current);
+          const raced = await lstat2(current);
           if (raced.isSymbolicLink() || !raced.isDirectory()) {
             throw new Error("A mutation directory changed during creation.");
           }
@@ -1252,8 +1784,8 @@ class Workspace {
     return canonical;
   }
   async stageFile(target, contents, mode) {
-    const directory = await this.secureWorkspaceDirectory(path3.dirname(target));
-    const temporary = path3.join(directory, `.${path3.basename(target)}.zhivex-${randomUUID()}.tmp`);
+    const directory = await this.secureWorkspaceDirectory(path4.dirname(target));
+    const temporary = path4.join(directory, `.${path4.basename(target)}.zhivex-${randomUUID()}.tmp`);
     const handle = await open(temporary, "wx", mode);
     try {
       await handle.writeFile(contents);
@@ -1371,6 +1903,7 @@ class Workspace {
         throw new AggregateError([error, ...rollbackErrors], "Patch failed and rollback was incomplete.");
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const changes = prepared.map((item) => this.audit({
       operation: item.before ? "update" : "create",
       path: item.change.path,
@@ -1411,7 +1944,7 @@ class Workspace {
     const destination = await this.safePath(parsed.destination, { allowMissing: true });
     if (destination.exists)
       throw new Error(`Move destination already exists: ${parsed.destination}.`);
-    await this.secureWorkspaceDirectory(path3.dirname(destination.path));
+    await this.secureWorkspaceDirectory(path4.dirname(destination.path));
     const destinationRecheck = await this.safePath(parsed.destination, { allowMissing: true });
     if (destinationRecheck.exists)
       throw new Error(`Move destination already exists: ${parsed.destination}.`);
@@ -1431,6 +1964,7 @@ class Workspace {
         await unlink(destination.path).catch(() => {});
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "move", path: parsed.source, destination: parsed.destination, beforeDigest: source.digest, afterDigest: source.digest });
     return { source: parsed.source, destination: parsed.destination, digest: source.digest, audit };
   }
@@ -1438,9 +1972,9 @@ class Workspace {
     const segments = [".zhivex-harness", "quarantine"];
     let current = this.root;
     for (const segment of segments) {
-      current = path3.join(current, segment);
+      current = path4.join(current, segment);
       try {
-        const entry = await lstat(current);
+        const entry = await lstat2(current);
         if (entry.isSymbolicLink()) {
           throw new Error("Harness quarantine must not resolve through a symbolic link.");
         }
@@ -1455,7 +1989,7 @@ class Workspace {
         } catch (mkdirError) {
           if (mkdirError.code !== "EEXIST")
             throw mkdirError;
-          const racedEntry = await lstat(current);
+          const racedEntry = await lstat2(current);
           if (racedEntry.isSymbolicLink() || !racedEntry.isDirectory()) {
             throw new Error("Harness quarantine path changed during creation.");
           }
@@ -1469,19 +2003,19 @@ class Workspace {
   }
   async writeManifest(manifest) {
     const directory = await this.secureQuarantineDirectory(true);
-    const target = path3.join(directory, `${manifest.quarantineId}.json`);
+    const target = path4.join(directory, `${manifest.quarantineId}.json`);
     const temporary = await this.stageFile(target, `${JSON.stringify(manifest, null, 2)}
 `, 384);
     await rename(temporary, target);
   }
   async readInternalRegularFile(target, label, maxBytes) {
-    const before = await lstat(target);
+    const before = await lstat2(target);
     if (before.isSymbolicLink() || !before.isFile())
       throw new Error(`${label} must be a regular non-symlink file.`);
     if (before.size > maxBytes)
       throw new Error(`${label} exceeds its size limit.`);
     const contents = await readFile(target);
-    const after = await lstat(target);
+    const after = await lstat2(target);
     if (after.isSymbolicLink() || !after.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
       throw new Error(`${label} changed while it was being read.`);
     }
@@ -1494,7 +2028,7 @@ class Workspace {
       throw new Error(`Stale quarantine rejected for ${parsed.path}.`);
     const quarantineId = `${Date.now()}-${randomUUID()}`;
     const directory = await this.secureQuarantineDirectory(true);
-    const dataPath = path3.join(directory, `${quarantineId}.data`);
+    const dataPath = path4.join(directory, `${quarantineId}.data`);
     if ((await this.readStableFile(parsed.path)).digest !== parsed.expectedDigest)
       throw new Error(`Stale quarantine rejected for ${parsed.path}.`);
     await link(source.absolutePath, dataPath);
@@ -1516,9 +2050,10 @@ class Workspace {
       await unlink(source.absolutePath);
     } catch (error) {
       await unlink(dataPath).catch(() => {});
-      await unlink(path3.join(directory, `${quarantineId}.json`)).catch(() => {});
+      await unlink(path4.join(directory, `${quarantineId}.json`)).catch(() => {});
       throw error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "quarantine", path: parsed.path, beforeDigest: source.digest, quarantineId });
     return { quarantineId, path: parsed.path, digest: source.digest, audit };
   }
@@ -1527,7 +2062,7 @@ class Workspace {
     const directory = await this.secureQuarantineDirectory(false);
     let manifest;
     try {
-      const manifestFile = await this.readInternalRegularFile(path3.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
+      const manifestFile = await this.readInternalRegularFile(path4.join(directory, `${parsed.quarantineId}.json`), "Quarantine manifest", 64 * 1024);
       manifest = JSON.parse(manifestFile.contents.toString("utf8"));
     } catch {
       throw new Error(`Quarantine entry was not found: ${parsed.quarantineId}.`);
@@ -1535,7 +2070,7 @@ class Workspace {
     if (manifest.schemaVersion !== 1 || manifest.quarantineId !== parsed.quarantineId || manifest.status !== "quarantined") {
       throw new Error(`Quarantine entry is not restorable: ${parsed.quarantineId}.`);
     }
-    const dataPath = path3.join(directory, `${parsed.quarantineId}.data`);
+    const dataPath = path4.join(directory, `${parsed.quarantineId}.data`);
     const dataFile = await this.readInternalRegularFile(dataPath, "Quarantine payload", MAX_FILE_BYTES);
     const digest2 = digestBytes(dataFile.contents);
     if (digest2 !== manifest.digest || parsed.expectedDigest && parsed.expectedDigest !== digest2) {
@@ -1545,16 +2080,16 @@ class Workspace {
     const destination = await this.safePath(destinationPath, { allowMissing: true });
     if (destination.exists)
       throw new Error(`Restore destination already exists: ${destinationPath}.`);
-    await this.secureWorkspaceDirectory(path3.dirname(destination.path));
+    await this.secureWorkspaceDirectory(path4.dirname(destination.path));
     const destinationRecheck = await this.safePath(destinationPath, { allowMissing: true });
     if (destinationRecheck.exists)
       throw new Error(`Restore destination already exists: ${destinationPath}.`);
-    const dataRecheck = await lstat(dataPath);
+    const dataRecheck = await lstat2(dataPath);
     if (dataRecheck.isSymbolicLink() || !dataRecheck.isFile() || dataRecheck.dev !== dataFile.stat.dev || dataRecheck.ino !== dataFile.stat.ino || dataRecheck.size !== dataFile.stat.size || dataRecheck.mtimeMs !== dataFile.stat.mtimeMs) {
       throw new Error("Quarantine payload changed before restore commit.");
     }
     await link(dataPath, destination.path);
-    const linkedDestination = await lstat(destination.path);
+    const linkedDestination = await lstat2(destination.path);
     if (linkedDestination.isSymbolicLink() || !linkedDestination.isFile() || linkedDestination.dev !== dataFile.stat.dev || linkedDestination.ino !== dataFile.stat.ino || digestBytes(await readFile(destination.path)) !== digest2) {
       await unlink(destination.path).catch(() => {});
       throw new Error("Restore destination did not match the quarantined payload.");
@@ -1587,27 +2122,25 @@ class Workspace {
       }
       throw rollbackErrors.length ? new AggregateError([error, ...rollbackErrors], "Restore failed and rollback was incomplete.") : error;
     }
+    this.invalidateWorkspaceIndex();
     const audit = this.audit({ operation: "restore", path: destinationPath, afterDigest: digest2, quarantineId: parsed.quarantineId });
     return { quarantineId: parsed.quarantineId, path: destinationPath, digest: digest2, audit };
   }
   async runCheck(check, expectedScript, allowedChecks = DEFAULT_CHECKS) {
-    if (!/^[A-Za-z0-9:_-]+$/.test(check) || !allowedChecks.includes(check)) {
-      throw new Error(`The check "${check}" is not in the explicit allowlist.`);
-    }
-    let scripts = {};
+    let manifest;
     try {
-      const packageJson = JSON.parse((await this.readStableFile("package.json", false)).contents.toString("utf8"));
-      scripts = packageJson.scripts ?? {};
+      manifest = JSON.parse((await this.readStableFile("package.json", false)).contents.toString("utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         throw new Error("The workspace does not contain a package.json file.");
       throw error;
     }
-    if (!scripts[check])
-      throw new Error(`package.json does not define the "${check}" script.`);
-    if (scripts[check] !== expectedScript)
-      throw new Error(`The "${check}" script changed or does not match expectedScript.`);
-    return spawnBounded(["bun", "--no-env-file", "run", check], this.root);
+    const resolved = await resolvePackageCheckCommand(this.root, manifest, check, expectedScript, allowedChecks);
+    try {
+      return await spawnBounded(resolved.command, this.root);
+    } finally {
+      this.invalidateWorkspaceIndex();
+    }
   }
   async gitDiff() {
     const [statusResult, diffResult, stagedResult] = await Promise.all([
@@ -1620,8 +2153,8 @@ class Workspace {
 }
 
 // src/operations.ts
-import { chmod, lstat as lstat3, mkdir as mkdir2, open as open2 } from "fs/promises";
-import path5 from "path";
+import { chmod, lstat as lstat4, mkdir as mkdir2, open as open2 } from "node:fs/promises";
+import path6 from "node:path";
 import {
   cancelAgentRun,
   cancelAgentRunTree,
@@ -1638,29 +2171,95 @@ import {
   createSqliteAgentRunStore
 } from "@zhivex-ai/agents/ops";
 import { createAgentRunLedger } from "@zhivex-ai/agents/control-plane";
-import { Database } from "bun:sqlite";
+
+// src/sqlite-database.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+var DatabaseSyncConstructor;
+var loadDatabaseSync = () => {
+  DatabaseSyncConstructor ??= require2("node:sqlite").DatabaseSync;
+  return DatabaseSyncConstructor;
+};
+var normalizeNumberedParameters = (sql) => {
+  const indexes = new Set;
+  const normalizedSql = sql.replace(/\?([1-9]\d*)/g, (_match, rawIndex) => {
+    const index = Number(rawIndex);
+    indexes.add(index);
+    return `$__zhivex_${index}`;
+  });
+  return {
+    sql: normalizedSql,
+    indexes: [...indexes].sort((left, right) => left - right)
+  };
+};
+var numberedBindings = (indexes, parameters) => {
+  if (indexes.length === 0)
+    return;
+  const maximumIndex = indexes.at(-1);
+  if (parameters.length !== maximumIndex) {
+    throw new Error(`SQLite numbered parameters require exactly ${maximumIndex} binding${maximumIndex === 1 ? "" : "s"}; received ${parameters.length}.`);
+  }
+  return Object.fromEntries(indexes.map((index) => [`$__zhivex_${index}`, parameters[index - 1]]));
+};
+
+class SqliteDatabase {
+  #database;
+  constructor(databasePath, options = {}) {
+    options.create;
+    options.strict;
+    const DatabaseSync = loadDatabaseSync();
+    this.#database = new DatabaseSync(databasePath, {
+      ...options.readonly === undefined ? {} : { readOnly: options.readonly }
+    });
+  }
+  exec(sql) {
+    this.#database.exec(sql);
+  }
+  query(sql) {
+    const normalized = normalizeNumberedParameters(sql);
+    const statement = this.#database.prepare(normalized.sql);
+    const invoke = (method, parameters) => {
+      const bindings = numberedBindings(normalized.indexes, parameters);
+      return bindings ? method(bindings) : method(...parameters);
+    };
+    return {
+      run: (...parameters) => invoke(statement.run.bind(statement), parameters),
+      get: (...parameters) => invoke(statement.get.bind(statement), parameters),
+      all: (...parameters) => invoke(statement.all.bind(statement), parameters)
+    };
+  }
+  close(throwOnError = true) {
+    try {
+      this.#database.close();
+    } catch (error) {
+      if (throwOnError) {
+        throw error;
+      }
+    }
+  }
+}
 
 // src/state-directory.ts
-import { lstat as lstat2 } from "fs/promises";
-import path4 from "path";
+import { lstat as lstat3 } from "node:fs/promises";
+import path5 from "node:path";
 var SENSITIVE_STATE_SEGMENTS = new Set([".git", ".env", ".npmrc", "dist", "node_modules", "src"]);
 var isInside2 = (root, candidate) => {
-  const relative = path4.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path4.sep}`) && relative !== ".." && !path4.isAbsolute(relative);
+  const relative = path5.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative);
 };
 var validateStateDirectory = async (workspace, stateDirectory) => {
-  if (stateDirectory === workspace || stateDirectory === path4.parse(stateDirectory).root) {
+  if (stateDirectory === workspace || stateDirectory === path5.parse(stateDirectory).root) {
     throw new Error("The state directory cannot be the workspace or filesystem root.");
   }
   const insideWorkspace = isInside2(workspace, stateDirectory);
-  const relativeSegments = insideWorkspace ? path4.relative(workspace, stateDirectory).split(path4.sep).filter(Boolean) : stateDirectory.slice(path4.parse(stateDirectory).root.length).split(path4.sep).filter(Boolean);
+  const relativeSegments = insideWorkspace ? path5.relative(workspace, stateDirectory).split(path5.sep).filter(Boolean) : stateDirectory.slice(path5.parse(stateDirectory).root.length).split(path5.sep).filter(Boolean);
   const sensitiveSegment = insideWorkspace ? relativeSegments.find((segment) => SENSITIVE_STATE_SEGMENTS.has(segment)) : undefined;
   if (sensitiveSegment) {
     throw new Error(`The state directory is inside the protected workspace path: ${sensitiveSegment}.`);
   }
   if (!insideWorkspace) {
     try {
-      const externalEntry = await lstat2(stateDirectory);
+      const externalEntry = await lstat3(stateDirectory);
       if (externalEntry.isSymbolicLink()) {
         throw new Error(`The state directory must not be a symbolic link: ${stateDirectory}.`);
       }
@@ -1676,9 +2275,9 @@ var validateStateDirectory = async (workspace, stateDirectory) => {
   }
   let current = workspace;
   for (const segment of relativeSegments) {
-    current = path4.join(current, segment);
+    current = path5.join(current, segment);
     try {
-      const entry = await lstat2(current);
+      const entry = await lstat3(current);
       if (entry.isSymbolicLink()) {
         throw new Error(`The state directory must not resolve through a symbolic link: ${current}.`);
       }
@@ -1865,7 +2464,7 @@ var sqliteAdapter = (database) => ({
 });
 var ensurePrivateStateDirectory = async (directory) => {
   await mkdir2(directory, { recursive: true, mode: 448 });
-  const entry = await lstat3(directory);
+  const entry = await lstat4(directory);
   if (entry.isSymbolicLink() || !entry.isDirectory()) {
     throw new Error(`The state directory must be a real directory: ${directory}.`);
   }
@@ -1921,17 +2520,17 @@ var openHarnessPersistence = async (config, options = {}) => {
       backend: "file",
       store,
       memory: createFileAgentMemoryStore({
-        directory: path5.join(config.stateDirectory, "memory"),
+        directory: path6.join(config.stateDirectory, "memory"),
         scope: config.scope
       }),
       migration,
       close() {}
     };
   }
-  const databasePath = path5.join(config.stateDirectory, HARNESS_SQLITE_FILE);
+  const databasePath = path6.join(config.stateDirectory, HARNESS_SQLITE_FILE);
   let databaseEntry;
   try {
-    databaseEntry = await lstat3(databasePath);
+    databaseEntry = await lstat4(databasePath);
   } catch (error) {
     if (error.code !== "ENOENT") {
       throw error;
@@ -1944,12 +2543,12 @@ var openHarnessPersistence = async (config, options = {}) => {
         throw creationError;
       }
     }
-    databaseEntry = await lstat3(databasePath);
+    databaseEntry = await lstat4(databasePath);
   }
   if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
     throw new Error(`The SQLite state path must be a real file: ${databasePath}.`);
   }
-  const database = new Database(databasePath, { create: false, strict: true });
+  const database = new SqliteDatabase(databasePath, { create: false, strict: true });
   let closed = false;
   const closeDatabase = () => {
     if (!closed) {
@@ -1958,7 +2557,7 @@ var openHarnessPersistence = async (config, options = {}) => {
     }
   };
   try {
-    const openedEntry = await lstat3(databasePath);
+    const openedEntry = await lstat4(databasePath);
     if (openedEntry.isSymbolicLink() || !openedEntry.isFile() || openedEntry.dev !== databaseEntry.dev || openedEntry.ino !== databaseEntry.ino) {
       throw new Error(`The SQLite state path changed while it was being opened: ${databasePath}.`);
     }
@@ -1985,8 +2584,8 @@ var openHarnessPersistence = async (config, options = {}) => {
 };
 
 // src/mcp.ts
-import { lstat as lstat4, readFile as readFile2, realpath as realpath2 } from "fs/promises";
-import path6 from "path";
+import { lstat as lstat5, readFile as readFile2, realpath as realpath2 } from "node:fs/promises";
+import path7 from "node:path";
 import {
   createMcpToolSet,
   serializeJsonValue
@@ -1994,15 +2593,19 @@ import {
 import { z as z2 } from "zod";
 
 // src/version.ts
-import { createRequire } from "module";
-var packageMetadata = createRequire(import.meta.url)("../package.json");
+import { createRequire as createRequire2 } from "node:module";
+var packageMetadata = createRequire2(import.meta.url)("../package.json");
 if (typeof packageMetadata.version !== "string" || packageMetadata.version.length === 0) {
   throw new Error("package.json must contain a non-empty version.");
 }
+if (typeof packageMetadata.engines?.node !== "string" || packageMetadata.engines.node.length === 0) {
+  throw new Error("package.json must contain a non-empty engines.node requirement.");
+}
 if (typeof packageMetadata.engines?.bun !== "string" || packageMetadata.engines.bun.length === 0) {
   throw new Error("package.json must contain a non-empty engines.bun requirement.");
 }
 var HARNESS_VERSION = packageMetadata.version;
+var NODE_ENGINE_RANGE = packageMetadata.engines.node;
 var BUN_ENGINE_RANGE = packageMetadata.engines.bun;
 
 // src/mcp.ts
@@ -2036,8 +2639,8 @@ var configurationSchema = z2.object({
   servers: z2.array(serverSchema).max(20)
 }).strict();
 var isInsidePath = (root, candidate) => {
-  const relative = path6.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
+  const relative = path7.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
 };
 var validatedHttpUrl = (value, serverName) => {
   let url;
@@ -2121,7 +2724,7 @@ var normalizeHarnessMcpConfiguration = (value) => {
   return { schemaVersion: HARNESS_MCP_CONFIG_SCHEMA_VERSION, servers };
 };
 var loadHarnessMcpConfiguration = async (workspace, configPath) => {
-  const entry = await lstat4(configPath);
+  const entry = await lstat5(configPath);
   if (entry.isSymbolicLink() || !entry.isFile()) {
     throw new Error(`MCP configuration must be a regular non-symlink file: ${configPath}.`);
   }
@@ -2376,7 +2979,7 @@ var createHarnessMcpTools = async (configuration, options = {}) => {
 var mcpConfigurationFingerprintInput = (configuration) => serializeJsonValue(configuration);
 
 // src/orchestration.ts
-import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 import {
   applySafetyPolicyToAgent,
   createBudgetGuard,
@@ -2389,7 +2992,7 @@ var HARNESS_SUBAGENT_PROFILE_DESCRIPTORS = [
     toolName: "delegate_explorer",
     description: "Delegate bounded repository discovery to a read-only explorer.",
     instructions: "Inspect the repository with read-only tools. Return evidence with paths and concrete findings. Never propose or perform mutations.",
-    toolNames: ["list_files", "read_file", "search_files", "git_diff"]
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "git_diff"]
   },
   {
     id: "implementer",
@@ -2401,16 +3004,16 @@ var HARNESS_SUBAGENT_PROFILE_DESCRIPTORS = [
   {
     id: "tester",
     toolName: "delegate_tester",
-    description: "Delegate focused verification to a tester with read-only inspection and approved Bun checks.",
-    instructions: "Verify the delegated behavior with repository evidence and declared Bun checks. Do not edit files. Report exact failures and limits.",
-    toolNames: ["list_files", "read_file", "search_files", "run_check", "git_diff"]
+    description: "Delegate focused verification to a tester with read-only inspection and approved package-manager checks.",
+    instructions: "Verify the delegated behavior with repository evidence and declared package-manager checks. Do not edit files. Report exact failures and limits.",
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "run_check", "git_diff"]
   },
   {
     id: "reviewer",
     toolName: "delegate_reviewer",
     description: "Delegate an independent read-only review of correctness, safety, and regressions.",
     instructions: "Review the requested scope independently. Inspect concrete code and diffs, prioritize actionable defects, and do not mutate the workspace.",
-    toolNames: ["list_files", "read_file", "search_files", "mutation_audit", "git_diff"]
+    toolNames: ["list_files", "read_file", "read_files", "search_files", "search_many", "mutation_audit", "git_diff"]
   }
 ];
 var pickTools = (tools, names) => {
@@ -2547,10 +3150,13 @@ var runHarnessReviewGroup = async (runtime, input, profiles = ["explorer", "revi
 };
 
 // src/execution-environment.ts
-import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
 import {
   chmod as chmod2,
-  lstat as lstat5,
+  copyFile,
+  lstat as lstat6,
   mkdir as mkdir3,
   readFile as readFile3,
   readdir as readdir2,
@@ -2558,12 +3164,13 @@ import {
   rename as rename2,
   rm,
   writeFile
-} from "fs/promises";
-import path7 from "path";
+} from "node:fs/promises";
+import path8 from "node:path";
 import { createAgentExecutionEnvironmentBinding } from "@zhivex-ai/agents/beta";
 var HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION = 1;
 var HARNESS_OCI_LABEL = "com.zhivex.harness.execution";
 var HARNESS_OCI_LABEL_VALUE = "v1";
+var HARNESS_OCI_OWNER_PID_LABEL = "com.zhivex.harness.owner-pid";
 var TERMINAL_STATUSES = new Set([
   "completed",
   "failed",
@@ -2573,9 +3180,12 @@ var TERMINAL_STATUSES = new Set([
 var BUILT_IN_TOOL_NAMES = new Set([
   "list_files",
   "read_file",
+  "read_files",
   "search_files",
+  "search_many",
   "propose_edits",
   "apply_patch",
+  "apply_reviewed_edits",
   "move_file",
   "quarantine_file",
   "restore_file",
@@ -2583,19 +3193,22 @@ var BUILT_IN_TOOL_NAMES = new Set([
   "mutation_audit",
   "git_diff",
   "run_environment_command",
+  "run_environment_batch",
   "inspect_environment_patch",
   "apply_environment_patch",
+  "verify_and_apply_environment_patch",
+  "verify_and_apply_reviewed_edits",
   "environment_status"
 ]);
 var digest2 = (value) => `sha256:${createHash6("sha256").update(value).digest("hex")}`;
 var runHash = (runId) => createHash6("sha256").update(runId).digest("hex").slice(0, 24);
 var isInside3 = (root, candidate) => {
-  const relative = path7.relative(root, candidate);
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
+  const relative = path8.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative);
 };
 var privateDirectory = async (directory) => {
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const entry = await lstat5(directory);
+  const entry = await lstat6(directory);
   if (entry.isSymbolicLink() || !entry.isDirectory()) {
     throw new Error(`Execution artifact directory must be a real directory: ${directory}.`);
   }
@@ -2608,14 +3221,19 @@ var atomicJson = async (target, value) => {
   await rename2(temporary, target);
 };
 var commandDisplay = (command) => command.map((value) => /^[A-Za-z0-9_./:=+-]+$/.test(value) ? value : JSON.stringify(value)).join(" ");
+var elapsedMilliseconds = (startedAt) => Number(process.hrtime.bigint() - startedAt) / 1e6;
 var spawnBounded2 = async (command, options) => {
-  const child = Bun.spawn(command, {
+  const child = spawn2(command[0], command.slice(1), {
     ...options.cwd ? { cwd: options.cwd } : {},
     env: options.env ?? {},
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
+    stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"]
   });
+  if (options.input !== undefined) {
+    child.stdin?.on("error", () => {
+      return;
+    });
+    child.stdin?.end(options.input);
+  }
   let timedOut = false;
   let cancelled = false;
   let outputLimitExceeded = false;
@@ -2643,22 +3261,19 @@ var spawnBounded2 = async (command, options) => {
     options.abortSignal?.addEventListener("abort", onAbort, { once: true });
   }
   const consume = async (stream) => {
-    const reader = stream.getReader();
     const chunks = [];
     let omittedBytes = 0;
-    for (;; ) {
-      const next = await reader.read();
-      if (next.done)
-        break;
-      totalOutputBytes += next.value.byteLength;
+    for await (const value of stream) {
+      const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+      totalOutputBytes += chunk.byteLength;
       if (retainedOutputBytes < options.maxOutputBytes) {
         const remaining = options.maxOutputBytes - retainedOutputBytes;
-        const kept = next.value.byteLength <= remaining ? next.value : next.value.slice(0, remaining);
+        const kept = chunk.byteLength <= remaining ? chunk : chunk.subarray(0, remaining);
         chunks.push(kept);
         retainedOutputBytes += kept.byteLength;
-        omittedBytes += next.value.byteLength - kept.byteLength;
+        omittedBytes += chunk.byteLength - kept.byteLength;
       } else {
-        omittedBytes += next.value.byteLength;
+        omittedBytes += chunk.byteLength;
       }
       if (totalOutputBytes > options.maxOutputBytes) {
         outputLimitExceeded = true;
@@ -2667,13 +3282,17 @@ var spawnBounded2 = async (command, options) => {
     }
     const text = new TextDecoder().decode(Buffer.concat(chunks));
     return omittedBytes > 0 ? `${text}
-\u2026 output limit exceeded (${omittedBytes} bytes omitted)` : text;
+… output limit exceeded (${omittedBytes} bytes omitted)` : text;
   };
+  const exited = new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (exitCode) => resolve(exitCode ?? 137));
+  });
   try {
     const [stdout, stderr, exitCode] = await Promise.all([
       consume(child.stdout),
       consume(child.stderr),
-      child.exited
+      exited
     ]);
     return {
       command,
@@ -2697,14 +3316,39 @@ var parseRuntimeVersion = (stdout, runtime) => {
 };
 var validContainerIds = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^[a-f0-9]{12,64}$/.test(value));
 var validVolumeNames = (stdout) => stdout.split(/\r?\n/).map((value) => value.trim()).filter((value) => /^zhivex-harness-[A-Za-z0-9_.-]+$/.test(value));
+var hostProcessIsAlive = (pid) => {
+  if (!Number.isSafeInteger(pid) || pid < 1)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
 var MAX_SYNC_ENTRIES = 1e4;
+var updateSnapshotMetadata = (target, kind, relative, entry) => {
+  target.update([
+    kind,
+    relative,
+    entry.dev,
+    entry.ino,
+    entry.size,
+    entry.mtimeMs,
+    entry.ctimeMs,
+    entry.mode & 511
+  ].join("\x00"));
+  target.update("\x00");
+};
 var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspaceBytes, maxFileWriteBytes) => {
   let entries = 0;
   let totalBytes = 0;
+  const seal = createHash6("sha256");
+  const metadata = createHash6("sha256");
   const visit = async (directory, relativeDirectory = "") => {
-    for (const name of await readdir2(directory)) {
+    for (const name of (await readdir2(directory)).sort()) {
       const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
-      const absolute = path7.join(directory, name);
+      const absolute = path8.join(directory, name);
       if (!isInside3(stagedRoot, absolute) || relative.length > 1024) {
         throw new Error(`OCI workspace export contains an invalid path: ${relative}.`);
       }
@@ -2716,27 +3360,37 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
         await rm(absolute, { recursive: true, force: true });
         continue;
       }
-      const entry = await lstat5(absolute);
+      const entry = await lstat6(absolute);
       if (entry.isSymbolicLink()) {
         throw new Error(`OCI workspace export contains a symbolic link: ${relative}.`);
       }
       if (entry.isDirectory()) {
+        updateSnapshotMetadata(metadata, "directory", relative, entry);
+        seal.update(`directory\x00${relative}\x00${entry.mode & 511}\x00`);
         await visit(absolute, relative);
         continue;
       }
       if (!entry.isFile() || entry.nlink !== 1) {
         throw new Error(`OCI workspace export contains a special or linked file: ${relative}.`);
       }
+      const contents = await readFile3(absolute);
+      const after = await lstat6(absolute);
+      if (after.isSymbolicLink() || !after.isFile() || after.nlink !== 1 || entry.dev !== after.dev || entry.ino !== after.ino || entry.size !== after.size || entry.mtimeMs !== after.mtimeMs || entry.ctimeMs !== after.ctimeMs || (entry.mode & 511) !== (after.mode & 511)) {
+        throw new Error(`OCI workspace export changed while it was being validated: ${relative}.`);
+      }
       totalBytes += entry.size;
       if (totalBytes > maxWorkspaceBytes) {
         throw new Error(`OCI workspace export exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
       }
+      const contentDigest = digest2(contents);
+      updateSnapshotMetadata(metadata, "file", relative, after);
+      seal.update(`file\x00${relative}\x00${entry.mode & 511}\x00${entry.size}\x00${contentDigest}\x00`);
       if (entry.size > maxFileWriteBytes) {
-        const previous = path7.join(previousRoot, ...relative.split("/"));
+        const previous = path8.join(previousRoot, ...relative.split("/"));
         let unchanged = false;
         try {
-          const previousEntry = await lstat5(previous);
-          unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile3(previous)) === digest2(await readFile3(absolute));
+          const previousEntry = await lstat6(previous);
+          unchanged = previousEntry.isFile() && !previousEntry.isSymbolicLink() && previousEntry.size === entry.size && digest2(await readFile3(previous)) === contentDigest;
         } catch (error) {
           if (error.code !== "ENOENT")
             throw error;
@@ -2748,6 +3402,51 @@ var validateSynchronizedSnapshot = async (stagedRoot, previousRoot, maxWorkspace
     }
   };
   await visit(stagedRoot);
+  return {
+    entries,
+    totalBytes,
+    seal: `sha256:${seal.digest("hex")}`,
+    metadataFingerprint: `sha256:${metadata.digest("hex")}`
+  };
+};
+var snapshotMetadataFingerprint = async (root, maxWorkspaceBytes) => {
+  let entries = 0;
+  let totalBytes = 0;
+  const metadata = createHash6("sha256");
+  const visit = async (directory, relativeDirectory = "") => {
+    for (const name of (await readdir2(directory)).sort()) {
+      const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+      if (relative === "node_modules")
+        continue;
+      const absolute = path8.join(directory, name);
+      if (!isInside3(root, absolute) || relative.length > 1024) {
+        throw new Error(`OCI workspace snapshot contains an invalid path: ${relative}.`);
+      }
+      entries += 1;
+      if (entries > MAX_SYNC_ENTRIES) {
+        throw new Error(`OCI workspace snapshot exceeds the ${MAX_SYNC_ENTRIES}-entry limit.`);
+      }
+      const entry = await lstat6(absolute);
+      if (entry.isSymbolicLink()) {
+        throw new Error(`OCI workspace snapshot contains a symbolic link: ${relative}.`);
+      }
+      if (entry.isDirectory()) {
+        updateSnapshotMetadata(metadata, "directory", relative, entry);
+        await visit(absolute, relative);
+        continue;
+      }
+      if (!entry.isFile() || entry.nlink !== 1) {
+        throw new Error(`OCI workspace snapshot contains a special or linked file: ${relative}.`);
+      }
+      totalBytes += entry.size;
+      if (totalBytes > maxWorkspaceBytes) {
+        throw new Error(`OCI workspace snapshot exceeds the ${maxWorkspaceBytes}-byte workspace limit.`);
+      }
+      updateSnapshotMetadata(metadata, "file", relative, entry);
+    }
+  };
+  await visit(root);
+  return `sha256:${metadata.digest("hex")}`;
 };
 var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
   const backupRoot = `${snapshotRoot}.${randomUUID3()}.previous`;
@@ -2762,10 +3461,67 @@ var replaceSnapshot = async (snapshotRoot, stagedRoot) => {
   }
   await rm(backupRoot, { recursive: true, force: true });
 };
+var OCI_BACKGROUND_PROCESS_MARKER = "ZHIVEX_HARNESS_BACKGROUND_PROCESS";
+var OCI_COMMAND_TIMEOUT_MARKER = "ZHIVEX_HARNESS_COMMAND_TIMEOUT";
+var OCI_ATTESTATION_TIMEOUT_MS = 60000;
+var OCI_ATTESTATION_PROTOCOL_BYTES = 160;
+var OCI_ATTESTATION_PATTERN = /\nZHIVEX_HARNESS_ATTESTATION:(sha256:[a-f0-9]{64})\n$/;
+var OCI_COMMAND_RUNNER_SCRIPT = [
+  "import { createHash } from 'node:crypto';",
+  "import { spawn } from 'node:child_process';",
+  "import { readFileSync } from 'node:fs';",
+  "import { lstat, readFile, readdir, readlink, rm } from 'node:fs/promises';",
+  "import path from 'node:path';",
+  "const request=JSON.parse(readFileSync(0,'utf8'));",
+  "if(!Array.isArray(request.commands)||request.commands.length===0||!request.commands.every((command)=>Array.isArray(command)&&command.length>0&&command.every((value)=>typeof value==='string')))throw new Error('invalid OCI command batch');",
+  "if(!Number.isSafeInteger(request.maxProcessRuntimeMs)||request.maxProcessRuntimeMs<1)throw new Error('invalid OCI command timeout');",
+  "const deadline=Date.now()+request.maxProcessRuntimeMs;",
+  "const run=async(command,timeoutMs)=>await new Promise((resolve,reject)=>{",
+  "const child=spawn(command[0],command.slice(1),{stdio:['ignore','inherit','inherit'],detached:true});",
+  "let settled=false;let timedOut=false;",
+  "const finish=(value,error)=>{if(settled)return;settled=true;clearTimeout(timer);error?reject(error):resolve(value);};",
+  "const timer=setTimeout(()=>{timedOut=true;try{process.kill(-child.pid,'SIGKILL');}catch{}},timeoutMs);",
+  "child.once('error',(error)=>finish(undefined,error));",
+  "child.once('exit',(code)=>finish({exitCode:timedOut?124:(code??137),timedOut}));",
+  "});",
+  "for(const command of request.commands){const remaining=deadline-Date.now();if(remaining<=0){console.error('ZHIVEX_HARNESS_COMMAND_TIMEOUT');process.exit(124);}const result=await run(command,remaining);if(result.timedOut){console.error('ZHIVEX_HARNESS_COMMAND_TIMEOUT');process.exit(124);}if(result.exitCode!==0)process.exit(result.exitCode);}",
+  "const unexpectedProcesses=async()=>(await readdir('/proc')).filter((name)=>/^\\d+$/.test(name)).map(Number).filter((pid)=>pid!==1&&pid!==process.pid);",
+  "if((await unexpectedProcesses()).length>0){console.error('ZHIVEX_HARNESS_BACKGROUND_PROCESS');process.exit(126);}",
+  "const root='/workspace';",
+  "const seal=createHash('sha256');",
+  "const modules=path.join(root,'node_modules');",
+  "try{",
+  "if(request.hasDependencies===true){const entry=await lstat(modules);if(!entry.isSymbolicLink()||(await readlink(modules))!=='/dependencies')throw new Error('read-only dependency mount was replaced');}else{await rm(modules,{recursive:true,force:true});}",
+  "const digest=(value)=>`sha256:${createHash('sha256').update(value).digest('hex')}`;",
+  "const same=(before,after)=>before.dev===after.dev&&before.ino===after.ino&&before.size===after.size&&before.mtimeMs===after.mtimeMs&&before.ctimeMs===after.ctimeMs&&(before.mode&0o777)===(after.mode&0o777);",
+  "const visit=async(directory,base='')=>{",
+  "for(const name of (await readdir(directory)).sort()){",
+  "const relative=base?`${base}/${name}`:name;",
+  "if(relative==='node_modules')continue;",
+  "const absolute=path.join(directory,name);",
+  "const entry=await lstat(absolute);",
+  "if(entry.isSymbolicLink())throw new Error(`symbolic link: ${relative}`);",
+  "if(entry.isDirectory()){seal.update(`directory\\0${relative}\\0${entry.mode&0o777}\\0`);await visit(absolute,relative);continue;}",
+  "if(!entry.isFile()||entry.nlink!==1)throw new Error(`special or linked file: ${relative}`);",
+  "const contents=await readFile(absolute);",
+  "const after=await lstat(absolute);",
+  "if(!same(entry,after))throw new Error(`changed while sealing: ${relative}`);",
+  "seal.update(`file\\0${relative}\\0${entry.mode&0o777}\\0${entry.size}\\0${digest(contents)}\\0`);",
+  "}",
+  "};",
+  "await visit(root);",
+  "if((await unexpectedProcesses()).length>0){console.error('ZHIVEX_HARNESS_BACKGROUND_PROCESS');process.exit(126);}",
+  "for(const name of await readdir('/tmp'))await rm(path.join('/tmp',name),{recursive:true,force:true});",
+  "process.stdout.write(`\\nZHIVEX_HARNESS_ATTESTATION:sha256:${seal.digest('hex')}\\n`);",
+  "}catch(error){console.error(`ZHIVEX_HARNESS_ATTESTATION_FAILURE:${error instanceof Error?error.message:String(error)}`);process.exit(127);}"
+].join("");
+var OCI_SESSION_CONTROLLER_SCRIPT = "setInterval(()=>{},2147483647);";
 
 class CliOciRuntimeAdapter {
   runtime;
   hostEnvironment;
+  sessions = new Map;
+  runQueues = new Map;
   constructor(runtime) {
     this.runtime = runtime;
     this.hostEnvironment = Object.fromEntries(["DOCKER_CONFIG", "DOCKER_CONTEXT", "DOCKER_HOST", "HOME", "PATH", "XDG_RUNTIME_DIR"].flatMap((name) => process.env[name] ? [[name, process.env[name]]] : []));
@@ -2818,10 +3574,44 @@ ${result.stdout}`)) {
       throw new Error(`${this.runtime} could not remove OCI workspace volume ${name}: ${result.stderr.trim()}`);
     }
   }
-  async run(request) {
+  requestFingerprint(request) {
+    return digest2(JSON.stringify({
+      runId: request.runId,
+      snapshotRoot: request.snapshotRoot,
+      dependencyRoot: request.dependencyRoot ?? null,
+      imageId: request.imageId,
+      limits: request.limits
+    }));
+  }
+  async withRunLock(runId, operation) {
+    const key = runHash(runId);
+    const previous = this.runQueues.get(key) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    const tail = previous.then(() => gate, () => gate);
+    this.runQueues.set(key, tail);
+    await previous.catch(() => {
+      return;
+    });
+    try {
+      return await operation();
+    } finally {
+      release();
+      if (this.runQueues.get(key) === tail)
+        this.runQueues.delete(key);
+    }
+  }
+  async destroySession(session) {
+    if (this.sessions.get(session.key) === session)
+      this.sessions.delete(session.key);
+    await this.forceRemove(session.name);
+    await this.removeVolume(session.volumeName);
+  }
+  async createSession(request, requestFingerprint, snapshotSeal, hostFingerprint) {
     const resourceName = `zhivex-harness-${runHash(request.runId)}-${randomUUID3().slice(0, 8)}`;
     const name = `${resourceName}-job`;
-    const exportName = `${resourceName}-export`;
     const volumeName = `${resourceName}-workspace`;
     const uid = process.getuid?.() ?? 65532;
     const gid = process.getgid?.() ?? 65532;
@@ -2840,6 +3630,8 @@ ${result.stdout}`)) {
       `${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
       "--label",
       `com.zhivex.harness.run=${runHash(request.runId)}`,
+      "--label",
+      `${HARNESS_OCI_OWNER_PID_LABEL}=${process.pid}`,
       volumeName
     ];
     const args = [
@@ -2874,38 +3666,30 @@ ${result.stdout}`)) {
       "--env",
       "TMPDIR=/tmp",
       "--env",
-      "BUN_INSTALL_CACHE_DIR=/tmp/bun-cache",
+      "NPM_CONFIG_CACHE=/tmp/npm-cache",
       "--env",
       "CI=1",
-      "--volume",
-      `${request.snapshotRoot}:/seed:ro`,
       ...request.dependencyRoot ? ["--volume", `${request.dependencyRoot}:/dependencies:ro`] : [],
       "--workdir",
       "/workspace",
       "--entrypoint",
-      "bun",
+      "node",
       request.imageId,
+      "--input-type=module",
       "-e",
-      `await Bun.sleep(${request.limits.maxProcessRuntimeMs + 60000})`
+      OCI_SESSION_CONTROLLER_SCRIPT
     ];
-    let forcedRemoval;
-    const forceRemove = () => {
-      forcedRemoval ??= this.forceRemove(name);
-    };
+    let volumeCreated = false;
     try {
       await this.cli(volumeArgs);
+      volumeCreated = true;
       await this.cli(args);
       await this.cli(["start", name]);
       await this.cli([
-        "exec",
-        "--workdir",
-        "/workspace",
-        "--user",
-        `${uid}:${gid}`,
-        name,
-        "bun",
-        "-e",
-        "import { cp } from 'node:fs/promises'; await cp('/seed', '/workspace', { recursive: true, force: false, errorOnExist: true })"
+        "cp",
+        "-a",
+        `${request.snapshotRoot}${path8.sep}.`,
+        `${name}:/workspace`
       ], 60000);
       if (request.dependencyRoot) {
         await this.cli([
@@ -2915,93 +3699,208 @@ ${result.stdout}`)) {
           "--user",
           `${uid}:${gid}`,
           name,
-          "bun",
+          "node",
+          "--input-type=module",
           "-e",
           "import { symlink } from 'node:fs/promises'; await symlink('/dependencies', '/workspace/node_modules', 'dir')"
         ]);
       }
-      const result = await spawnBounded2([
-        this.runtime,
-        "exec",
-        "--workdir",
-        "/workspace",
-        "--user",
-        `${uid}:${gid}`,
+      const session = {
+        key: runHash(request.runId),
+        requestFingerprint,
         name,
-        ...request.command
-      ], {
-        env: this.hostEnvironment,
-        timeoutMs: request.limits.maxProcessRuntimeMs,
-        maxOutputBytes: request.limits.maxProcessOutputBytes,
-        ...request.abortSignal ? { abortSignal: request.abortSignal } : {},
-        onStop: forceRemove
-      });
-      if (result.timedOut || result.cancelled || result.outputLimitExceeded) {
-        forceRemove();
-        await forcedRemoval;
-      } else if (result.exitCode === 0) {
-        await this.cli(["pause", name]);
-        const stagedRoot = path7.join(path7.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID3()}`);
-        try {
-          await privateDirectory(stagedRoot);
-          try {
-            await this.cli([
-              "run",
-              "--rm",
-              "--name",
-              exportName,
-              "--label",
-              `${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
-              "--label",
-              `com.zhivex.harness.run=${runHash(request.runId)}`,
-              "--network",
-              "none",
-              "--read-only",
-              "--cap-drop",
-              "ALL",
-              "--security-opt",
-              "no-new-privileges",
-              "--pids-limit",
-              "32",
-              "--memory",
-              "256m",
-              "--cpus",
-              "1",
-              "--tmpfs",
-              "/tmp:rw,noexec,nosuid,nodev,size=16m",
-              "--user",
-              `${uid}:${gid}`,
-              "--volume",
-              `${volumeName}:/workspace:ro`,
-              "--volume",
-              `${stagedRoot}:/export:rw`,
-              "--workdir",
-              "/workspace",
-              "--entrypoint",
-              "bun",
-              request.imageId,
-              "-e",
-              "import { cp } from 'node:fs/promises'; await cp('/workspace', '/export', { recursive: true, force: false, errorOnExist: true })"
-            ], 60000);
-          } finally {
-            await this.forceRemove(exportName);
+        volumeName,
+        snapshotSeal,
+        hostFingerprint
+      };
+      this.sessions.set(session.key, session);
+      return session;
+    } catch (error) {
+      await this.forceRemove(name);
+      if (volumeCreated)
+        await this.removeVolume(volumeName).catch(() => {
+          return;
+        });
+      throw error;
+    }
+  }
+  async runInSession(request, session, sessionReused) {
+    const totalStartedAt = process.hrtime.bigint();
+    const uid = process.getuid?.() ?? 65532;
+    const gid = process.getgid?.() ?? 65532;
+    let forcedRemoval;
+    const forceRemove = () => {
+      forcedRemoval ??= this.forceRemove(session.name);
+    };
+    const commandStartedAt = process.hrtime.bigint();
+    const result = await spawnBounded2([
+      this.runtime,
+      "exec",
+      "-i",
+      "--workdir",
+      "/workspace",
+      "--user",
+      `${uid}:${gid}`,
+      session.name,
+      "node",
+      "--input-type=module",
+      "-e",
+      OCI_COMMAND_RUNNER_SCRIPT
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: request.limits.maxProcessRuntimeMs + OCI_ATTESTATION_TIMEOUT_MS,
+      maxOutputBytes: request.limits.maxProcessOutputBytes + OCI_ATTESTATION_PROTOCOL_BYTES,
+      input: JSON.stringify({
+        commands: request.commands,
+        maxProcessRuntimeMs: request.limits.maxProcessRuntimeMs,
+        hasDependencies: Boolean(request.dependencyRoot)
+      }),
+      ...request.abortSignal ? { abortSignal: request.abortSignal } : {},
+      onStop: forceRemove
+    });
+    const commandAndAttestationMs = elapsedMilliseconds(commandStartedAt);
+    const attestationMatch = result.exitCode === 0 ? result.stdout.match(OCI_ATTESTATION_PATTERN) : null;
+    const commandResult = attestationMatch ? { ...result, stdout: result.stdout.slice(0, -attestationMatch[0].length) } : result;
+    if (Buffer.byteLength(commandResult.stdout) + Buffer.byteLength(commandResult.stderr) > request.limits.maxProcessOutputBytes) {
+      commandResult.outputLimitExceeded = true;
+    }
+    const command = request.commands.length === 1 ? request.commands[0] : ["<oci-batch>", String(request.commands.length)];
+    const backgroundProcess = commandResult.exitCode === 126 && commandResult.stderr.includes(OCI_BACKGROUND_PROCESS_MARKER);
+    const commandTimedOut = commandResult.exitCode === 124 && commandResult.stderr.includes(OCI_COMMAND_TIMEOUT_MARKER);
+    const attestationFailure = commandResult.exitCode === 127 ? commandResult.stderr.match(/ZHIVEX_HARNESS_ATTESTATION_FAILURE:([^\r\n]*)/) : null;
+    if (commandResult.exitCode !== 0 || commandResult.timedOut || commandResult.cancelled || commandResult.outputLimitExceeded) {
+      forceRemove();
+      await forcedRemoval;
+      await this.destroySession(session);
+      if (attestationFailure) {
+        throw new Error(`OCI workspace attestation failed: ${attestationFailure[1] ?? "unknown failure"}.`);
+      }
+      return {
+        ...commandResult,
+        command,
+        commands: request.commands,
+        ...commandTimedOut ? { timedOut: true, exitCode: 124 } : {},
+        ...backgroundProcess ? {
+          exitCode: 126,
+          stderr: [
+            commandResult.stderr.replace(OCI_BACKGROUND_PROCESS_MARKER, "").trim(),
+            "OCI command left background processes running; its workspace changes were discarded."
+          ].filter(Boolean).join(`
+`)
+        } : {},
+        sessionReused,
+        workspacePublished: false,
+        workspaceExported: false,
+        phaseLatencies: {
+          commandAndAttestationMs,
+          totalMs: elapsedMilliseconds(totalStartedAt)
+        }
+      };
+    }
+    try {
+      if (!attestationMatch) {
+        throw new Error("OCI command attestation returned an invalid workspace seal.");
+      }
+      const workspaceSeal = attestationMatch[1];
+      if (workspaceSeal === session.snapshotSeal) {
+        return {
+          ...commandResult,
+          command,
+          commands: request.commands,
+          sessionReused,
+          workspacePublished: true,
+          workspaceExported: false,
+          phaseLatencies: {
+            commandAndAttestationMs,
+            totalMs: elapsedMilliseconds(totalStartedAt)
           }
-          await validateSynchronizedSnapshot(stagedRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
-          await replaceSnapshot(request.snapshotRoot, stagedRoot);
-        } finally {
-          await rm(stagedRoot, { recursive: true, force: true });
+        };
+      }
+      const workspaceExportStartedAt = process.hrtime.bigint();
+      const stagedRoot = path8.join(path8.dirname(request.snapshotRoot), `.workspace-sync-${randomUUID3()}`);
+      try {
+        await privateDirectory(stagedRoot);
+        await this.cli(["cp", `${session.name}:/workspace/.`, stagedRoot], 60000);
+        const validated = await validateSynchronizedSnapshot(stagedRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+        await replaceSnapshot(request.snapshotRoot, stagedRoot);
+        session.snapshotSeal = validated.seal;
+        session.hostFingerprint = validated.metadataFingerprint;
+      } finally {
+        await rm(stagedRoot, { recursive: true, force: true });
+      }
+      return {
+        ...commandResult,
+        command,
+        commands: request.commands,
+        sessionReused,
+        workspacePublished: true,
+        workspaceExported: true,
+        phaseLatencies: {
+          commandAndAttestationMs,
+          workspaceExportMs: elapsedMilliseconds(workspaceExportStartedAt),
+          totalMs: elapsedMilliseconds(totalStartedAt)
         }
+      };
+    } catch (error) {
+      await this.destroySession(session);
+      throw error;
+    }
+  }
+  async runBatchLocked(request) {
+    if (request.commands.length === 0 || request.commands.some((command) => command.length === 0)) {
+      throw new Error("OCI command batch must contain at least one non-empty argv command.");
+    }
+    const totalStartedAt = process.hrtime.bigint();
+    const key = runHash(request.runId);
+    const requestFingerprint = this.requestFingerprint(request);
+    let session = this.sessions.get(key);
+    let sessionReused = Boolean(session);
+    let validated;
+    let hostSynchronizationMs;
+    let sessionCreationMs;
+    if (session) {
+      const synchronizationStartedAt = process.hrtime.bigint();
+      const hostFingerprint = await snapshotMetadataFingerprint(request.snapshotRoot, request.limits.maxWorkspaceBytes);
+      if (session.requestFingerprint !== requestFingerprint || session.hostFingerprint !== hostFingerprint) {
+        await this.destroySession(session);
+        session = undefined;
+        sessionReused = false;
       }
+      hostSynchronizationMs = elapsedMilliseconds(synchronizationStartedAt);
+    }
+    if (!session) {
+      const creationStartedAt = process.hrtime.bigint();
+      validated = await validateSynchronizedSnapshot(request.snapshotRoot, request.snapshotRoot, request.limits.maxWorkspaceBytes, request.limits.maxFileWriteBytes);
+      session = await this.createSession(request, requestFingerprint, validated.seal, validated.metadataFingerprint);
+      sessionCreationMs = elapsedMilliseconds(creationStartedAt);
+    }
+    try {
+      const result = await this.runInSession(request, session, sessionReused);
       return {
         ...result,
-        command: request.command
+        phaseLatencies: {
+          ...result.phaseLatencies,
+          ...hostSynchronizationMs !== undefined ? { hostSynchronizationMs } : {},
+          ...sessionCreationMs !== undefined ? { sessionCreationMs } : {},
+          totalMs: elapsedMilliseconds(totalStartedAt)
+        }
       };
-    } finally {
-      forceRemove();
-      await forcedRemoval;
-      await this.removeVolume(volumeName);
+    } catch (error) {
+      if (this.sessions.get(key) === session)
+        await this.destroySession(session).catch(() => {
+          return;
+        });
+      throw error;
     }
   }
+  async run(request) {
+    const { command, ...shared } = request;
+    const result = await this.runBatch({ ...shared, commands: [command] });
+    return { ...result, command };
+  }
+  async runBatch(request) {
+    return this.withRunLock(request.runId, () => this.runBatchLocked(request));
+  }
   async removeByFilters(filters) {
     const listed = await spawnBounded2([this.runtime, "ps", "-aq", ...filters.flatMap((filter) => ["--filter", filter])], {
       env: this.hostEnvironment,
@@ -3046,57 +3945,150 @@ ${result.stdout}`)) {
     }
     return removed;
   }
+  async removeRunningOrphans() {
+    const listed = await spawnBounded2([
+      this.runtime,
+      "ps",
+      "-q",
+      "--filter",
+      `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
+      "--filter",
+      "status=running"
+    ], {
+      env: this.hostEnvironment,
+      timeoutMs: 30000,
+      maxOutputBytes: 1024 * 1024
+    });
+    if (listed.exitCode !== 0)
+      return 0;
+    let removed = 0;
+    for (const id of validContainerIds(listed.stdout)) {
+      const inspected = await this.cli([
+        "inspect",
+        id,
+        "--format",
+        "{{json .Config.Labels}}"
+      ], 30000, 20000);
+      const labels = JSON.parse(inspected.stdout);
+      const ownerPid = Number(labels[HARNESS_OCI_OWNER_PID_LABEL]);
+      if (hostProcessIsAlive(ownerPid))
+        continue;
+      await this.forceRemove(id);
+      removed += 1;
+    }
+    return removed;
+  }
   async removeRunContainers(runId) {
+    const key = runHash(runId);
+    const session = this.sessions.get(key);
+    let cachedResources = 0;
+    if (session) {
+      await this.destroySession(session);
+      cachedResources = 2;
+    }
     const filters = [
       `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
-      `label=com.zhivex.harness.run=${runHash(runId)}`
+      `label=com.zhivex.harness.run=${key}`
     ];
     const containers = await this.removeByFilters(filters);
     const volumes = await this.removeVolumesByFilters(filters);
-    return containers + volumes;
+    return cachedResources + containers + volumes;
   }
   async cleanupOrphans() {
     let removed = 0;
+    for (const session of [...this.sessions.values()]) {
+      await this.destroySession(session);
+      removed += 2;
+    }
+    this.sessions.clear();
     for (const status of ["created", "exited", "dead", "paused"]) {
       removed += await this.removeByFilters([
         `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`,
         `status=${status}`
       ]);
     }
+    removed += await this.removeRunningOrphans();
     removed += await this.removeVolumesByFilters([
       `label=${HARNESS_OCI_LABEL}=${HARNESS_OCI_LABEL_VALUE}`
     ]);
     return removed;
   }
 }
-var collectSnapshotFiles = async (workspace) => {
+var SNAPSHOT_INVENTORY_PAGE_SIZE = 5000;
+var COPY_ON_WRITE_UNSUPPORTED_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
+var collectSnapshotInventory = async (workspace, metrics) => {
   const files = new Map;
+  if (metrics)
+    metrics.inventoryPasses += 1;
   let cursor;
   do {
-    const page = await workspace.listFiles(".", { limit: 500, ...cursor ? { cursor } : {} });
+    const page = await workspace.listFiles(".", {
+      limit: SNAPSHOT_INVENTORY_PAGE_SIZE,
+      ...cursor ? { cursor } : {}
+    });
+    if (metrics)
+      metrics.inventoryPages += 1;
     for (const file of page.files) {
-      const absolute = path7.join(workspace.root, ...file.path.split("/"));
+      const absolute = path8.join(workspace.root, ...file.path.split("/"));
       if (!isInside3(workspace.root, absolute))
         throw new Error(`Snapshot file escaped its workspace: ${file.path}.`);
-      const before = await lstat5(absolute);
-      if (before.isSymbolicLink() || !before.isFile())
+      const entry = await lstat6(absolute);
+      if (entry.isSymbolicLink() || !entry.isFile()) {
         throw new Error(`Snapshot source is not a regular file: ${file.path}.`);
-      const contents = await readFile3(absolute);
-      const after = await lstat5(absolute);
-      if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
-        throw new Error(`Snapshot source changed while reading: ${file.path}.`);
       }
-      if (digest2(contents) !== file.digest)
-        throw new Error(`Snapshot digest changed while reading: ${file.path}.`);
-      files.set(file.path, { path: file.path, digest: file.digest, contents, mode: before.mode & 511 });
+      if (entry.size !== file.size) {
+        throw new Error(`Snapshot source changed while inventorying: ${file.path}.`);
+      }
+      files.set(file.path, {
+        path: file.path,
+        digest: file.digest,
+        mode: entry.mode & 511,
+        bytes: file.size
+      });
     }
     cursor = page.nextCursor;
   } while (cursor);
   return files;
 };
-var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceBytes) => {
-  const files = await collectSnapshotFiles(source);
-  const totalBytes = [...files.values()].reduce((total, file) => total + file.contents.byteLength, 0);
+var readSnapshotFile = async (workspace, expected, metrics) => {
+  const absolute = path8.join(workspace.root, ...expected.path.split("/"));
+  if (!isInside3(workspace.root, absolute)) {
+    throw new Error(`Snapshot file escaped its workspace: ${expected.path}.`);
+  }
+  const before = await lstat6(absolute);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new Error(`Snapshot source is not a regular file: ${expected.path}.`);
+  }
+  const contents = await readFile3(absolute);
+  const after = await lstat6(absolute);
+  if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || (before.mode & 511) !== (after.mode & 511)) {
+    throw new Error(`Snapshot source changed while reading: ${expected.path}.`);
+  }
+  const actualDigest = digest2(contents);
+  if (actualDigest !== expected.digest || contents.byteLength !== expected.bytes || (before.mode & 511) !== expected.mode) {
+    throw new Error(`Snapshot source changed after inventory: ${expected.path}.`);
+  }
+  if (metrics) {
+    metrics.verifiedContentReads += 1;
+    metrics.verifiedContentBytes += contents.byteLength;
+  }
+  return { ...expected, contents };
+};
+var copySnapshotFile = async (source, target, metrics) => {
+  try {
+    await copyFile(source, target, fsConstants.COPYFILE_FICLONE_FORCE);
+  } catch (error) {
+    const code = error.code;
+    if (!code || !COPY_ON_WRITE_UNSUPPORTED_CODES.has(code))
+      throw error;
+    if (metrics)
+      metrics.snapshotCloneFallbacks += 1;
+    await copyFile(source, target);
+  }
+};
+var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceBytes, metrics) => {
+  const files = await collectSnapshotInventory(source, metrics);
+  const totalBytes = [...files.values()].reduce((total, file) => total + file.bytes, 0);
   if (totalBytes > maxWorkspaceBytes) {
     throw new Error(`Workspace snapshot exceeds the ${maxWorkspaceBytes}-byte OCI limit.`);
   }
@@ -3104,13 +4096,22 @@ var copyWorkspaceSnapshot = async (source, baseRoot, snapshotRoot, maxWorkspaceB
     await rm(root, { recursive: true, force: true });
     await privateDirectory(root);
   }
-  for (const file of files.values()) {
-    for (const root of [baseRoot, snapshotRoot]) {
-      const target = path7.join(root, ...file.path.split("/"));
-      await mkdir3(path7.dirname(target), { recursive: true, mode: 448 });
-      await writeFile(target, file.contents, { mode: file.mode });
-      await chmod2(target, file.mode);
-    }
+  for (const expected of files.values()) {
+    const file = await readSnapshotFile(source, expected, metrics);
+    const baseTarget = path8.join(baseRoot, ...file.path.split("/"));
+    const snapshotTarget = path8.join(snapshotRoot, ...file.path.split("/"));
+    await Promise.all([
+      mkdir3(path8.dirname(baseTarget), { recursive: true, mode: 448 }),
+      mkdir3(path8.dirname(snapshotTarget), { recursive: true, mode: 448 })
+    ]);
+    await writeFile(baseTarget, file.contents, { mode: file.mode });
+    await chmod2(baseTarget, file.mode);
+    await copySnapshotFile(baseTarget, snapshotTarget, metrics);
+    await chmod2(snapshotTarget, file.mode);
+  }
+  if (metrics) {
+    metrics.snapshotFiles += files.size;
+    metrics.snapshotBytes += totalBytes;
   }
   return { files: files.size, bytes: totalBytes };
 };
@@ -3129,9 +4130,11 @@ var textContent = (file, maxFileWriteBytes) => {
   }
   return file.contents.toString("utf8");
 };
-var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes) => {
-  const before = await collectSnapshotFiles(base);
-  const after = await collectSnapshotFiles(current);
+var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes, metrics) => {
+  const [before, after] = await Promise.all([
+    collectSnapshotInventory(base, metrics),
+    collectSnapshotInventory(current, metrics)
+  ]);
   const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
   const entries = [];
   let totalBytes = 0;
@@ -3141,9 +4144,9 @@ var createEnvironmentPatch = async (runId, base, current, maxFileWriteBytes) =>
     if (oldFile?.digest === newFile?.digest && oldFile?.mode === newFile?.mode)
       continue;
     const operation = !oldFile ? "create" : !newFile ? "delete" : "update";
-    const beforeContent = oldFile ? textContent(oldFile, maxFileWriteBytes) : undefined;
-    const afterContent = newFile ? textContent(newFile, maxFileWriteBytes) : undefined;
-    const bytes = newFile?.contents.byteLength ?? 0;
+    const beforeContent = oldFile ? textContent(await readSnapshotFile(base, oldFile, metrics), maxFileWriteBytes) : undefined;
+    const afterContent = newFile ? textContent(await readSnapshotFile(current, newFile, metrics), maxFileWriteBytes) : undefined;
+    const bytes = newFile?.bytes ?? 0;
     totalBytes += bytes;
     entries.push({
       path: filePath,
@@ -3183,8 +4186,8 @@ var inspectHostPrecondition = async (workspace, filePath, expectedDigest, expect
     throw error;
   }
 };
-var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWriteBytes) => {
-  const patch = await createEnvironmentPatch(runId, base, current, maxFileWriteBytes);
+var importPatch = async (runId, expectedPatchId, host, base, current, maxFileWriteBytes, metrics) => {
+  const patch = await createEnvironmentPatch(runId, base, current, maxFileWriteBytes, metrics);
   if (patch.patchId !== expectedPatchId) {
     throw new Error("Environment patch changed after review; inspect it again before import.");
   }
@@ -3278,7 +4281,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
     version: `${HARNESS_EXECUTION_POLICY_VERSION}:${image.imageDigest}`,
     backend: "container",
     assurance: "enforced",
-    isolation: "per-tool-call",
+    isolation: "per-run",
     workspace: {
       id: workspaceIdentity,
       root: "/workspace",
@@ -3315,26 +4318,41 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       maxPids: options.config.maxPids,
       maxCpus: options.config.maxCpus,
       tmpfsMb: options.config.tmpfsMb,
+      containerLifecycle: "warm-per-acquired-run",
+      failedCommandRecovery: "discard-and-reseed",
       patchImportApproval: true,
       hostMutationMode: "reviewed-environment-patch"
     }
   };
   const binding = createAgentExecutionEnvironmentBinding(manifest);
-  const environmentRoot = path7.join(options.stateDirectory, "environments");
+  const environmentRoot = path8.join(options.stateDirectory, "environments");
   return {
     manifest,
     image,
     runtime,
     async acquire(request) {
+      const ioMetrics = {
+        inventoryPasses: 0,
+        inventoryPages: 0,
+        verifiedContentReads: 0,
+        verifiedContentBytes: 0,
+        snapshotFiles: 0,
+        snapshotBytes: 0,
+        snapshotCloneFallbacks: 0,
+        containerStarts: 0,
+        containerReuses: 0,
+        workspacePublishes: 0,
+        workspaceExports: 0
+      };
       await privateDirectory(environmentRoot);
-      const directory = path7.join(environmentRoot, runHash(request.runId));
+      const directory = path8.join(environmentRoot, runHash(request.runId));
       await privateDirectory(directory);
-      const metadataPath = path7.join(directory, "environment.json");
-      const baseRoot = path7.join(directory, "base");
-      const snapshotRoot = path7.join(directory, "workspace");
+      const metadataPath = path8.join(directory, "environment.json");
+      const baseRoot = path8.join(directory, "base");
+      const snapshotRoot = path8.join(directory, "workspace");
       let metadata;
       try {
-        const entry = await lstat5(metadataPath);
+        const entry = await lstat6(metadataPath);
         if (entry.isSymbolicLink() || !entry.isFile())
           throw new Error("Execution metadata must be a regular file.");
         metadata = JSON.parse(await readFile3(metadataPath, "utf8"));
@@ -3344,7 +4362,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       } catch (error) {
         if (error.code !== "ENOENT")
           throw error;
-        const snapshot = await copyWorkspaceSnapshot(options.workspace, baseRoot, snapshotRoot, options.config.maxWorkspaceBytes);
+        const snapshot = await copyWorkspaceSnapshot(options.workspace, baseRoot, snapshotRoot, options.config.maxWorkspaceBytes, ioMetrics);
         const now = new Date().toISOString();
         metadata = {
           schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
@@ -3363,10 +4381,10 @@ var createHarnessOciExecutionEnvironment = async (options) => {
       await atomicJson(metadataPath, metadata);
       const workspace = await Workspace.open(snapshotRoot);
       const base = await Workspace.open(baseRoot);
-      const dependencyPath = path7.join(options.workspace.root, "node_modules");
+      const dependencyPath = path8.join(options.workspace.root, "node_modules");
       let dependencyRoot;
       try {
-        const entry = await lstat5(dependencyPath);
+        const entry = await lstat6(dependencyPath);
         if (entry.isSymbolicLink() || !entry.isDirectory()) {
           throw new Error("node_modules must be a real directory before it can be mounted read-only.");
         }
@@ -3376,31 +4394,41 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           throw error;
         }
       }
-      const runCommand = async (command, args, context) => {
+      const validateCommand = (command, args) => {
         if (!options.config.allowedCommands.includes(command)) {
           throw new Error(`The OCI command "${command}" is not in the explicit allowlist.`);
         }
         if (args.length > 256 || args.some((value) => value.length > 8192 || value.includes("\x00"))) {
           throw new Error("OCI command arguments exceed the bounded argument contract.");
         }
-        const result = await runtime.run({
-          runId: request.runId,
-          snapshotRoot,
-          ...dependencyRoot ? { dependencyRoot } : {},
-          command: [command, ...args],
-          imageId: image.imageId,
-          limits: {
-            maxProcessRuntimeMs: options.config.maxProcessRuntimeMs,
-            maxProcessOutputBytes: options.config.maxProcessOutputBytes,
-            maxMemoryMb: options.config.maxMemoryMb,
-            maxPids: options.config.maxPids,
-            maxCpus: options.config.maxCpus,
-            maxWorkspaceBytes: options.config.maxWorkspaceBytes,
-            maxFileWriteBytes: options.config.maxFileWriteBytes,
-            tmpfsMb: options.config.tmpfsMb
-          },
-          ...context?.abortSignal ?? request.abortSignal ? { abortSignal: context?.abortSignal ?? request.abortSignal } : {}
-        });
+        return [command, ...args];
+      };
+      const sharedRunRequest = (context) => ({
+        runId: request.runId,
+        snapshotRoot,
+        ...dependencyRoot ? { dependencyRoot } : {},
+        imageId: image.imageId,
+        limits: {
+          maxProcessRuntimeMs: options.config.maxProcessRuntimeMs,
+          maxProcessOutputBytes: options.config.maxProcessOutputBytes,
+          maxMemoryMb: options.config.maxMemoryMb,
+          maxPids: options.config.maxPids,
+          maxCpus: options.config.maxCpus,
+          maxWorkspaceBytes: options.config.maxWorkspaceBytes,
+          maxFileWriteBytes: options.config.maxFileWriteBytes,
+          tmpfsMb: options.config.tmpfsMb
+        },
+        ...context?.abortSignal ?? request.abortSignal ? { abortSignal: context?.abortSignal ?? request.abortSignal } : {}
+      });
+      const normalizeResult = (result) => {
+        if (result.sessionReused === false)
+          ioMetrics.containerStarts += 1;
+        if (result.sessionReused === true)
+          ioMetrics.containerReuses += 1;
+        if (result.workspacePublished === true)
+          ioMetrics.workspacePublishes += 1;
+        if (result.workspaceExported === true)
+          ioMetrics.workspaceExports += 1;
         const forcedExitCode = result.cancelled ? 130 : result.timedOut ? 124 : result.outputLimitExceeded ? 125 : result.exitCode;
         return {
           command: result.command,
@@ -3413,7 +4441,45 @@ var createHarnessOciExecutionEnvironment = async (options) => {
             ...result.outputLimitExceeded ? ["OCI command exceeded the output limit."] : []
           ].filter(Boolean).join(`
 `),
-          timedOut: result.timedOut
+          timedOut: result.timedOut,
+          ...result.phaseLatencies ? { phaseLatencies: result.phaseLatencies } : {},
+          ...result.sessionReused !== undefined ? { sessionReused: result.sessionReused } : {},
+          ...result.workspacePublished !== undefined ? { workspacePublished: result.workspacePublished } : {},
+          ...result.workspaceExported !== undefined ? { workspaceExported: result.workspaceExported } : {}
+        };
+      };
+      const runCommand2 = async (command, args, context) => normalizeResult(await runtime.run({
+        ...sharedRunRequest(context),
+        command: validateCommand(command, args)
+      }));
+      const runCommandBatch = async (commands, context) => {
+        if (commands.length === 0 || commands.length > 32) {
+          throw new Error("OCI command batch must contain between 1 and 32 commands.");
+        }
+        if (commands.reduce((total, item) => total + item.args.length, 0) > 256) {
+          throw new Error("OCI command batch exceeds the bounded argument-count contract.");
+        }
+        const argvCommands = commands.map(({ command, args }) => validateCommand(command, args));
+        if (runtime.runBatch) {
+          return normalizeResult(await runtime.runBatch({
+            ...sharedRunRequest(context),
+            commands: argvCommands
+          }));
+        }
+        const results = [];
+        for (const argv of argvCommands) {
+          const result = await runCommand2(argv[0], argv.slice(1), context);
+          results.push(result);
+          if (result.exitCode !== 0)
+            break;
+        }
+        return {
+          command: ["<oci-batch>", String(commands.length)],
+          exitCode: results.at(-1)?.exitCode ?? 1,
+          stdout: results.map((result) => result.stdout).filter(Boolean).join(""),
+          stderr: results.map((result) => result.stderr).filter(Boolean).join(`
+`),
+          timedOut: results.some((result) => result.timedOut)
         };
       };
       const session = {
@@ -3433,6 +4499,22 @@ var createHarnessOciExecutionEnvironment = async (options) => {
               return { decision: "deny", reason: "The requested OCI executable is not allowlisted." };
             }
           }
+          if (name === "verify_and_apply_environment_patch" || name === "verify_and_apply_reviewed_edits") {
+            const input = authorization.input;
+            const validBoundInput = name === "verify_and_apply_environment_patch" ? typeof input.patchId === "string" : Array.isArray(input.changes) && input.changes.length > 0;
+            if (!validBoundInput || typeof input.command !== "string" || !options.config.allowedCommands.includes(input.command) || !Array.isArray(input.args)) {
+              return { decision: "deny", reason: "The verified OCI transaction is invalid or contains a non-allowlisted executable." };
+            }
+          }
+          if (name === "run_environment_batch") {
+            const input = authorization.input;
+            if (!Array.isArray(input.commands) || input.commands.length < 1 || input.commands.length > 32 || input.commands.some((item) => {
+              const candidate = item;
+              return typeof candidate.command !== "string" || !options.config.allowedCommands.includes(candidate.command) || !Array.isArray(candidate.args);
+            })) {
+              return { decision: "deny", reason: "The requested OCI command batch is invalid or contains a non-allowlisted executable." };
+            }
+          }
           return {
             decision: "allow",
             metadata: {
@@ -3447,7 +4529,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           return await operation();
         },
         async status() {
-          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes);
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
           return {
             schemaVersion: HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
             kind: "environment-status",
@@ -3461,32 +4543,27 @@ var createHarnessOciExecutionEnvironment = async (options) => {
             rootFilesystem: "read-only",
             workspace: "ephemeral-snapshot",
             patchId: patch.patchId,
-            changedFiles: patch.entries.length
+            changedFiles: patch.entries.length,
+            io: { ...ioMetrics }
           };
         },
-        runCommand,
+        runCommand: runCommand2,
+        runCommandBatch,
         async runCheck(check, expectedScript, allowedChecks, context) {
-          if (!/^[A-Za-z0-9:_-]+$/.test(check) || !allowedChecks.includes(check)) {
-            throw new Error(`The check "${check}" is not in the explicit allowlist.`);
-          }
           let manifestDocument;
           try {
-            manifestDocument = JSON.parse(await readFile3(path7.join(snapshotRoot, "package.json"), "utf8"));
+            manifestDocument = JSON.parse(await readFile3(path8.join(snapshotRoot, "package.json"), "utf8"));
           } catch (error) {
             if (error.code === "ENOENT") {
               throw new Error("The environment snapshot does not contain package.json.");
             }
             throw error;
           }
-          const actual = manifestDocument.scripts?.[check];
-          if (!actual)
-            throw new Error(`package.json does not define the "${check}" script.`);
-          if (actual !== expectedScript)
-            throw new Error(`The "${check}" script changed or does not match expectedScript.`);
-          return runCommand("bun", ["--no-env-file", "run", check], context);
+          const resolved = await resolvePackageCheckCommand(snapshotRoot, manifestDocument, check, expectedScript, allowedChecks);
+          return runCommand2(resolved.command[0], resolved.command.slice(1), context);
         },
         async inspectPatch() {
-          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes);
+          const patch = await createEnvironmentPatch(request.runId, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
           const payload = patchPayload(request.runId, patch.entries);
           return {
             ...payload,
@@ -3495,7 +4572,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
           };
         },
         importPatch(host, patchId) {
-          return importPatch(request.runId, patchId, host, base, workspace, options.config.maxFileWriteBytes);
+          return importPatch(request.runId, patchId, host, base, workspace, options.config.maxFileWriteBytes, ioMetrics);
         },
         async release(result) {
           await runtime.removeRunContainers(request.runId);
@@ -3509,7 +4586,7 @@ var createHarnessOciExecutionEnvironment = async (options) => {
   };
 };
 var cleanupHarnessExecutionArtifacts = async (stateDirectory, before) => {
-  const root = path7.join(stateDirectory, "environments");
+  const root = path8.join(stateDirectory, "environments");
   const result = { scanned: 0, deleted: 0, skipped: 0 };
   let entries;
   try {
@@ -3525,15 +4602,15 @@ var cleanupHarnessExecutionArtifacts = async (stateDirectory, before) => {
       continue;
     }
     result.scanned += 1;
-    const directory = path7.join(root, entry.name);
+    const directory = path8.join(root, entry.name);
     const resolved = await realpath3(directory);
     if (!isInside3(root, resolved)) {
       result.skipped += 1;
       continue;
     }
     try {
-      const metadataPath = path7.join(directory, "environment.json");
-      const metadataEntry = await lstat5(metadataPath);
+      const metadataPath = path8.join(directory, "environment.json");
+      const metadataEntry = await lstat6(metadataPath);
       if (metadataEntry.isSymbolicLink() || !metadataEntry.isFile())
         throw new Error("unsafe metadata");
       const metadata = JSON.parse(await readFile3(metadataPath, "utf8"));
@@ -3559,7 +4636,7 @@ var describeOciCommand = (command, args) => commandDisplay([command, ...args]);
 
 // src/harness.ts
 var APPROVAL_VERSION = "2026-08-17-v5";
-var TOOL_CONTRACT_VERSION = "enforced-execution-v1";
+var TOOL_CONTRACT_VERSION = "workspace-verified-transaction-v3";
 var createHarnessBinding = (config, mcpConfiguration, model, subagentModels, providerTransportFingerprint, executionEnvironment) => ({
   schemaVersion: 1,
   id: "zhivex-harness",
@@ -3589,14 +4666,17 @@ var HARNESS_INSTRUCTIONS = `You are Zhivex Harness, a provider-portable coding a
 
 Rules:
 - Match the user's language.
-- Inspect the repository before proposing changes. Prefer search_files and read_file over assumptions.
+- Inspect the repository before proposing changes. Use list_files with includeDigests=false for fast topology discovery, then prefer search_many and read_files for independent lookups. Omit cursor on the first paginated call and only reuse an exact nextCursor returned by the immediately preceding matching request. Read the exact digest before proposing any edit.
 - Use only workspace-relative paths. Never request or expose secrets.
 - Make the smallest coherent change that fully addresses the task.
 - For every file edit, first read its digest and call propose_edits. Apply exactly that reviewed proposal with apply_patch.
 - apply_patch, move_file, quarantine_file, restore_file, and run_check require explicit approval from the operator.
+- apply_reviewed_edits is the one-step equivalent of propose_edits plus apply_patch: its complete digest-bound changes are the approval payload and are applied atomically only after approval.
+- verify_and_apply_reviewed_edits requests one approval for complete digest-bound edits plus exact verifier argv, applies them to a clean OCI snapshot, rejects verifier-created drift, and imports only after exit code 0.
 - Calling an approval-gated tool is how you request that approval: call the tool with its complete reviewed arguments, then let the runtime pause before execution. Never replace the tool call with a textual approval request.
 - With enforced OCI execution enabled, workspace tools operate on an ephemeral snapshot. Use inspect_environment_patch and obtain a separate approval through apply_environment_patch before changing the host workspace.
-- run_environment_command executes one allowlisted argv command without a host shell. Network, privileges, resources, environment variables, and output are bounded by the OCI policy.
+- run_environment_command executes one allowlisted argv command without a host shell. Prefer run_environment_batch for a reviewed sequence that can share one final workspace attestation. Network, privileges, resources, environment variables, and output are bounded by the OCI policy.
+- verify_and_apply_environment_patch binds one reviewed patch and verifier argv, runs that verifier inside OCI, rejects any verifier-created patch drift, and imports only after exit code 0.
 - Never overwrite stale content. If an expected digest no longer matches, inspect the file again and create a new proposal.
 - Deletions are recoverable: use quarantine_file, never permanent deletion. Use restore_file to recover quarantined content.
 - Never claim a check passed unless run_check returned exitCode 0.
@@ -3635,20 +4715,29 @@ var mutationApproval = {
   approvalVersion: APPROVAL_VERSION,
   metadata: toolMetadata(["filesystem", "write"], "high")
 };
+var verifierCommandSchema = z3.strictObject({
+  command: z3.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/),
+  args: z3.array(z3.string().max(8192)).max(256).default([])
+});
+var verifiedReviewedEditsInputSchema = editProposalInputSchema.extend({
+  command: verifierCommandSchema.shape.command,
+  args: verifierCommandSchema.shape.args
+});
 var createWorkspaceTools = (workspace, allowedChecks) => ({
   list_files: tool({
     name: "list_files",
-    description: "List regular files with content digests using a stable cursor. Build artifacts, dependencies, Git internals, and harness state are ignored.",
+    description: "List regular files using a stable cursor. Omit cursor on the first call; on later pages pass only the exact nextCursor returned by the preceding matching request. Set includeDigests=false for fast path-only topology discovery; keep it true when size and content digests are required. Build artifacts, dependencies, Git internals, and harness state are ignored.",
     schema: z3.object({
       path: z3.string().min(1).default("."),
       limit: z3.number().int().min(1).max(500).default(200),
-      cursor: z3.string().min(1).max(2000).optional()
+      includeDigests: z3.boolean().default(true),
+      cursor: z3.string().min(1).max(2000).optional().describe("Omit on the first page. For a later page, pass only the exact nextCursor returned by the preceding matching list_files result.")
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ path: path8, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).listFiles(path8, {
-      limit,
-      ...cursor ? { cursor } : {}
-    }))
+    execute: async ({ path: path9, limit, includeDigests, cursor }, context) => {
+      const selectedWorkspace = harnessExecutionSession(context)?.workspace ?? workspace;
+      return serializeJsonValue2(await (includeDigests ? selectedWorkspace.listFiles(path9, { limit, includeDigests: true, ...cursor ? { cursor } : {} }) : selectedWorkspace.listFiles(path9, { limit, includeDigests: false, ...cursor ? { cursor } : {} })));
+    }
   }),
   read_file: tool({
     name: "read_file",
@@ -3659,7 +4748,24 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       endLine: z3.number().int().min(1).optional()
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ path: path8, startLine, endLine }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFile(path8, startLine, endLine))
+    execute: async ({ path: path9, startLine, endLine }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFile(path9, startLine, endLine))
+  }),
+  read_files: tool({
+    name: "read_files",
+    description: "Read up to 20 independent UTF-8 file slices in one bounded call. Duplicate paths are read once and results use deterministic path/range order.",
+    schema: z3.object({
+      files: z3.array(z3.object({
+        path: z3.string().min(1),
+        startLine: z3.number().int().min(1).default(1),
+        endLine: z3.number().int().min(1).optional()
+      })).min(1).max(20)
+    }),
+    metadata: readOnlyMetadata,
+    execute: async ({ files }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).readFiles(files.map(({ path: path9, startLine, endLine }) => ({
+      path: path9,
+      startLine,
+      ...endLine !== undefined ? { endLine } : {}
+    }))))
   }),
   search_files: tool({
     name: "search_files",
@@ -3672,12 +4778,34 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       cursor: z3.string().min(1).max(2000).optional()
     }),
     metadata: readOnlyMetadata,
-    execute: async ({ query, path: path8, caseSensitive, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchFiles(query, path8, {
+    execute: async ({ query, path: path9, caseSensitive, limit, cursor }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchFiles(query, path9, {
       caseSensitive,
       limit,
       ...cursor ? { cursor } : {}
     }))
   }),
+  search_many: tool({
+    name: "search_many",
+    description: "Search up to 10 independent literal queries in one workspace pass, with at most 500 aggregate matches.",
+    schema: z3.object({
+      queries: z3.array(z3.object({
+        query: z3.string().min(1).max(200),
+        caseSensitive: z3.boolean().default(false)
+      })).min(1).max(10),
+      path: z3.string().min(1).default("."),
+      limitPerQuery: z3.number().int().min(1).max(500).default(50)
+    }).superRefine((input, context) => {
+      if (input.queries.length * input.limitPerQuery > 500) {
+        context.addIssue({
+          code: "custom",
+          path: ["limitPerQuery"],
+          message: "search_many allows at most 500 aggregate matches."
+        });
+      }
+    }),
+    metadata: readOnlyMetadata,
+    execute: async ({ queries, path: path9, limitPerQuery }, context) => serializeJsonValue2(await (harnessExecutionSession(context)?.workspace ?? workspace).searchMany(queries, path9, { limitPerQuery }))
+  }),
   propose_edits: tool({
     name: "propose_edits",
     description: "Validate a bounded multi-file edit against current SHA-256 digests and return a deterministic proposalId for operator review. This tool does not write files.",
@@ -3698,6 +4826,19 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
       return serializeJsonValue2(editContractDocument("patch-result", await (harnessExecutionSession(context)?.workspace ?? workspace).applyPatch(proposal)));
     }
   }),
+  apply_reviewed_edits: tool({
+    name: "apply_reviewed_edits",
+    description: "Request approval for complete digest-bound changes and atomically apply them without copying a separate proposalId between model turns. The exact paths, expected digests, and contents are the approval payload.",
+    schema: editProposalInputSchema,
+    ...mutationApproval,
+    execute: async ({ changes }, context) => {
+      const proposal = createEditProposal({ changes });
+      return serializeJsonValue2(editContractDocument("patch-result", await (harnessExecutionSession(context)?.workspace ?? workspace).applyPatch({
+        proposalId: proposal.proposalId,
+        changes
+      })));
+    }
+  }),
   move_file: tool({
     name: "move_file",
     description: "Move one regular file without overwriting the destination. The source must still match expectedDigest.",
@@ -3721,7 +4862,7 @@ var createWorkspaceTools = (workspace, allowedChecks) => ({
   }),
   run_check: tool({
     name: "run_check",
-    description: `Run one explicitly allowed package.json script through Bun (${allowedChecks.join(", ")}). Read package.json first and pass its exact script text as expectedScript so the operator can review the command. No arbitrary shell or .env loading is exposed.`,
+    description: `Run one explicitly allowed package.json script through the repository package manager (${allowedChecks.join(", ")}). Read package.json first and pass its exact script text as expectedScript so the operator can review the command. No arbitrary shell or implicit lifecycle hook is exposed.`,
     schema: z3.object({
       check: z3.string().min(1).max(100).regex(/^[A-Za-z0-9:_-]+$/),
       expectedScript: z3.string().min(1).max(2000)
@@ -3773,6 +4914,29 @@ var createExecutionEnvironmentTools = (workspace) => ({
     metadata: toolMetadata(["code-execution", "filesystem"], "high"),
     execute: async ({ command, args }, context) => serializeJsonValue2(await requireExecutionSession(context).runCommand(command, args, context))
   }),
+  run_environment_batch: tool({
+    name: "run_environment_batch",
+    description: "Run 1 to 32 reviewed allowlisted argv commands sequentially inside one enforced OCI cycle. Execution stops on the first failure and the workspace is attested and published only after the batch succeeds; no host shell or network is exposed.",
+    schema: z3.strictObject({
+      commands: z3.array(z3.strictObject({
+        command: z3.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/),
+        args: z3.array(z3.string().max(8192)).max(256).default([])
+      })).min(1).max(32)
+    }).superRefine((input, context) => {
+      if (input.commands.reduce((total, command) => total + command.args.length, 0) > 256) {
+        context.addIssue({
+          code: "custom",
+          path: ["commands"],
+          message: "run_environment_batch allows at most 256 aggregate arguments."
+        });
+      }
+    }),
+    requiresApproval: true,
+    approvalMode: "interrupt",
+    approvalVersion: APPROVAL_VERSION,
+    metadata: toolMetadata(["code-execution", "filesystem"], "high"),
+    execute: async ({ commands }, context) => serializeJsonValue2(await requireExecutionSession(context).runCommandBatch(commands, context))
+  }),
   environment_status: tool({
     name: "environment_status",
     description: "Inspect the immutable image binding and enforced policy for the active run without exposing host paths or environment variables.",
@@ -3793,6 +4957,83 @@ var createExecutionEnvironmentTools = (workspace) => ({
     schema: z3.strictObject({ patchId: fileDigestSchema }),
     ...mutationApproval,
     execute: async ({ patchId }, context) => serializeJsonValue2(await requireExecutionSession(context).importPatch(workspace, patchId))
+  }),
+  verify_and_apply_environment_patch: tool({
+    name: "verify_and_apply_environment_patch",
+    description: "Request one approval to verify an already inspected content-bound OCI patch with exact allowlisted argv and import it only when verification succeeds without changing the reviewed patch.",
+    schema: z3.strictObject({
+      patchId: fileDigestSchema,
+      command: z3.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/),
+      args: z3.array(z3.string().max(8192)).max(256).default([])
+    }),
+    requiresApproval: true,
+    approvalMode: "interrupt",
+    approvalVersion: "2026-08-21-verify-and-apply-v1",
+    metadata: toolMetadata(["code-execution", "filesystem"], "high"),
+    execute: async ({ patchId, command, args }, context) => {
+      const session = requireExecutionSession(context);
+      const beforeVerification = await session.inspectPatch();
+      if (beforeVerification.patchId !== patchId) {
+        throw new Error("The OCI patch changed after review; inspect it again before verification and import.");
+      }
+      const verification = await session.runCommand(command, args, context);
+      if (verification.exitCode !== 0) {
+        throw new Error(`The approved verifier failed with exit code ${verification.exitCode}; the host workspace was not changed.`);
+      }
+      const afterVerification = await session.inspectPatch();
+      if (afterVerification.patchId !== patchId) {
+        throw new Error("The verifier changed the reviewed OCI patch; the host workspace was not changed.");
+      }
+      const imported = await session.importPatch(workspace, patchId);
+      return serializeJsonValue2({
+        schemaVersion: 1,
+        kind: "verified-environment-patch-import",
+        patchId,
+        verification,
+        imported
+      });
+    }
+  }),
+  verify_and_apply_reviewed_edits: tool({
+    name: "verify_and_apply_reviewed_edits",
+    description: "Request one approval for complete digest-bound edits and exact verifier argv. The transaction requires a clean OCI snapshot, applies the edits atomically, rejects verifier-created drift, and imports the reviewed patch only after exit code 0.",
+    schema: verifiedReviewedEditsInputSchema,
+    requiresApproval: true,
+    approvalMode: "interrupt",
+    approvalVersion: "2026-08-21-verify-reviewed-edits-v1",
+    metadata: toolMetadata(["code-execution", "filesystem", "write"], "high"),
+    execute: async ({ changes, command, args }, context) => {
+      const session = requireExecutionSession(context);
+      const initialPatch = await session.inspectPatch();
+      if (initialPatch.entries.length !== 0) {
+        throw new Error("The verified edit transaction requires a clean OCI snapshot; the host workspace was not changed.");
+      }
+      const proposal = createEditProposal({ changes });
+      await session.workspace.applyPatch({ proposalId: proposal.proposalId, changes });
+      const reviewedPatch = await session.inspectPatch();
+      const approvedPaths = [...new Set(changes.map((change) => change.path))].sort();
+      const reviewedPaths = reviewedPatch.entries.map((entry) => entry.path).sort();
+      if (JSON.stringify(reviewedPaths) !== JSON.stringify(approvedPaths)) {
+        throw new Error("The OCI patch does not match the approved edit paths; the host workspace was not changed.");
+      }
+      const verification = await session.runCommand(command, args, context);
+      if (verification.exitCode !== 0) {
+        throw new Error(`The approved verifier failed with exit code ${verification.exitCode}; the host workspace was not changed.`);
+      }
+      const afterVerification = await session.inspectPatch();
+      if (afterVerification.patchId !== reviewedPatch.patchId) {
+        throw new Error("The verifier changed the reviewed OCI patch; the host workspace was not changed.");
+      }
+      const imported = await session.importPatch(workspace, reviewedPatch.patchId);
+      return serializeJsonValue2({
+        schemaVersion: 1,
+        kind: "verified-reviewed-edit-import",
+        proposalId: proposal.proposalId,
+        patchId: reviewedPatch.patchId,
+        verification,
+        imported
+      });
+    }
   })
 });
 var estimateMessageTokens = (messages) => Math.max(1, Math.ceil(JSON.stringify(messages).length / 4));
@@ -3803,7 +5044,7 @@ var summarizeHarnessMessages = (messages) => {
     const parts = (record.parts ?? []).map((part) => {
       if (part.type === "text" && typeof part.text === "string") {
         const text = redaction.redactText(part.text).replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|api[_-]?key|access[_-]?token|password)\s*([=:])\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "$1$2[REDACTED]").replace(/\b(?:sk|ghp|gho|github_pat)-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\s+/g, " ").trim();
-        return text.length > 160 ? `${text.slice(0, 160)}\u2026` : text;
+        return text.length > 160 ? `${text.slice(0, 160)}…` : text;
       }
       if (part.type === "tool-call") {
         const call = part.toolCall;
@@ -3819,7 +5060,7 @@ var summarizeHarnessMessages = (messages) => {
   });
   const summary = summaries.join(`
 `);
-  return summary.length > 4000 ? `${summary.slice(0, 4000)}\u2026` : summary;
+  return summary.length > 4000 ? `${summary.slice(0, 4000)}…` : summary;
 };
 var compactHarnessMessages = (messages) => {
   if (messages.length === 0)
@@ -4024,6 +5265,272 @@ Available bounded delegations: ${config.orchestration.profiles.map((profile) =>
     }
   };
 };
+var canonicalJson = (value) => {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+};
+var localApprovalResolutionPayload = (inputDigest, approve, reason) => JSON.stringify({ inputDigest, approve, reason: reason ?? null });
+var terminalToolCallId = (runId, step, providerToolCallId, toolName2, input) => `tool_${createHash7("sha256").update(`${runId}\x00${step}\x00${providerToolCallId}\x00${toolName2}\x00${canonicalJson(input)}`).digest("hex")}`;
+var recoverableTerminalStaleDigest = (toolName2, message) => toolName2 === "verify_and_apply_reviewed_edits" && /^Stale patch rejected for .+\.$/.test(message);
+var executeTerminalReceiptTool = async (harness, waiting, approval, response) => {
+  if (approval.kind !== "local-tool" || response.provider !== approval.provider || response.approvalRequestId !== approval.id || !response.approve || !approval.toolCallId || approval.step === undefined) {
+    throw new Error("Terminal receipt finalization requires one matching approved local-tool request.");
+  }
+  const candidate = harness.agent.tools?.[approval.name];
+  if (!candidate || !("execute" in candidate)) {
+    throw new Error(`Approved terminal tool ${approval.name} is not locally callable.`);
+  }
+  const definition = candidate;
+  const parsedInput = definition.schema.parse(JSON.parse(approval.arguments));
+  const serializedInput = serializeJsonValue2(parsedInput);
+  const session = await harness.executionEnvironment?.acquire({
+    runId: waiting.state.runId,
+    ...waiting.state.agentId ? { agentId: waiting.state.agentId } : {},
+    ...waiting.state.scope ? { scope: waiting.state.scope } : {},
+    ...waiting.state.metadata ? { metadata: waiting.state.metadata } : {}
+  });
+  if (!session)
+    throw new Error("Terminal receipt finalization requires an active execution environment.");
+  const toolVersion = [
+    definition.approvalVersion,
+    `environment:${session.binding.fingerprint}`
+  ].filter(Boolean).join("|") || "1";
+  const inputDigest = createHash7("sha256").update(canonicalJson({
+    runId: waiting.state.runId,
+    step: approval.step,
+    toolCallId: approval.toolCallId,
+    toolName: approval.name,
+    input: serializedInput,
+    toolVersion
+  })).digest("hex");
+  if (approval.id !== `approval_${inputDigest}` || approval.inputDigest !== inputDigest || approval.toolVersion !== toolVersion || approval.arguments !== canonicalJson(serializedInput)) {
+    await session.release?.({ status: "failed", error: { message: "Approval binding mismatch." } });
+    throw new Error("The terminal tool approval is stale or does not match the current runtime binding.");
+  }
+  if (harness.agent.toolApprovalSigner) {
+    if (!approval.signature) {
+      await session.release?.({ status: "failed", error: { message: "Missing approval signature." } });
+      throw new Error("The terminal tool approval is missing its required signature.");
+    }
+    const valid = harness.agent.toolApprovalSigner.verify ? await harness.agent.toolApprovalSigner.verify(inputDigest, approval.signature) : await harness.agent.toolApprovalSigner.sign(inputDigest) === approval.signature;
+    if (!valid) {
+      await session.release?.({ status: "failed", error: { message: "Invalid approval signature." } });
+      throw new Error("The terminal tool approval signature is invalid.");
+    }
+  }
+  const toolCall = { id: approval.toolCallId, name: approval.name, input: serializedInput };
+  const context = {
+    runId: waiting.state.runId,
+    ...waiting.state.agentId ? { agentId: waiting.state.agentId } : {},
+    ...harness.agent.name ? { agentName: harness.agent.name } : {},
+    ...waiting.state.scope ? { scope: waiting.state.scope } : {},
+    ...waiting.state.metadata ? { metadata: waiting.state.metadata } : {},
+    executionEnvironment: session,
+    toolCall,
+    step: approval.step,
+    model: harness.agent.model,
+    idempotencyKey: `${waiting.state.runId}:${approval.toolCallId}`
+  };
+  const authorization = {
+    manifest: session.manifest,
+    binding: session.binding,
+    tool: definition,
+    toolCall,
+    input: parsedInput,
+    context,
+    phase: "execute"
+  };
+  const decision = await session.authorize(authorization);
+  if (decision.decision === "deny") {
+    await session.release?.({ status: "failed", error: { message: decision.reason } });
+    throw new Error(`Terminal tool execution was denied by the execution environment: ${decision.reason}`);
+  }
+  const resolutionSignature = harness.agent.toolApprovalSigner ? await harness.agent.toolApprovalSigner.sign(localApprovalResolutionPayload(inputDigest, response.approve, response.reason)) : undefined;
+  const durableId = terminalToolCallId(waiting.state.runId, approval.step, approval.toolCallId, approval.name, serializedInput);
+  const idempotencyKey = `${waiting.state.runId}:${durableId}`;
+  const journalCandidate = {
+    runId: waiting.state.runId,
+    ...waiting.state.scope ? { scope: waiting.state.scope } : {},
+    toolCallId: durableId,
+    toolName: approval.name,
+    status: "pending",
+    idempotencyKey,
+    revision: 0,
+    input: serializedInput,
+    updatedAt: Date.now()
+  };
+  const journal = harness.store.claimToolExecution ? await harness.store.claimToolExecution(journalCandidate) : undefined;
+  let output;
+  try {
+    if (journal && !journal.claimed) {
+      if (journal.entry.status === "completed") {
+        output = journal.entry.output ?? null;
+      } else if (journal.entry.status === "failed") {
+        throw new Error(journal.entry.error?.message ?? `Tool "${approval.name}" previously failed.`);
+      } else {
+        throw new Error(`Tool "${approval.name}" has an indeterminate durable execution.`);
+      }
+    } else {
+      output = serializeJsonValue2(await session.execute(authorization, () => definition.execute(parsedInput, { ...context, idempotencyKey })));
+      if (journal?.claimed && harness.store.completeToolExecution) {
+        await harness.store.completeToolExecution({
+          ...journal.entry,
+          status: "completed",
+          output,
+          completedAt: Date.now(),
+          updatedAt: Date.now()
+        }, { expectedRevision: journal.entry.revision });
+      }
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (journal?.claimed && harness.store.completeToolExecution) {
+      await Promise.resolve(harness.store.completeToolExecution({
+        ...journal.entry,
+        status: "failed",
+        error: { message },
+        completedAt: Date.now(),
+        updatedAt: Date.now()
+      }, { expectedRevision: journal.entry.revision })).catch(() => {
+        return;
+      });
+    }
+    await session.release?.({
+      status: "failed",
+      error: { message }
+    });
+    if (!recoverableTerminalStaleDigest(approval.name, message))
+      throw error;
+    const now2 = Date.now();
+    const toolResult2 = {
+      toolCallId: approval.toolCallId,
+      toolName: approval.name,
+      error: { message },
+      isError: true
+    };
+    const messages2 = [
+      ...waiting.messages,
+      { role: "tool", parts: [{ type: "tool-result", toolResult: toolResult2 }] }
+    ];
+    const steps2 = waiting.steps.map((step) => step.index === approval.step ? {
+      ...step,
+      status: "completed",
+      finishedAt: now2,
+      toolResults: [...step.toolResults, toolResult2]
+    } : step);
+    const previousRevision2 = waiting.state.revision ?? 0;
+    const {
+      finalOutput: _finalOutput,
+      finishReason: _finishReason,
+      providerFinishReason: _providerFinishReason,
+      error: _stateError,
+      ...resumableState
+    } = waiting.state;
+    const state2 = {
+      ...resumableState,
+      revision: previousRevision2 + 1,
+      status: "running",
+      messages: messages2,
+      steps: steps2,
+      toolResults: [...waiting.toolResults, toolResult2],
+      pendingApprovals: [],
+      approvalHistory: [
+        ...waiting.state.approvalHistory ?? [],
+        {
+          requestId: approval.id,
+          kind: "local-tool",
+          provider: approval.provider,
+          approve: true,
+          ...response.reason ? { reason: response.reason } : {},
+          toolCallId: approval.toolCallId,
+          step: approval.step,
+          inputDigest,
+          toolVersion,
+          ...resolutionSignature ? { signature: resolutionSignature } : {},
+          resolvedAt: now2
+        }
+      ],
+      updatedAt: now2
+    };
+    await harness.store.save(state2, { expectedRevision: previousRevision2 });
+    return {
+      status: "running",
+      outputText: state2.outputText,
+      ...waiting.usage ? { usage: waiting.usage } : {},
+      messages: messages2,
+      steps: steps2,
+      toolResults: state2.toolResults,
+      state: state2
+    };
+  }
+  const now = Date.now();
+  const toolResult = {
+    toolCallId: approval.toolCallId,
+    toolName: approval.name,
+    output,
+    isError: false
+  };
+  const messages = [
+    ...waiting.messages,
+    { role: "tool", parts: [{ type: "tool-result", toolResult }] }
+  ];
+  const steps = waiting.steps.map((step) => step.index === approval.step ? {
+    ...step,
+    status: "completed",
+    finishedAt: now,
+    toolResults: [...step.toolResults, toolResult]
+  } : step);
+  const outputText = canonicalJson(output);
+  const previousRevision = waiting.state.revision ?? 0;
+  const state = {
+    ...waiting.state,
+    revision: previousRevision + 1,
+    status: "completed",
+    messages,
+    steps,
+    toolResults: [...waiting.toolResults, toolResult],
+    outputText,
+    finalOutput: output,
+    finishReason: "stop",
+    providerFinishReason: "terminal-tool-receipt",
+    pendingApprovals: [],
+    approvalHistory: [
+      ...waiting.state.approvalHistory ?? [],
+      {
+        requestId: approval.id,
+        kind: "local-tool",
+        provider: approval.provider,
+        approve: true,
+        ...response.reason ? { reason: response.reason } : {},
+        toolCallId: approval.toolCallId,
+        step: approval.step,
+        inputDigest,
+        toolVersion,
+        ...resolutionSignature ? { signature: resolutionSignature } : {},
+        resolvedAt: now
+      }
+    ],
+    updatedAt: now
+  };
+  await harness.store.save(state, { expectedRevision: previousRevision });
+  await session.release?.({ status: "completed" });
+  return {
+    status: "completed",
+    outputText,
+    finalOutput: output,
+    finishReason: "stop",
+    providerFinishReason: "terminal-tool-receipt",
+    ...waiting.usage ? { usage: waiting.usage } : {},
+    messages,
+    steps,
+    toolResults: state.toolResults,
+    state
+  };
+};
 var runHarness = async (harness, input, options = {}) => {
   let nextInput = input;
   const continuationOptions = {
@@ -4064,6 +5571,17 @@ var runHarness = async (harness, input, options = {}) => {
     if (!approvals) {
       return result;
     }
+    const terminalTools = new Set(options.terminalReceiptTools ?? []);
+    if (result.state.pendingApprovals.length === 1 && approvals.length === 1 && approvals[0]?.approve === true && terminalTools.has(result.state.pendingApprovals[0].name)) {
+      const terminalResult = await executeTerminalReceiptTool(harness, result, result.state.pendingApprovals[0], approvals[0]);
+      if (terminalResult.status === "completed")
+        return terminalResult;
+      nextInput = {
+        ...continuationOptions,
+        state: terminalResult.state
+      };
+      continue;
+    }
     nextInput = {
       ...continuationOptions,
       state: result.state,
@@ -4251,11 +5769,10 @@ var streamResultDocument = (result, sequence = 0) => {
 var serializeStreamResult = (result, sequence = 0) => JSON.stringify(streamResultDocument(result, sequence));
 
 // src/sessions.ts
-import { createHash as createHash8, randomUUID as randomUUID4 } from "crypto";
-import { chmod as chmod3, lstat as lstat6, mkdir as mkdir4, open as open3, realpath as realpath4, stat as stat3 } from "fs/promises";
-import path8 from "path";
+import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
+import { chmod as chmod3, lstat as lstat7, mkdir as mkdir4, open as open3, realpath as realpath4, stat as stat3 } from "node:fs/promises";
+import path9 from "node:path";
 import { createRedactionPolicy as createRedactionPolicy3 } from "@zhivex-ai/agents";
-import { Database as Database2 } from "bun:sqlite";
 var HARNESS_SESSION_INDEX_FILE = "operations.sqlite";
 var HARNESS_SESSION_SCHEMA_VERSION = 1;
 var SESSION_RUN_STATUSES = [
@@ -4359,19 +5876,19 @@ var sessionId = () => `ses_${randomUUID4()}`;
 var turnId = () => `turn_${randomUUID4()}`;
 var isMissing = (error) => error.code === "ENOENT";
 var ensurePrivateDatabase = async (workspace, stateDirectory) => {
-  const requestedStateDirectory = path8.resolve(stateDirectory);
+  const requestedStateDirectory = path9.resolve(stateDirectory);
   await validateStateDirectory(workspace, requestedStateDirectory);
   await mkdir4(requestedStateDirectory, { recursive: true, mode: 448 });
-  const directoryEntry = await lstat6(requestedStateDirectory);
+  const directoryEntry = await lstat7(requestedStateDirectory);
   if (directoryEntry.isSymbolicLink() || !directoryEntry.isDirectory()) {
     throw new Error(`The session state directory must be a real directory: ${requestedStateDirectory}.`);
   }
   await chmod3(requestedStateDirectory, 448);
   const canonicalStateDirectory2 = await realpath4(requestedStateDirectory);
-  const databasePath = path8.join(canonicalStateDirectory2, HARNESS_SESSION_INDEX_FILE);
+  const databasePath = path9.join(canonicalStateDirectory2, HARNESS_SESSION_INDEX_FILE);
   let databaseEntry;
   try {
-    databaseEntry = await lstat6(databasePath);
+    databaseEntry = await lstat7(databasePath);
   } catch (error) {
     if (!isMissing(error)) {
       throw error;
@@ -4384,7 +5901,7 @@ var ensurePrivateDatabase = async (workspace, stateDirectory) => {
         throw creationError;
       }
     }
-    databaseEntry = await lstat6(databasePath);
+    databaseEntry = await lstat7(databasePath);
   }
   if (databaseEntry.isSymbolicLink() || !databaseEntry.isFile()) {
     throw new Error(`The session SQLite path must be a real file: ${databasePath}.`);
@@ -4408,7 +5925,7 @@ var toRunReference = (row) => ({
 var metadataSize = (input) => Object.values(input).reduce((total, value) => total + (typeof value === "string" ? byteLength(value) : 0), 0);
 var isTerminal = (status) => TERMINAL_STATUSES2.has(status);
 var openCliSessionStore = async (options) => {
-  const workspace = await realpath4(path8.resolve(options.workspace));
+  const workspace = await realpath4(path9.resolve(options.workspace));
   const workspaceEntry = await stat3(workspace);
   if (!workspaceEntry.isDirectory()) {
     throw new Error(`The session workspace is not a directory: ${workspace}.`);
@@ -4423,7 +5940,7 @@ var openCliSessionStore = async (options) => {
   const maxIndexBytes = boundedInteger("maxIndexBytes", options.maxIndexBytes, DEFAULT_MAX_INDEX_BYTES, 1024);
   const now = options.now ?? Date.now;
   const { databasePath, databaseEntry } = await ensurePrivateDatabase(workspace, options.stateDirectory);
-  const database = new Database2(databasePath, { create: false, strict: true });
+  const database = new SqliteDatabase(databasePath, { create: false, strict: true });
   let closed = false;
   const assertOpen = () => {
     if (closed) {
@@ -4543,7 +6060,7 @@ var openCliSessionStore = async (options) => {
     `).run(candidateTurnId, sourceTurnId ?? null, candidateSessionId, sequence, runId, provider, model, role, status, createdAt, isTerminal(status) ? createdAt : null, entryBytes);
   };
   try {
-    const openedEntry = await lstat6(databasePath);
+    const openedEntry = await lstat7(databasePath);
     if (openedEntry.isSymbolicLink() || !openedEntry.isFile() || openedEntry.dev !== databaseEntry.dev || openedEntry.ino !== databaseEntry.ino) {
       throw new Error(`The session SQLite path changed while it was being opened: ${databasePath}.`);
     }
@@ -4901,6 +6418,512 @@ var openCliSessionStore = async (options) => {
 };
 var openSessionStore = openCliSessionStore;
 
+// src/change-envelope.ts
+import { createHash as createHash9 } from "node:crypto";
+import { z as z4 } from "zod";
+var CHANGE_ENVELOPE_SCHEMA_VERSION = 1;
+var CHANGE_ENVELOPE_DIGEST_ALGORITHM = "sha256";
+var MAX_CHANGE_ENVELOPE_CHECKS = 100;
+var MAX_CHANGE_ENVELOPE_APPROVALS = 100;
+var MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES = 32;
+var MAX_CHANGE_ENVELOPE_ATTESTATIONS = 32;
+var timestampSchema = z4.iso.datetime({ precision: 3 });
+var boundedIdentifierSchema = z4.string().min(1).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/, "Identifier must contain only bounded non-secret token characters.");
+var approvalScopeSchema = z4.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:/*-]*$/, "Approval scope must contain only bounded token characters.");
+var attestationFormatSchema = z4.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9.+_-]*$/);
+var mediaTypeSchema = z4.string().min(3).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*$/);
+var addDuplicateIssues = (values, key, context, path10) => {
+  const seen = new Set;
+  for (let index = 0;index < values.length; index += 1) {
+    const value = values[index];
+    if (value === undefined)
+      continue;
+    const identifier2 = key(value);
+    if (seen.has(identifier2)) {
+      context.addIssue({
+        code: "custom",
+        path: [index, path10],
+        message: `Duplicate ${path10}: ${identifier2}.`
+      });
+    }
+    seen.add(identifier2);
+  }
+};
+var addCanonicalOrderIssue = (values, key, context, path10) => {
+  for (let index = 1;index < values.length; index += 1) {
+    const previous = values[index - 1];
+    const current = values[index];
+    if (previous !== undefined && current !== undefined && key(previous) >= key(current)) {
+      context.addIssue({
+        code: "custom",
+        path: [index, path10],
+        message: `${path10} entries must be unique and in canonical ascending order.`
+      });
+    }
+  }
+};
+var approvalScopesInputSchema = z4.array(approvalScopeSchema).min(1).max(MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES).superRefine((scopes, context) => addDuplicateIssues(scopes, (scope) => scope, context, "scope"));
+var canonicalApprovalScopesSchema = z4.array(approvalScopeSchema).min(1).max(MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES).superRefine((scopes, context) => addCanonicalOrderIssue(scopes, (scope) => scope, context, "scope"));
+var changeEnvelopeCheckSchema = z4.strictObject({
+  checkId: boundedIdentifierSchema,
+  status: z4.enum(["passed", "failed", "skipped"]),
+  redacted: z4.literal(true),
+  startedAt: timestampSchema,
+  completedAt: timestampSchema,
+  durationMs: z4.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  exitCode: z4.number().int().min(0).max(255).optional(),
+  redactedOutputDigest: fileDigestSchema.optional(),
+  runnerFingerprint: fileDigestSchema.optional()
+}).superRefine((check, context) => {
+  const startedAt = Date.parse(check.startedAt);
+  const completedAt = Date.parse(check.completedAt);
+  if (completedAt < startedAt) {
+    context.addIssue({
+      code: "custom",
+      path: ["completedAt"],
+      message: "Check completion cannot precede its start."
+    });
+  }
+  if (check.status === "passed" && check.exitCode !== undefined && check.exitCode !== 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["exitCode"],
+      message: "A passed check cannot have a non-zero exit code."
+    });
+  }
+  if (check.status === "failed" && check.exitCode === 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["exitCode"],
+      message: "A failed check cannot have a zero exit code."
+    });
+  }
+  if (check.status === "skipped" && check.exitCode !== undefined) {
+    context.addIssue({
+      code: "custom",
+      path: ["exitCode"],
+      message: "A skipped check cannot have an exit code."
+    });
+  }
+});
+var checkInputListSchema = z4.array(changeEnvelopeCheckSchema).min(1).max(MAX_CHANGE_ENVELOPE_CHECKS).superRefine((checks, context) => addDuplicateIssues(checks, (check) => check.checkId, context, "checkId"));
+var canonicalCheckListSchema = z4.array(changeEnvelopeCheckSchema).min(1).max(MAX_CHANGE_ENVELOPE_CHECKS).superRefine((checks, context) => addCanonicalOrderIssue(checks, (check) => check.checkId, context, "checkId"));
+var changeEnvelopeApprovalSchema = z4.strictObject({
+  kind: z4.literal("approval-reference"),
+  approvalId: boundedIdentifierSchema,
+  approvalDigest: fileDigestSchema,
+  approverDigest: fileDigestSchema,
+  scopes: canonicalApprovalScopesSchema,
+  approvedAt: timestampSchema,
+  expiresAt: timestampSchema.optional()
+}).superRefine((approval, context) => {
+  if (approval.expiresAt && Date.parse(approval.expiresAt) <= Date.parse(approval.approvedAt)) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAt"],
+      message: "Approval expiry must be later than approval time."
+    });
+  }
+});
+var changeEnvelopeApprovalInputSchema = z4.strictObject({
+  kind: z4.literal("approval-reference"),
+  approvalId: boundedIdentifierSchema,
+  approvalDigest: fileDigestSchema,
+  approverDigest: fileDigestSchema,
+  scopes: approvalScopesInputSchema,
+  approvedAt: timestampSchema,
+  expiresAt: timestampSchema.optional()
+}).superRefine((approval, context) => {
+  if (approval.expiresAt && Date.parse(approval.expiresAt) <= Date.parse(approval.approvedAt)) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAt"],
+      message: "Approval expiry must be later than approval time."
+    });
+  }
+});
+var approvalInputListSchema = z4.array(changeEnvelopeApprovalInputSchema).min(1).max(MAX_CHANGE_ENVELOPE_APPROVALS).superRefine((approvals, context) => addDuplicateIssues(approvals, (approval) => approval.approvalId, context, "approvalId"));
+var canonicalApprovalListSchema = z4.array(changeEnvelopeApprovalSchema).min(1).max(MAX_CHANGE_ENVELOPE_APPROVALS).superRefine((approvals, context) => addCanonicalOrderIssue(approvals, (approval) => approval.approvalId, context, "approvalId"));
+var externalAttestationReferenceSchema = z4.strictObject({
+  kind: z4.literal("external-attestation-reference"),
+  attestationId: boundedIdentifierSchema,
+  format: attestationFormatSchema,
+  mediaType: mediaTypeSchema,
+  bundleDigest: fileDigestSchema
+});
+var externalAttestationInputListSchema = z4.array(externalAttestationReferenceSchema).min(1).max(MAX_CHANGE_ENVELOPE_ATTESTATIONS).superRefine((attestations, context) => addDuplicateIssues(attestations, (attestation) => attestation.attestationId, context, "attestationId"));
+var canonicalExternalAttestationListSchema = z4.array(externalAttestationReferenceSchema).min(1).max(MAX_CHANGE_ENVELOPE_ATTESTATIONS).superRefine((attestations, context) => addCanonicalOrderIssue(attestations, (attestation) => attestation.attestationId, context, "attestationId"));
+var changeEnvelopeBaseSchema = z4.strictObject({
+  workspaceDigest: fileDigestSchema,
+  treeDigest: fileDigestSchema
+});
+var changeEnvelopePatchSchema = z4.strictObject({
+  patchId: boundedIdentifierSchema,
+  patchDigest: fileDigestSchema
+});
+var changeEnvelopeFingerprintsSchema = z4.strictObject({
+  harness: fileDigestSchema,
+  policy: fileDigestSchema,
+  environment: fileDigestSchema
+});
+var changeEnvelopeEvidenceSchema = z4.strictObject({
+  schemaVersion: z4.literal(CHANGE_ENVELOPE_SCHEMA_VERSION),
+  kind: z4.literal("check-evidence-summary"),
+  digestAlgorithm: z4.literal(CHANGE_ENVELOPE_DIGEST_ALGORITHM),
+  evidenceDigest: fileDigestSchema,
+  checks: canonicalCheckListSchema
+});
+var changeEnvelopeInputSchema = z4.strictObject({
+  createdAt: timestampSchema,
+  expiresAt: timestampSchema.optional(),
+  base: changeEnvelopeBaseSchema,
+  patch: changeEnvelopePatchSchema,
+  fingerprints: changeEnvelopeFingerprintsSchema,
+  checks: checkInputListSchema,
+  approvals: approvalInputListSchema.optional(),
+  externalAttestations: externalAttestationInputListSchema.optional()
+});
+var changeEnvelopeSchema = z4.strictObject({
+  schemaVersion: z4.literal(CHANGE_ENVELOPE_SCHEMA_VERSION),
+  kind: z4.literal("change-envelope"),
+  digestAlgorithm: z4.literal(CHANGE_ENVELOPE_DIGEST_ALGORITHM),
+  envelopeId: fileDigestSchema,
+  createdAt: timestampSchema,
+  expiresAt: timestampSchema.optional(),
+  base: changeEnvelopeBaseSchema,
+  patch: changeEnvelopePatchSchema,
+  fingerprints: changeEnvelopeFingerprintsSchema,
+  evidence: changeEnvelopeEvidenceSchema,
+  approvals: canonicalApprovalListSchema.optional(),
+  externalAttestations: canonicalExternalAttestationListSchema.optional()
+}).superRefine((envelope, context) => {
+  if (envelope.expiresAt && Date.parse(envelope.expiresAt) <= Date.parse(envelope.createdAt)) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAt"],
+      message: "Envelope expiry must be later than creation time."
+    });
+  }
+  for (let index = 0;index < envelope.evidence.checks.length; index += 1) {
+    const check = envelope.evidence.checks[index];
+    if (check && Date.parse(check.completedAt) > Date.parse(envelope.createdAt)) {
+      context.addIssue({
+        code: "custom",
+        path: ["evidence", "checks", index, "completedAt"],
+        message: "Check completion cannot be later than envelope creation time."
+      });
+    }
+  }
+  for (let index = 0;index < (envelope.approvals?.length ?? 0); index += 1) {
+    const approval = envelope.approvals?.[index];
+    if (approval && Date.parse(approval.approvedAt) > Date.parse(envelope.createdAt)) {
+      context.addIssue({
+        code: "custom",
+        path: ["approvals", index, "approvedAt"],
+        message: "Approval time cannot be later than envelope creation time."
+      });
+    }
+  }
+});
+var canonicalJson2 = (value) => {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new TypeError("Canonical JSON cannot encode a non-finite number.");
+    return JSON.stringify(Object.is(value, -0) ? 0 : value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => canonicalJson2(entry)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson2(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`Canonical JSON cannot encode ${typeof value}.`);
+};
+var digestCanonical = (value) => `sha256:${createHash9("sha256").update(canonicalJson2(value)).digest("hex")}`;
+var digestChangeEnvelopeArtifact = (value) => `sha256:${createHash9("sha256").update(value).digest("hex")}`;
+var evidencePayload = (checks) => ({
+  schemaVersion: CHANGE_ENVELOPE_SCHEMA_VERSION,
+  kind: "check-evidence-summary",
+  digestAlgorithm: CHANGE_ENVELOPE_DIGEST_ALGORITHM,
+  checks: [...checks]
+});
+var envelopePayload = (envelope) => {
+  const { envelopeId: _envelopeId, ...payload } = envelope;
+  return payload;
+};
+var sortBy = (values, key) => [...values].sort((left, right) => {
+  const leftKey = key(left);
+  const rightKey = key(right);
+  return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+});
+var createChangeEnvelope = (input) => {
+  const parsed = changeEnvelopeInputSchema.parse(input);
+  const checks = sortBy(parsed.checks, (check) => check.checkId);
+  const evidenceWithoutDigest = evidencePayload(checks);
+  const evidence = {
+    ...evidenceWithoutDigest,
+    evidenceDigest: digestCanonical(evidenceWithoutDigest)
+  };
+  const approvals = parsed.approvals ? sortBy(parsed.approvals, (approval) => approval.approvalId).map((approval) => ({
+    ...approval,
+    scopes: [...approval.scopes].sort()
+  })) : undefined;
+  const externalAttestations = parsed.externalAttestations ? sortBy(parsed.externalAttestations, (attestation) => attestation.attestationId) : undefined;
+  const payload = {
+    schemaVersion: CHANGE_ENVELOPE_SCHEMA_VERSION,
+    kind: "change-envelope",
+    digestAlgorithm: CHANGE_ENVELOPE_DIGEST_ALGORITHM,
+    createdAt: parsed.createdAt,
+    ...parsed.expiresAt ? { expiresAt: parsed.expiresAt } : {},
+    base: parsed.base,
+    patch: parsed.patch,
+    fingerprints: parsed.fingerprints,
+    evidence,
+    ...approvals ? { approvals } : {},
+    ...externalAttestations ? { externalAttestations } : {}
+  };
+  return changeEnvelopeSchema.parse({
+    ...payload,
+    envelopeId: digestCanonical(payload)
+  });
+};
+var canonicalizeChangeEnvelope = (input) => canonicalJson2(changeEnvelopeSchema.parse(input));
+var computeChangeEnvelopeDigest = (input) => {
+  const parsed = changeEnvelopeSchema.parse(input);
+  return digestCanonical(envelopePayload(parsed));
+};
+var computeChangeEnvelopeEvidenceDigest = (input) => {
+  const parsed = changeEnvelopeEvidenceSchema.parse(input);
+  return digestCanonical(evidencePayload(parsed.checks));
+};
+var changeEnvelopePreconditionsSchema = z4.strictObject({
+  envelopeId: fileDigestSchema.optional(),
+  baseWorkspaceDigest: fileDigestSchema.optional(),
+  baseTreeDigest: fileDigestSchema.optional(),
+  patchId: boundedIdentifierSchema.optional(),
+  patchDigest: fileDigestSchema.optional(),
+  harnessFingerprint: fileDigestSchema.optional(),
+  policyFingerprint: fileDigestSchema.optional(),
+  environmentFingerprint: fileDigestSchema.optional(),
+  evidenceDigest: fileDigestSchema.optional(),
+  requiredPassedChecks: z4.array(boundedIdentifierSchema).max(MAX_CHANGE_ENVELOPE_CHECKS).optional(),
+  requiredApprovalDigests: z4.array(fileDigestSchema).max(MAX_CHANGE_ENVELOPE_APPROVALS).optional(),
+  requiredApprovalScopes: z4.array(approvalScopeSchema).max(MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES).optional(),
+  requiredAttestationDigests: z4.array(fileDigestSchema).max(MAX_CHANGE_ENVELOPE_ATTESTATIONS).optional()
+}).superRefine((preconditions, context) => {
+  if (preconditions.requiredPassedChecks) {
+    addDuplicateIssues(preconditions.requiredPassedChecks, (checkId) => checkId, context, "requiredPassedCheck");
+  }
+  if (preconditions.requiredApprovalDigests) {
+    addDuplicateIssues(preconditions.requiredApprovalDigests, (digest3) => digest3, context, "requiredApprovalDigest");
+  }
+  if (preconditions.requiredApprovalScopes) {
+    addDuplicateIssues(preconditions.requiredApprovalScopes, (scope) => scope, context, "requiredApprovalScope");
+  }
+  if (preconditions.requiredAttestationDigests) {
+    addDuplicateIssues(preconditions.requiredAttestationDigests, (digest3) => digest3, context, "requiredAttestationDigest");
+  }
+});
+var verificationOptionsSchema = z4.strictObject({
+  now: z4.union([z4.date(), z4.number().int(), timestampSchema]).optional(),
+  preconditions: changeEnvelopePreconditionsSchema.optional()
+});
+var verificationTime = (value) => {
+  const date = value === undefined ? new Date : value instanceof Date ? value : new Date(value);
+  if (!Number.isFinite(date.getTime()))
+    throw new TypeError("Verification time must be a valid date.");
+  return date;
+};
+var verifyChangeEnvelope = (input, options = {}) => {
+  const parsedOptions = verificationOptionsSchema.parse(options);
+  const now = verificationTime(parsedOptions.now);
+  const checkedAt = now.toISOString();
+  const parsedEnvelope = changeEnvelopeSchema.safeParse(input);
+  if (!parsedEnvelope.success) {
+    return {
+      valid: false,
+      verificationScope: "integrity-expiration-and-preconditions-only",
+      issues: parsedEnvelope.error.issues.map((issue) => ({
+        code: "invalid-schema",
+        path: issue.path.map((segment) => typeof segment === "symbol" ? segment.description ?? "symbol" : segment),
+        message: issue.message
+      })),
+      integrity: { envelopeDigestValid: false, evidenceDigestValid: false },
+      expiration: { checkedAt, envelopeNotYetValid: false, envelopeExpired: false, expiredApprovalIds: [] },
+      checks: {
+        recorded: 0,
+        passed: [],
+        failed: [],
+        skipped: [],
+        requiredPassed: [...parsedOptions.preconditions?.requiredPassedChecks ?? []].sort(),
+        missingPassed: [...parsedOptions.preconditions?.requiredPassedChecks ?? []].sort()
+      },
+      approvals: {
+        recorded: 0,
+        requiredScopes: [...parsedOptions.preconditions?.requiredApprovalScopes ?? []].sort(),
+        missingScopes: [...parsedOptions.preconditions?.requiredApprovalScopes ?? []].sort(),
+        authenticity: "not-verified"
+      },
+      externalAttestations: {
+        referenced: 0,
+        requiredDigests: [...parsedOptions.preconditions?.requiredAttestationDigests ?? []].sort(),
+        missingDigests: [...parsedOptions.preconditions?.requiredAttestationDigests ?? []].sort(),
+        authenticity: "not-verified"
+      }
+    };
+  }
+  const envelope = parsedEnvelope.data;
+  const issues = [];
+  const computedEvidenceDigest = digestCanonical(evidencePayload(envelope.evidence.checks));
+  const evidenceDigestValid = computedEvidenceDigest === envelope.evidence.evidenceDigest;
+  if (!evidenceDigestValid) {
+    issues.push({
+      code: "evidence-digest-mismatch",
+      path: ["evidence", "evidenceDigest"],
+      message: "Evidence digest does not match the canonical redacted check summary.",
+      expected: computedEvidenceDigest,
+      actual: envelope.evidence.evidenceDigest
+    });
+  }
+  const computedEnvelopeDigest = digestCanonical(envelopePayload(envelope));
+  const envelopeDigestValid = computedEnvelopeDigest === envelope.envelopeId;
+  if (!envelopeDigestValid) {
+    issues.push({
+      code: "envelope-digest-mismatch",
+      path: ["envelopeId"],
+      message: "Envelope digest does not match its canonical payload.",
+      expected: computedEnvelopeDigest,
+      actual: envelope.envelopeId
+    });
+  }
+  const envelopeNotYetValid = now.getTime() < Date.parse(envelope.createdAt);
+  if (envelopeNotYetValid) {
+    issues.push({
+      code: "envelope-not-yet-valid",
+      path: ["createdAt"],
+      message: "Change envelope creation time is in the future."
+    });
+  }
+  const envelopeExpired = envelope.expiresAt !== undefined && now.getTime() >= Date.parse(envelope.expiresAt);
+  if (envelopeExpired) {
+    issues.push({
+      code: "envelope-expired",
+      path: ["expiresAt"],
+      message: "Change envelope has expired."
+    });
+  }
+  const expiredApprovalIds = (envelope.approvals ?? []).filter((approval) => approval.expiresAt !== undefined && now.getTime() >= Date.parse(approval.expiresAt)).map((approval) => approval.approvalId);
+  for (const approvalId of expiredApprovalIds) {
+    issues.push({
+      code: "approval-expired",
+      path: ["approvals", envelope.approvals?.findIndex((approval) => approval.approvalId === approvalId) ?? 0, "expiresAt"],
+      message: `Recorded approval has expired: ${approvalId}.`
+    });
+  }
+  const preconditions = parsedOptions.preconditions;
+  const comparePrecondition = (field, expected, actual, path10) => {
+    if (expected !== undefined && expected !== actual) {
+      issues.push({
+        code: "precondition-mismatch",
+        path: path10,
+        message: `Change envelope precondition does not match: ${field}.`,
+        expected,
+        actual
+      });
+    }
+  };
+  comparePrecondition("envelopeId", preconditions?.envelopeId, envelope.envelopeId, ["envelopeId"]);
+  comparePrecondition("baseWorkspaceDigest", preconditions?.baseWorkspaceDigest, envelope.base.workspaceDigest, ["base", "workspaceDigest"]);
+  comparePrecondition("baseTreeDigest", preconditions?.baseTreeDigest, envelope.base.treeDigest, ["base", "treeDigest"]);
+  comparePrecondition("patchId", preconditions?.patchId, envelope.patch.patchId, ["patch", "patchId"]);
+  comparePrecondition("patchDigest", preconditions?.patchDigest, envelope.patch.patchDigest, ["patch", "patchDigest"]);
+  comparePrecondition("harnessFingerprint", preconditions?.harnessFingerprint, envelope.fingerprints.harness, ["fingerprints", "harness"]);
+  comparePrecondition("policyFingerprint", preconditions?.policyFingerprint, envelope.fingerprints.policy, ["fingerprints", "policy"]);
+  comparePrecondition("environmentFingerprint", preconditions?.environmentFingerprint, envelope.fingerprints.environment, ["fingerprints", "environment"]);
+  comparePrecondition("evidenceDigest", preconditions?.evidenceDigest, envelope.evidence.evidenceDigest, ["evidence", "evidenceDigest"]);
+  const passedChecks = envelope.evidence.checks.filter((check) => check.status === "passed").map((check) => check.checkId);
+  const failedChecks = envelope.evidence.checks.filter((check) => check.status === "failed").map((check) => check.checkId);
+  const skippedChecks = envelope.evidence.checks.filter((check) => check.status === "skipped").map((check) => check.checkId);
+  const passedCheckSet = new Set(passedChecks);
+  const requiredPassed = [...preconditions?.requiredPassedChecks ?? []].sort();
+  const missingPassed = requiredPassed.filter((checkId) => !passedCheckSet.has(checkId));
+  for (const checkId of missingPassed) {
+    issues.push({
+      code: "missing-passed-check",
+      path: ["evidence", "checks"],
+      message: `Required passed check is not recorded: ${checkId}.`,
+      expected: checkId
+    });
+  }
+  const expiredApprovals = new Set(expiredApprovalIds);
+  const activeApprovals = (envelope.approvals ?? []).filter((approval) => !expiredApprovals.has(approval.approvalId));
+  const approvalDigests = new Set(activeApprovals.map((approval) => approval.approvalDigest));
+  for (const requiredDigest of preconditions?.requiredApprovalDigests ?? []) {
+    if (!approvalDigests.has(requiredDigest)) {
+      issues.push({
+        code: "missing-approval-digest",
+        path: ["approvals"],
+        message: `Required active approval digest is not recorded: ${requiredDigest}.`,
+        expected: requiredDigest
+      });
+    }
+  }
+  const approvedScopes = new Set(activeApprovals.flatMap((approval) => approval.scopes));
+  const requiredScopes = [...preconditions?.requiredApprovalScopes ?? []].sort();
+  const missingScopes = requiredScopes.filter((scope) => !approvedScopes.has(scope));
+  for (const scope of missingScopes) {
+    issues.push({
+      code: "missing-approval-scope",
+      path: ["approvals"],
+      message: `Required active approval scope is not recorded: ${scope}.`,
+      expected: scope
+    });
+  }
+  const attestationDigests = new Set((envelope.externalAttestations ?? []).map((attestation) => attestation.bundleDigest));
+  const requiredAttestationDigests = [...preconditions?.requiredAttestationDigests ?? []].sort();
+  const missingAttestationDigests = requiredAttestationDigests.filter((digest3) => !attestationDigests.has(digest3));
+  for (const requiredDigest of missingAttestationDigests) {
+    issues.push({
+      code: "missing-attestation-digest",
+      path: ["externalAttestations"],
+      message: `Required external attestation digest is not referenced: ${requiredDigest}.`,
+      expected: requiredDigest
+    });
+  }
+  return {
+    valid: issues.length === 0,
+    verificationScope: "integrity-expiration-and-preconditions-only",
+    envelope,
+    issues,
+    integrity: { envelopeDigestValid, evidenceDigestValid },
+    expiration: { checkedAt, envelopeNotYetValid, envelopeExpired, expiredApprovalIds },
+    checks: {
+      recorded: envelope.evidence.checks.length,
+      passed: passedChecks,
+      failed: failedChecks,
+      skipped: skippedChecks,
+      requiredPassed,
+      missingPassed
+    },
+    approvals: {
+      recorded: envelope.approvals?.length ?? 0,
+      requiredScopes,
+      missingScopes,
+      authenticity: "not-verified"
+    },
+    externalAttestations: {
+      referenced: envelope.externalAttestations?.length ?? 0,
+      requiredDigests: requiredAttestationDigests,
+      missingDigests: missingAttestationDigests,
+      authenticity: "not-verified"
+    }
+  };
+};
+
 // src/cli.ts
 var HARNESS_RESUME_METADATA_KEY = "zhivexHarnessResume";
 var HARNESS_RESUME_METADATA_SCHEMA_VERSION = 1;
@@ -4910,9 +6933,11 @@ var CLI_EXIT_CODES = {
   usageError: 2,
   doctorFailed: 3
 };
-var COMMANDS = new Set(["run", "review", "chat", "providers", "doctor", "resume", "runs", "sessions", "help", "version"]);
+var COMMANDS = new Set(["run", "review", "chat", "providers", "doctor", "resume", "runs", "sessions", "changes", "help", "version"]);
 var RUNS_COMMANDS = new Set(["list", "inspect", "cancel", "cleanup", "export"]);
 var SESSIONS_COMMANDS = new Set(["list", "inspect", "rename", "fork", "archive"]);
+var CHANGES_COMMANDS = new Set(["create", "verify"]);
+var CLI_TIMESTAMP_SCHEMA = z5.iso.datetime({ precision: 3 });
 var RUN_STATUSES = new Set([
   "queued",
   "running",
@@ -5132,6 +7157,23 @@ var parseCliArgs = (argv) => {
         options.mcpConfigPath = optionValue(argv, index, argument);
         index += 1;
         break;
+      case "--patch":
+        options.patchPath = optionValue(argv, index, argument);
+        index += 1;
+        break;
+      case "--preconditions":
+        options.preconditionsPath = optionValue(argv, index, argument);
+        index += 1;
+        break;
+      case "--now": {
+        const value = optionValue(argv, index, argument);
+        if (!CLI_TIMESTAMP_SCHEMA.safeParse(value).success) {
+          throw new CliUsageError("--now must be a millisecond-precision ISO-8601 UTC timestamp.");
+        }
+        options.verificationTime = value;
+        index += 1;
+        break;
+      }
       case "--execution":
         options.executionBackend = optionValue(argv, index, argument);
         index += 1;
@@ -5424,6 +7466,9 @@ var parseCliArgs = (argv) => {
   if (options.jsonl && options.command !== "run" && options.command !== "resume") {
     throw new CliUsageError("--jsonl is supported by run and resume.");
   }
+  if (options.command !== "changes" && (options.patchPath || options.preconditionsPath || options.verificationTime)) {
+    throw new CliUsageError("--patch, --preconditions, and --now are supported only by changes.");
+  }
   if (options.command === "resume") {
     const runId = positional.shift();
     if (runId) {
@@ -5473,6 +7518,26 @@ var parseCliArgs = (argv) => {
     if (positional.length > 0) {
       throw new CliUsageError(`sessions ${sessionsCommand} received unexpected positional arguments.`);
     }
+  } else if (options.command === "changes") {
+    const changesCommand = positional.shift();
+    if (!changesCommand || !CHANGES_COMMANDS.has(changesCommand)) {
+      throw new CliUsageError("changes requires one of: create, verify.");
+    }
+    options.changesCommand = changesCommand;
+    const artifactPath = positional.shift();
+    if (!artifactPath) {
+      throw new CliUsageError(`changes ${changesCommand} requires an input JSON file.`);
+    }
+    options.artifactPath = artifactPath;
+    if (!options.patchPath) {
+      throw new CliUsageError(`changes ${changesCommand} requires --patch <file>.`);
+    }
+    if (changesCommand === "create" && (options.preconditionsPath || options.verificationTime)) {
+      throw new CliUsageError("--preconditions and --now are only supported by changes verify.");
+    }
+    if (positional.length > 0) {
+      throw new CliUsageError(`changes ${changesCommand} received unexpected positional arguments.`);
+    }
   } else if (options.command === "run" || options.command === "review") {
     const prompt = positional.join(" ").trim();
     if (prompt) {
@@ -5495,6 +7560,8 @@ Usage:
   zhx resume [options] <runId> --approve|--deny
   zhx runs list [--status <status>] [--limit <n>] [--json]
   zhx sessions list|inspect|rename|fork|archive
+  zhx changes create <input.json> --patch <artifact>
+  zhx changes verify <envelope.json> --patch <artifact> [--preconditions <file>]
 
 The long command zhivex-harness remains supported for compatibility.
 
@@ -5507,10 +7574,13 @@ Options:
   --workspace <path>             Target workspace (default: cwd)
   --state-dir <path>             Durable run-state directory
   --mcp-config <path>            Declarative governed MCP JSON configuration
+  --patch <path>                 Exact patch/artifact bytes bound to a change envelope
+  --preconditions <path>         Verification preconditions JSON for changes verify
+  --now <ISO-8601 UTC>           Explicit millisecond verification time (default: current time)
   --execution <none|oci>         Enforced execution backend (default: none)
   --oci-runtime <docker|podman>  Local OCI runtime (default: docker)
   --oci-image <reference>        Preloaded immutable-capable OCI image
-  --oci-allow-command <name>     Allow one argv executable in OCI; repeatable, must include bun
+  --oci-allow-command <name>     Allow one argv executable in OCI; repeatable, include a package manager
   --oci-max-process-runtime-ms <n> Per-command timeout (default: 120000)
   --oci-max-process-output-bytes <n> Combined output ceiling (default: 20000)
   --oci-max-memory-mb <n>        Container memory ceiling (default: 1024)
@@ -5562,7 +7632,7 @@ Credentials:
   Gemini: GEMINI_API_KEY or GOOGLE_GENERATIVE_AI_API_KEY`;
 var summarizeApproval = (approval) => {
   const mustShowCompleteProposal = approval.name === "apply_patch";
-  const argumentsText = !mustShowCompleteProposal && approval.arguments.length > 1200 ? `${approval.arguments.slice(0, 1200)}\u2026` : approval.arguments;
+  const argumentsText = !mustShowCompleteProposal && approval.arguments.length > 1200 ? `${approval.arguments.slice(0, 1200)}…` : approval.arguments;
   return `[${approval.kind ?? "provider"}] ${approval.name}
 ${argumentsText}`;
 };
@@ -5684,7 +7754,7 @@ var printTerminalResult = (result, harness, output, tracker) => {
 `);
   }
   process.stderr.write(`
-run ${result.state.runId} \xB7 ${result.state.provider}/${result.state.modelId} \xB7 ${result.status} \xB7 ${result.steps.length} steps \xB7 ${harness.workspace.mutationAudit().length} mutations
+run ${result.state.runId} · ${result.state.provider}/${result.state.modelId} · ${result.status} · ${result.steps.length} steps · ${harness.workspace.mutationAudit().length} mutations
 `);
   if (result.status === "waiting_approval") {
     for (const approval of result.state.pendingApprovals) {
@@ -5714,11 +7784,11 @@ var orchestrationObserver = (json) => async (event) => {
     return;
   if (event.type === "subagent-start") {
     process.stderr.write(`
-subagent start \xB7 ${event.childAgentId ?? event.toolName}
+subagent start · ${event.childAgentId ?? event.toolName}
 `);
   } else if (event.type === "subagent-finish") {
     process.stderr.write(`
-subagent finish \xB7 ${event.childRun.agentId ?? event.childRun.toolName} \xB7 ${event.childRun.status}
+subagent finish · ${event.childRun.agentId ?? event.childRun.toolName} · ${event.childRun.status}
 `);
   }
 };
@@ -5984,9 +8054,9 @@ var chat = async (options) => {
     const current = await refreshSession();
     const latest = current.runs.at(-1);
     const routeText = routes.size === 0 ? "default" : [...routes.values()].map((route) => `${route.profile}=${route.provider}:${route.model}`).join(", ");
-    return `session ${current.sessionId} \xB7 ${harness.config.provider}/${harness.config.model}` + ` \xB7 ${messages.length} messages \xB7 routes ${routeText}` + `${latest ? ` \xB7 last ${latest.runId} (${latest.status})` : ""}`;
+    return `session ${current.sessionId} · ${harness.config.provider}/${harness.config.model}` + ` · ${messages.length} messages · routes ${routeText}` + `${latest ? ` · last ${latest.runId} (${latest.status})` : ""}`;
   };
-  process.stderr.write(`Zhivex Harness ${HARNESS_VERSION} \xB7 ${harness.config.provider}/${harness.config.model}
+  process.stderr.write(`Zhivex Harness ${HARNESS_VERSION} · ${harness.config.provider}/${harness.config.model}
 ` + `session ${session.sessionId}
 ` + `Type /help for console commands.
 `);
@@ -6001,9 +8071,9 @@ var chat = async (options) => {
         break;
       }
       if (prompt === "/help") {
-        process.stderr.write(`/provider [id] \xB7 /model [id] \xB7 /route [role=provider[:model]] \xB7 /status
-` + `/diff \xB7 /review <task> \xB7 /resume <last|sessionId> \xB7 /compact
-` + `/new [title] \xB7 /rename <title> \xB7 /clear \xB7 /exit
+        process.stderr.write(`/provider [id] · /model [id] · /route [role=provider[:model]] · /status
+` + `/diff · /review <task> · /resume <last|sessionId> · /compact
+` + `/new [title] · /rename <title> · /clear · /exit
 `);
         continue;
       }
@@ -6282,7 +8352,7 @@ var parseNumericVersion = (version) => {
   const match = /^(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
   return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : undefined;
 };
-var satisfiesBunEngine = (version, range) => {
+var satisfiesEngine = (version, range) => {
   const minimumMatch = /^>=(\d+\.\d+\.\d+)$/.exec(range.trim());
   const actual = parseNumericVersion(version);
   const minimum = minimumMatch ? parseNumericVersion(minimumMatch[1] ?? "") : undefined;
@@ -6305,7 +8375,7 @@ var inspectWorkspace = async (workspace) => {
     if (!workspaceStat.isDirectory()) {
       return diagnostic("workspace", "fail", "Workspace is not a directory.", { path: workspace });
     }
-    await access(workspace, fsConstants.R_OK);
+    await access(workspace, fsConstants2.R_OK);
     return diagnostic("workspace", "pass", "Workspace exists and is readable.", { path: workspace });
   } catch (error) {
     const code = error.code ?? "UNKNOWN";
@@ -6314,36 +8384,28 @@ var inspectWorkspace = async (workspace) => {
 };
 var inspectGit = async (workspace) => {
   try {
-    const versionProcess = Bun.spawn(["git", "--version"], {
-      stdin: "ignore",
-      stdout: "pipe",
+    const versionProcess = await runPortableProcess(["git", "--version"], {
+      timeoutMs: 15000,
+      maxOutputCharacters: 4096,
       stderr: "ignore"
     });
-    const [versionOutput, versionExitCode] = await Promise.all([
-      new Response(versionProcess.stdout).text(),
-      versionProcess.exited
-    ]);
-    if (versionExitCode !== 0) {
+    if (versionProcess.exitCode !== 0) {
       return diagnostic("git", "warn", "Git is unavailable.", { installed: false });
     }
-    const repositoryProcess = Bun.spawn(["git", "-C", workspace, "rev-parse", "--is-inside-work-tree"], {
-      env: { PATH: process.env.PATH ?? "", GIT_TERMINAL_PROMPT: "0" },
-      stdin: "ignore",
-      stdout: "pipe",
+    const repositoryProcess = await runPortableProcess(["git", "-C", workspace, "rev-parse", "--is-inside-work-tree"], {
+      env: { GIT_TERMINAL_PROMPT: "0" },
+      timeoutMs: 15000,
+      maxOutputCharacters: 4096,
       stderr: "ignore"
     });
-    const [repositoryOutput, repositoryExitCode] = await Promise.all([
-      new Response(repositoryProcess.stdout).text(),
-      repositoryProcess.exited
-    ]);
-    const repository = repositoryExitCode === 0 && repositoryOutput.trim() === "true";
-    return diagnostic("git", repository ? "pass" : "warn", repository ? "Git is installed and the workspace is a repository." : "Git is installed, but the workspace is not a repository.", { installed: true, repository, version: versionOutput.trim() });
+    const repository = repositoryProcess.exitCode === 0 && repositoryProcess.stdout.trim() === "true";
+    return diagnostic("git", repository ? "pass" : "warn", repository ? "Git is installed and the workspace is a repository." : "Git is installed, but the workspace is not a repository.", { installed: true, repository, version: versionProcess.stdout.trim() });
   } catch {
     return diagnostic("git", "warn", "Git is unavailable.", { installed: false });
   }
 };
 var inspectScripts = async (workspace, allowedChecks) => {
-  const packagePath = path9.join(workspace, "package.json");
+  const packagePath = path10.join(workspace, "package.json");
   try {
     const packageStat = await stat4(packagePath);
     if (!packageStat.isFile() || packageStat.size > 1024 * 1024) {
@@ -6356,7 +8418,15 @@ var inspectScripts = async (workspace, allowedChecks) => {
     const scripts = packageJson.scripts && typeof packageJson.scripts === "object" ? packageJson.scripts : {};
     const available = allowedChecks.filter((name) => typeof scripts[name] === "string");
     const missing = allowedChecks.filter((name) => typeof scripts[name] !== "string");
-    return diagnostic("scripts", available.length > 0 ? "pass" : "warn", available.length > 0 ? "Supported Bun check scripts were found." : "No supported Bun check scripts were found.", { packageJson: true, available, missing });
+    const packageManager = await resolvePackageManager(workspace, packageJson);
+    return diagnostic("scripts", available.length > 0 ? "pass" : "warn", available.length > 0 ? `Supported ${packageManager.manager} check scripts were found.` : `No supported ${packageManager.manager} check scripts were found.`, {
+      packageJson: true,
+      packageManager: packageManager.manager,
+      packageManagerSource: packageManager.source,
+      ...packageManager.evidence ? { packageManagerEvidence: packageManager.evidence } : {},
+      available,
+      missing
+    });
   } catch (error) {
     const code = error instanceof SyntaxError ? "INVALID_JSON" : error.code ?? "UNKNOWN";
     return diagnostic("scripts", "warn", "package.json could not be inspected.", {
@@ -6367,17 +8437,17 @@ var inspectScripts = async (workspace, allowedChecks) => {
   }
 };
 var isInsidePath2 = (root, candidate) => {
-  const relative = path9.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path9.sep}`) && relative !== ".." && !path9.isAbsolute(relative);
+  const relative = path10.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path10.sep}`) && relative !== ".." && !path10.isAbsolute(relative);
 };
 var containsSymlink = async (candidate, trustedPrefix) => {
-  const parsed = path9.parse(candidate);
-  const parts = trustedPrefix ? path9.relative(trustedPrefix, candidate).split(path9.sep).filter(Boolean) : candidate.slice(parsed.root.length).split(path9.sep).filter(Boolean).slice(1);
-  let current = trustedPrefix ?? path9.join(parsed.root, candidate.slice(parsed.root.length).split(path9.sep).filter(Boolean)[0] ?? "");
+  const parsed = path10.parse(candidate);
+  const parts = trustedPrefix ? path10.relative(trustedPrefix, candidate).split(path10.sep).filter(Boolean) : candidate.slice(parsed.root.length).split(path10.sep).filter(Boolean).slice(1);
+  let current = trustedPrefix ?? path10.join(parsed.root, candidate.slice(parsed.root.length).split(path10.sep).filter(Boolean)[0] ?? "");
   for (const part of parts) {
-    current = path9.join(current, part);
+    current = path10.join(current, part);
     try {
-      if ((await lstat7(current)).isSymbolicLink()) {
+      if ((await lstat8(current)).isSymbolicLink()) {
         return true;
       }
     } catch (error) {
@@ -6398,7 +8468,7 @@ var nearestExistingPath = async (candidate) => {
       if (error.code !== "ENOENT") {
         throw error;
       }
-      const parent = path9.dirname(current);
+      const parent = path10.dirname(current);
       if (parent === current) {
         throw error;
       }
@@ -6414,7 +8484,7 @@ var inspectStateDirectory = async (workspace, stateDirectory) => {
     });
   }
   if (isInsidePath2(workspace, stateDirectory)) {
-    const segments = path9.relative(workspace, stateDirectory).split(path9.sep).filter(Boolean);
+    const segments = path10.relative(workspace, stateDirectory).split(path10.sep).filter(Boolean);
     const sensitiveSegment = segments.find(isSensitiveStateSegment);
     if (sensitiveSegment) {
       return diagnostic("state-directory", "fail", "State directory is inside a sensitive workspace path.", {
@@ -6439,7 +8509,7 @@ var inspectStateDirectory = async (workspace, stateDirectory) => {
         writable: false
       });
     }
-    await access(existing.path, fsConstants.R_OK | fsConstants.W_OK);
+    await access(existing.path, fsConstants2.R_OK | fsConstants2.W_OK);
     return diagnostic("state-directory", "pass", "State directory is safe and writable.", {
       path: stateDirectory,
       exists: existing.path === stateDirectory,
@@ -6461,9 +8531,9 @@ var inspectOperationsStore = async (stateDirectory, storeBackend) => {
       migrationAvailable: true
     });
   }
-  const databasePath = path9.join(stateDirectory, "operations.sqlite");
+  const databasePath = path10.join(stateDirectory, "operations.sqlite");
   try {
-    const entry = await lstat7(databasePath);
+    const entry = await lstat8(databasePath);
     if (entry.isSymbolicLink() || !entry.isFile()) {
       return diagnostic("operations-store", "fail", "SQLite state path is not a regular file.", {
         backend: storeBackend,
@@ -6591,11 +8661,11 @@ var createDoctorReport = async (options = {}, context = {}) => {
     ...env.ZHIVEX_HARNESS_MCP_CONFIG ? { mcpConfigPath: env.ZHIVEX_HARNESS_MCP_CONFIG } : {},
     ...options
   });
-  const bunVersion = context.bunVersion ?? Bun.version;
+  const runtime = context.nodeVersion ? { name: "node", version: context.nodeVersion, required: NODE_ENGINE_RANGE } : context.bunVersion ? { name: "bun", version: context.bunVersion, required: BUN_ENGINE_RANGE } : process.versions.bun ? { name: "bun", version: process.versions.bun, required: BUN_ENGINE_RANGE } : { name: "node", version: process.versions.node, required: NODE_ENGINE_RANGE };
   const providers = providerAvailability(env);
   const selectedProvider = providers.find((provider) => provider.id === config.provider);
   const checks = [];
-  checks.push(diagnostic("bun", satisfiesBunEngine(bunVersion, BUN_ENGINE_RANGE) ? "pass" : "fail", satisfiesBunEngine(bunVersion, BUN_ENGINE_RANGE) ? "Bun satisfies the package engine requirement." : "Bun does not satisfy the package engine requirement.", { version: bunVersion, required: BUN_ENGINE_RANGE }));
+  checks.push(diagnostic(runtime.name, satisfiesEngine(runtime.version, runtime.required) ? "pass" : "fail", satisfiesEngine(runtime.version, runtime.required) ? `${runtime.name === "node" ? "Node.js" : "Bun"} satisfies the package engine requirement.` : `${runtime.name === "node" ? "Node.js" : "Bun"} does not satisfy the package engine requirement.`, { version: runtime.version, required: runtime.required, primary: runtime.name === "node" }));
   checks.push(await inspectWorkspace(config.workspace));
   checks.push(await inspectGit(config.workspace));
   checks.push(await inspectScripts(config.workspace, config.allowedChecks));
@@ -6655,7 +8725,7 @@ var createDoctorReport = async (options = {}, context = {}) => {
   };
 };
 var formatDoctorReport = (report) => {
-  const symbols = { pass: "\u2713", warn: "!", fail: "\u2717" };
+  const symbols = { pass: "✓", warn: "!", fail: "✗" };
   const lines = [
     `Zhivex Harness doctor v${report.harnessVersion}`,
     ...report.checks.map((check) => `${symbols[check.status]} ${check.id}: ${check.message}`),
@@ -6693,7 +8763,7 @@ var printRunsDocument = (document, json) => {
   }
   if (record.kind === "run-inspection") {
     const run = record.run;
-    process.stdout.write(`${String(run.runId)} \xB7 ${String(run.status)} \xB7 ${String(run.provider)}/${String(run.model)} \xB7 ${String(run.steps)} steps \xB7 ${String(run.toolCalls)} tools
+    process.stdout.write(`${String(run.runId)} · ${String(run.status)} · ${String(run.provider)}/${String(run.model)} · ${String(run.steps)} steps · ${String(run.toolCalls)} tools
 `);
     return;
   }
@@ -6766,14 +8836,14 @@ var printSessionDocument = (document, json) => {
   if (record.kind === "session-list") {
     for (const session2 of record.sessions ?? []) {
       const latest = session2.runs.at(-1);
-      process.stdout.write(`${session2.sessionId} ${session2.title ?? "(untitled)"} \xB7 ${session2.runs.length} runs` + `${latest ? ` \xB7 ${latest.provider}/${latest.model} \xB7 ${latest.status}` : ""}
+      process.stdout.write(`${session2.sessionId} ${session2.title ?? "(untitled)"} · ${session2.runs.length} runs` + `${latest ? ` · ${latest.provider}/${latest.model} · ${latest.status}` : ""}
 `);
     }
     return;
   }
   const session = record.session;
   if (session) {
-    process.stdout.write(`${session.sessionId} \xB7 ${session.title ?? "(untitled)"} \xB7 ${session.runs.length} runs` + `${session.archivedAt ? " \xB7 archived" : ""}
+    process.stdout.write(`${session.sessionId} · ${session.title ?? "(untitled)"} · ${session.runs.length} runs` + `${session.archivedAt ? " · archived" : ""}
 `);
     return;
   }
@@ -6841,6 +8911,90 @@ var updateIndexedSessionRun = async (config, runId, status) => {
   }
 };
 var cliExitCodeForError = (error) => error instanceof CliUsageError ? CLI_EXIT_CODES.usageError : CLI_EXIT_CODES.runtimeError;
+var MAX_CHANGE_ENVELOPE_JSON_BYTES = 4 * 1024 * 1024;
+var MAX_CHANGE_ARTIFACT_BYTES = 64 * 1024 * 1024;
+var readStableCliArtifact = async (filePath, maxBytes) => {
+  const absolute = path10.resolve(process.cwd(), filePath);
+  try {
+    const before = await lstat8(absolute);
+    if (before.isSymbolicLink() || !before.isFile()) {
+      throw new CliUsageError(`Change artifact must be a regular non-symlink file: ${filePath}`);
+    }
+    if (before.size > maxBytes) {
+      throw new CliUsageError(`Change artifact exceeds the ${maxBytes}-byte limit: ${filePath}`);
+    }
+    const contents = await readFile4(absolute);
+    const after = await lstat8(absolute);
+    if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) {
+      throw new CliUsageError(`Change artifact changed while it was being read: ${filePath}`);
+    }
+    return contents;
+  } catch (error) {
+    if (error instanceof CliUsageError)
+      throw error;
+    const code = error && typeof error === "object" && "code" in error ? error.code : undefined;
+    if (typeof code === "string") {
+      throw new CliUsageError(`Change artifact cannot be read (${code}): ${filePath}`);
+    }
+    throw error;
+  }
+};
+var readCliJsonArtifact = async (filePath) => {
+  const contents = await readStableCliArtifact(filePath, MAX_CHANGE_ENVELOPE_JSON_BYTES);
+  try {
+    return JSON.parse(contents.toString("utf8"));
+  } catch {
+    throw new CliUsageError(`Change artifact is not valid JSON: ${filePath}`);
+  }
+};
+var objectValue = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliUsageError(`${label} must be a JSON object.`);
+  }
+  return value;
+};
+var manageChanges = async (options) => {
+  if (!options.changesCommand || !options.artifactPath || !options.patchPath) {
+    throw new CliUsageError("Incomplete changes command.");
+  }
+  const patchBytes = await readStableCliArtifact(options.patchPath, MAX_CHANGE_ARTIFACT_BYTES);
+  const patchDigest = digestChangeEnvelopeArtifact(patchBytes);
+  if (options.changesCommand === "create") {
+    const input = objectValue(await readCliJsonArtifact(options.artifactPath), "Change envelope input");
+    const patchInput = objectValue(input.patch, "Change envelope patch");
+    if (patchInput.patchDigest !== undefined && patchInput.patchDigest !== patchDigest) {
+      throw new CliUsageError("The declared patch.patchDigest does not match the exact --patch bytes.");
+    }
+    const envelope2 = createChangeEnvelope({
+      ...input,
+      patch: { ...patchInput, patchDigest }
+    });
+    process.stdout.write(`${canonicalizeChangeEnvelope(envelope2)}
+`);
+    return;
+  }
+  const envelope = await readCliJsonArtifact(options.artifactPath);
+  const suppliedPreconditions = options.preconditionsPath ? objectValue(await readCliJsonArtifact(options.preconditionsPath), "Change envelope preconditions") : {};
+  if (suppliedPreconditions.patchDigest !== undefined && suppliedPreconditions.patchDigest !== patchDigest) {
+    throw new CliUsageError("The precondition patchDigest does not match the exact --patch bytes.");
+  }
+  const preconditions = changeEnvelopePreconditionsSchema.parse({
+    ...suppliedPreconditions,
+    patchDigest
+  });
+  const result = verifyChangeEnvelope(envelope, {
+    ...options.verificationTime ? { now: options.verificationTime } : {},
+    preconditions
+  });
+  process.stdout.write(`${JSON.stringify({
+    schemaVersion: 1,
+    kind: "change-envelope-verification",
+    ...result
+  })}
+`);
+  if (!result.valid)
+    process.exitCode = CLI_EXIT_CODES.runtimeError;
+};
 var main = async (argv = process.argv.slice(2)) => {
   const options = parseCliArgs(argv);
   switch (options.command) {
@@ -6870,6 +9024,9 @@ var main = async (argv = process.argv.slice(2)) => {
     case "sessions":
       await manageSessions(options);
       return;
+    case "changes":
+      await manageChanges(options);
+      return;
     case "run":
       if (options.implicitCommand && !options.prompt && process.stdin.isTTY && process.stdout.isTTY) {
         await chat(options);
@@ -6881,7 +9038,16 @@ var main = async (argv = process.argv.slice(2)) => {
       await reviewOnce(options);
   }
 };
-if (import.meta.main) {
+var isMainModule = (() => {
+  if (!process.argv[1])
+    return false;
+  try {
+    return realpathSync2(process.argv[1]) === realpathSync2(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+if (isMainModule) {
   main().catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
     process.stderr.write(`Error: ${message}
@@ -6890,22 +9056,22 @@ if (import.meta.main) {
   });
 }
 export {
-  withTemporaryHarnessProfiles,
-  summarizeApproval,
-  runResultDocument,
-  resumeCommand,
-  readHarnessResumeRoutes,
-  readHarnessResumeConfig,
-  providersDocument,
-  parseCliArgs,
-  main,
-  formatDoctorReport,
-  createHarnessResumeMetadata,
-  createDoctorReport,
-  cliExitCodeForError,
-  HARNESS_RESUME_METADATA_SCHEMA_VERSION,
-  HARNESS_RESUME_METADATA_KEY,
-  CliUsageError,
+  CLI_EXIT_CODES,
   CLI_JSON_SCHEMA_VERSION,
-  CLI_EXIT_CODES
+  CliUsageError,
+  HARNESS_RESUME_METADATA_KEY,
+  HARNESS_RESUME_METADATA_SCHEMA_VERSION,
+  cliExitCodeForError,
+  createDoctorReport,
+  createHarnessResumeMetadata,
+  formatDoctorReport,
+  main,
+  parseCliArgs,
+  providersDocument,
+  readHarnessResumeConfig,
+  readHarnessResumeRoutes,
+  resumeCommand,
+  runResultDocument,
+  summarizeApproval,
+  withTemporaryHarnessProfiles
 };