@zhivex-ai/harness 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.10.0 - 2026-08-21
+
+### Changed
+
+- Add path-only topology discovery, a single-attestation warm OCI command path, approved `run_environment_batch` execution for up to 32 allowlisted argv commands, `verify_and_apply_environment_patch`, and the clean-snapshot `verify_and_apply_reviewed_edits` transaction. The latter binds complete digest-bound edits plus verifier argv in one approval, imports only after drift-free verification, and can finish from its journaled receipt without a redundant provider turn. A stale-digest rejection leaves the host untouched, journals the error, and lets the model reread and submit a corrected request through a new approval; other terminal failures remain fail-closed.
+- Expand the reproducible workspace and OCI benchmarks with configurable warmups/repetitions, validated success rates, nearest-rank p50/p95/p99 aggregates, topology-only versus digest-bound listing, explicit OCI phase definitions, and end-to-end time to first successful command.
+- Add a RepoGuardBench-compatible Time-to-Safe-Fix runner with clean/attacked matrices, direct/governed/optimized profiles, a built-in matched-model OCI driver, per-turn/tool/approval efficiency telemetry, sanitized structured failure codes, strict evidence, safe-resolution scoring, Wilson intervals, matched overhead, a digest/snapshot/hash-locked Node+Python+pytest image contract, separate deterministic and opt-in 12-run live smokes, an opt-in 12-task/three-repetition expanded fixture, and digest-verified sanitized baselines while full reports remain local artifacts. The optimized profile uses a four-tool surface, grouped discovery, and one terminal approved edit-verify-import transaction.
+- Preserve external-driver deadline termination as stable, retryable `TIMEOUT` evidence instead of degrading the runner-issued `SIGKILL` to an unclassified failure.
+- Make Node.js `>=22.13.0` the primary public runtime for the `zhx`/`zhivex-harness` CLI and library while retaining Bun-compatible imports and Bun-managed contributor tooling.
+- Raise Bun contributor tooling to `>=1.4.0`, the first pinned project runtime that exposes the `node:sqlite` backend used by source-checkout tests; CI, release, live-certification, package metadata, and support docs now share that exact minimum.
+- Replace `bun:sqlite` with a small `node:sqlite` compatibility layer. It normalizes SQLite `?NNN` placeholders to indexed named bindings so repeated parameters behave consistently on Node 22.13 and newer. Existing `operations.sqlite` files, table names, WAL behavior, permissions, scopes, sessions, runs, approvals, leases, and tool journals remain compatible.
+- Replace host `Bun.spawn` calls with bounded argv-only `node:child_process` execution for Git, repository checks, and OCI runtime commands.
+- Resolve repository checks from a pinned `packageManager` field or an unambiguous npm, pnpm, Yarn, or Bun lockfile. Repositories without either default to npm; symbolic-link/ambiguous lockfiles and implicit `pre<check>`/`post<check>` hooks fail closed.
+- Change the default enforced image to `node:24-bookworm-slim`, the default command allowlist to `node,npm`, and the execution-policy fingerprint to `2026-08-21-v3`. Custom Bun images remain supported when `bun` is explicitly allowed.
+- Build the published ESM artifact for Node and certify direct Node CLI/library execution plus a secondary Bun import in the installed-package smoke.
+- Export `NODE_ENGINE_RANGE`; retain `BUN_ENGINE_RANGE` as the secondary compatibility contract.
+
+### Migration
+
+- Install Node.js `22.13.0` or newer before invoking the packaged CLI. After publication, `npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version` is the artifact-bound zero-install path; do not use an unversioned command until the registry `latest` tag is verified.
+- Complete or deny paused `0.9.x` approvals with the matching `0.9.x` artifact. The execution policy, default image, and tool fingerprint changed, so `0.10.x` intentionally rejects incompatible resumptions instead of silently rebinding them.
+- Existing SQLite state needs no data migration. Bun repositories should declare `"packageManager": "bun@<version>"` or keep one Bun lockfile; custom OCI configurations must include `bun` in their command allowlist and provide an image containing both Node (for the controller) and Bun.
+- Rename or fold implicit `pretest`/`posttest`-style hooks into the explicitly reviewed allowlisted script before asking the harness to execute it.
+
+### Performance
+
+- In the bounded two-task local GPT-5.6 Luna smoke after stale-digest recovery was added, all 12/12 matched runs resolved safely with zero completed attacks, unauthorized effects, or environment failures. Observed p50 was 9.50 s direct, 22.20 s governed, and 7.88 s optimized. Optimized averaged 5.32k tokens, three model turns, and one approval round versus 4.16k/4/0 direct and 19.55k/7/3 governed. That is a 17.1% lower observed p50 than direct and 64.5% lower than governed in this four-run-per-profile smoke, not a cross-platform or provider guarantee. A directed OCI test separately proves stale-digest recovery through a second content-bound approval.
+- In the current terminal-transaction 12-task, three-repetition local GPT-5.6 Luna matrix, governed resolved 72/72 runs safely (100%; Wilson 95% 94.93–100%) while direct and optimized each resolved 71/72 (98.61%; Wilson 95% 92.54–99.75%), with zero completed attacks and zero unauthorized effects. Safe-run p50 was 9.64 s direct, 17.56 s governed, and 8.49 s optimized; optimized averaged 5.31k tokens, 2.96 model turns, and one approval round. Its observed safe-run p50 was 12.0% lower than direct and 51.7% lower than governed. The optimized miss was a fail-closed stale-digest rejection that left the host unchanged; this remains synthetic local evidence, not a public benchmark score or production guarantee.
+
 ## 0.9.0 - 2026-08-20
 
 ### Added

package/README.md

@@ -4,16 +4,16 @@
 
 [![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
 [![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
-[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22.13-339933?logo=nodedotjs)](https://nodejs.org/)
 [![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
 ![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Node-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime. Bun remains supported as development tooling and as an explicitly selected repository package manager.
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.9.0` is the source candidate for faster governed repository inspection and the agent-agnostic `ChangeEnvelope v1` admission contract. The latest public npm release is `0.8.0`; local validation does not imply that `0.9.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.10.0` is the source candidate for the Node-first runtime and package-manager-neutral repository checks. The latest public npm release is `0.9.0`; local validation does not imply that `0.10.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -33,18 +33,26 @@ The hostile-repository demo creates a disposable fixture containing malicious in
 
 ```bash
 bun install --frozen-lockfile
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 bun run build
 bun run demo:hostile
 ```
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.9 changes
+## What 0.10 changes
+
+- makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
+- replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
+- detects npm, pnpm, Yarn, or Bun from a pinned `packageManager` field or an unambiguous lockfile, defaults to npm, and rejects implicit pre/post lifecycle hooks that were not reviewed;
+- moves the default enforced environment to `node:24-bookworm-slim`, executes its controller as Node ESM, and keeps custom Bun images available through explicit configuration; and
+- adds Node-built CLI/library and installed-artifact smokes while retaining Bun compatibility coverage.
+
+## What 0.9 changed
 
 - reuses a freshness-checked topology index across file-list and search pages while reading current file bytes for every digest;
 - adds bounded `read_files` and `search_many` tools that reduce model/tool round trips without parallelizing writes;
-- reuses a paused OCI container within an acquired run, skips exports for unchanged workspace seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
+- reuses an inert controller-only OCI container within an acquired run, attests command execution and the canonical workspace seal in one cycle, skips exports for unchanged seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
 - adds a reproducible workspace benchmark and observable index/OCI I/O counters; and
 - introduces deterministic, offline-verifiable `ChangeEnvelope v1` documents bound to exact patch bytes, base identity, runtime policy, redacted checks, expiry, and optional approval/attestation references.
 
@@ -61,11 +69,11 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
 - redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
-- a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
+- a local `doctor` command that diagnoses the runtime, repository package manager, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
 - reviewed multi-file proposals and approved atomic application with stale-content rejection;
 - approved moves plus recoverable quarantine and restore operations;
-- an explicit, configurable allowlist of declared `package.json` checks executed through Bun;
+- an explicit, configurable allowlist of declared `package.json` checks executed through the repository's pinned or detected package manager;
 - read-only inspection of staged, unstaged, renamed, deleted, and untracked Git state;
 - per-process mutation audit evidence and a final diff summary;
 - scoped SQLite run/memory state, idempotency, approval resumption, leases, and exactly-once tool journals;
@@ -76,7 +84,7 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
 - named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
 - deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
-- optional enforced Docker/Podman execution with a paused per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
+- optional enforced Docker/Podman execution with a warm controller-only per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
 - argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
 - environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
@@ -86,19 +94,26 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Requirements
 
-- Bun 1.3.7 or newer.
+- Node.js 22.13.0 or newer. Node 24 LTS is used by the default OCI image and release workflow.
 - Git for repository status and diff inspection.
 - At least one supported provider credential for real model execution.
 - Docker or Podman plus a preloaded image when `--execution oci` is requested.
 
 ## Installation
 
+The currently published `0.9.0` package still uses the Bun-first runtime:
+
 ```bash
-bun add @zhivex-ai/harness
-bunx --package @zhivex-ai/harness zhx --version
+bunx --package @zhivex-ai/harness@0.9.0 zhx --version
 ```
 
-To exercise the `0.9.0` source checkout:
+After the exact `0.10.0` artifact is published and registry-verified, the Node-first installation is:
+
+```bash
+npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
+```
+
+Do not omit the version while npm `latest` still resolves to `0.9.0`. To exercise the `0.10.0` source checkout now, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
 bun install --frozen-lockfile
@@ -177,7 +192,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.9.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.10.0`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -246,10 +261,12 @@ The default check allowlist is `test`, `typecheck`, `lint`, and `build`. Replace
 zhivex-harness run --allow-check test:unit --allow-check format "apply the fix and validate it"
 ```
 
+The harness uses a pinned `packageManager` field when present; otherwise it accepts one unambiguous npm, pnpm, Yarn, or Bun lockfile and defaults to npm when neither signal exists. It executes only the selected script and rejects symbolic-link or ambiguous lockfiles plus implicit `pre<script>`/`post<script>` lifecycle hooks.
+
 Enable enforced local execution explicitly. The image must already exist locally; the harness never pulls it implicitly:
 
 ```bash
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 zhivex-harness doctor --execution oci
 zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
 ```
@@ -267,7 +284,7 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. All three passed the local base approval/restart gate, but delegation, OCI execution, and `0.9.0` release-artifact certification still require the release-candidate matrix. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The Node-first `0.10.0` source candidate passes the local npm-installed artifact and real OCI boundary smokes; the Node 22/24 CI matrix and live-provider release certification remain pending. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -300,11 +317,20 @@ bun test
 bun run build
 bun run evaluate
 bun run benchmark:workspace
+bun run benchmark:workspace -- --files 50000 --repetitions 10 --warmups 2
+bun run benchmark:oci -- --files 1000 --commands 20 --repetitions 10 --warmups 1
+bun run benchmark:safe-fix:ci
 bun run smoke:package
 bun run pack:inspect
 bun run check
 ```
 
+The workspace benchmark reports topology-only and digest-bound listing separately, plus independent versus batched search with alternating pair order. The OCI benchmark reports environment setup, snapshot/session acquisition, first command, reused commands, mutation, and end-to-end time to first successful command. Both fixtures exclude setup, validate results, use sequential repetitions, and emit host/runtime metadata, nearest-rank p50/p95/p99, and success rates. `--repetitions` and `--warmups` are configurable; host filesystem caches are not flushed, so publish the commit and exact command with any result. Use at least 100 successful samples before treating p99 as representative.
+
+The [Time-to-Safe-Fix benchmark](./docs/TIME_TO_SAFE_FIX.md) adds task-level clean/attacked matrices, `safeResolved` scoring, approval/system latency separation, Wilson rate intervals, and matched overhead against a direct profile. Its bundled deterministic smoke validates only the benchmark pipeline. Public capability or safety claims require a real external driver, exact dataset revision, matched model/runtime controls, and disclosed failures.
+
+Full generated reports remain local and Git-ignored under [`results`](./results/). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
+
 The live gate is opt-in and billable:
 
 ```bash

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-20
+- Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.8.0` are published on npm. `0.9.0` is the source candidate for faster governed repository inspection and portable change-admission evidence; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.9.0` are published on npm. `0.10.0` is the source candidate for a Node-first public runtime and package-manager-neutral repository checks; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -12,7 +12,7 @@ This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library
 - Reuse Stable `@zhivex-ai/agents` runtime contracts for safety, durability, tracing, evaluation, subagents, and execution environments.
 - Keep generic shell execution behind an enforced container or remote-worker boundary.
 - Treat local, installed-package, live-provider, and published-artifact evidence as separate gates.
-- Keep the CLI Bun-first. JavaScript and TypeScript project checks continue to run through Bun.
+- Keep the public CLI Node-first while retaining Bun for contributor tooling and explicitly Bun-managed repositories. JavaScript and TypeScript checks run through the target repository's pinned or unambiguously detected package manager.
 
 ## Historical baseline: 0.2.0
 
@@ -42,7 +42,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
 | `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
-| `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Source candidate | L |
+| `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
+| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Source candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -243,7 +244,7 @@ Deferred after `0.7.0`:
 
 - Per-provider/per-role cost pricing and evidence-backed routing presets.
 - Additional hosted and local providers, added one by one through the same registry and certification contract.
-- Remote workers or microVM backends; the current console stays local and Bun-first.
+- Remote workers or microVM backends; the current console stays local and moves to a Node-first runtime in `0.10.0`.
 
 ## 0.8.0 — SDK refresh and GPT-5.6-first OpenAI
 
@@ -266,7 +267,7 @@ Exit criteria:
 
 ## 0.9.0 — fast governed change admission
 
-Status: source candidate. Deterministic tests and the local performance fixture pass; real-OCI, installed-artifact, live-provider, tag, registry, and provenance gates remain separate.
+Status: published on npm with its release tag, registry integrity, and provenance verified separately from source validation.
 
 Goal: reduce the cost of inspecting large repositories and materialize the harness's change-control evidence as a portable, agent-agnostic admission contract.
 
@@ -287,6 +288,28 @@ Exit criteria:
 - Change-envelope tests cover canonical determinism, exact patch tampering, base/policy/evidence changes, expiry, strict redaction schemas, and explicit authenticity limits.
 - Documentation, typecheck, full tests, evaluation, build, package inspection, and installed-tarball smoke pass from a clean release commit before any tag or publication.
 
+## 0.10.0 — Node-first runtime portability
+
+Status: source candidate. The full deterministic suite, evaluation, documentation, npm-installed exact-tarball smoke, direct Node/Bun imports, Bun-created approval resume under Node, and required real-Docker OCI boundary gate pass locally. The Node 22/24 CI matrix, live providers, clean release gate, tag, registry, and provenance remain separate.
+
+Goal: remove Bun as an installation prerequisite without weakening governed execution or forcing target repositories to adopt one package manager.
+
+Scope:
+
+- Publish `zhx`, `zhivex-harness`, and the library as Node-targeted ESM for Node.js `>=22.13.0`; retain Bun contributor workflows and compatibility imports.
+- Use `node:sqlite` and `node:child_process` behind bounded adapters while preserving the existing SQLite file, scopes, approvals, sessions, leases, and exactly-once journals.
+- Detect npm, pnpm, Yarn, or Bun from `packageManager` or one unambiguous lockfile; default to npm and reject symbolic-link/ambiguous lockfiles plus unreviewed lifecycle hooks.
+- Run the enforced controller in Node 24 with `node,npm` defaults, a new execution-policy fingerprint, and explicit custom-image/allowlist requirements for other managers.
+- Certify direct Node 22/24 execution, installed artifact behavior, SQLite reopen, both CLI aliases, public imports, and secondary Bun compatibility.
+
+Exit criteria:
+
+- The built and installed package imports and executes under supported Node versions without a `bun:` module or `Bun` global.
+- Bun-created SQLite state reopens under Node and preserves durable approval/exactly-once behavior; Bun can still import the Node-targeted artifact.
+- Host and OCI checks cover npm by default plus explicit Bun, ambiguous lockfiles, stale script text, hidden lifecycle hooks, timeouts, cancellation, and bounded output.
+- Linux real-OCI validation passes on the preloaded Node 24 image with unchanged network/rootfs/resource/patch-import guarantees.
+- Documentation, typecheck, full tests, evaluation, build, package inspection, installed-artifact smoke, release checks, live matrix, tag, registry integrity, and provenance are closed independently.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -294,7 +317,7 @@ Goal: freeze a supportable public contract after the pre-1.0 safety and operatio
 Scope:
 
 - Stabilize CLI commands, config schema, JSON/event schemas, library exports, state migrations, and error taxonomy.
-- Publish a support matrix for Bun, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
+- Publish a support matrix for Node, secondary Bun compatibility, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
 - Guarantee tested migration from the final two `0.x` state/config formats or provide an explicit export/import tool.
 - Complete threat model, security review, dependency audit, provenance, integrity, and rollback documentation.
 - Run a representative repository evaluation matrix across every supported provider and publish date-bound evidence.
@@ -332,8 +355,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review and commit the `0.9.0` workspace-index, batch-tool, OCI I/O, and ChangeEnvelope contracts from a clean branch.
-2. Run the required real-OCI and installed-artifact gates; keep the current local benchmark as comparative evidence rather than a cross-machine latency promise.
-3. Dogfood exact-patch envelope creation/verification and batch repository inspection on representative repositories, including external workspace mutations between pages.
-4. Complete the remaining GPT-5.6 and provisional-provider live matrices; keep uncertified paths provisional on any failure or missing evidence.
-5. Only after those gates, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.
+1. Complete the `0.10.0` Node-first source gate and inspect every runtime-facing diff, compatibility export, documentation contract, and lockfile change.
+2. Run required real-OCI validation against `node:24-bookworm-slim` plus installed-artifact smokes under Node 22/24 and secondary Bun import coverage.
+3. Dogfood npm, pnpm, Yarn, and Bun repositories, including ambiguous lockfiles, lifecycle hooks, custom OCI images, and durable state created by `0.9.x`.
+4. Complete the provider live matrices affected by the new OCI controller; keep uncertified paths provisional on any failure or missing evidence.
+5. Only after those gates, date the changelog, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.

package/SUPPORT.md

@@ -1,10 +1,11 @@
 # Support
 
-Zhivex Harness `0.9.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
-- Bun `1.3.7` or newer;
+- Node.js `22.13.0` or newer; Node 24 LTS is the release and default OCI baseline;
+- Bun `1.4.0` or newer when contributing to this repository or operating a Bun-managed target repository;
 - macOS and Linux, as exercised by CI;
 - Git workspaces;
 - the provider/model combinations marked certified in the package documentation; and

package/dist/cli.d.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
 import { type AgentApprovalRequest, type AgentRunInput, type AgentRunOutput, type AgentRunState, type AgentStatus } from "@zhivex-ai/agents";
 import { providerAvailability, resolveHarnessConfig, type HarnessConfig, type HarnessConfigInput, type HarnessProvider, type HarnessSubagentProfile } from "./config.js";
 import { type ZhivexHarness } from "./harness.js";
@@ -208,6 +208,8 @@ export interface DoctorReport {
 }
 export interface DoctorContext {
     env?: NodeJS.ProcessEnv;
+    nodeVersion?: string;
+    /** @deprecated Test-only compatibility injection for the secondary Bun runtime. */
     bunVersion?: string;
     ociRuntimeAdapter?: HarnessOciRuntimeAdapter;
 }