@zhivex-ai/harness 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,63 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.11.0 - 2026-08-21
+
+### Added
+
+- Add a dependency-free terminal presentation layer with sanitized/redacted activity events, complete governed approval cards, and `y`/`n`/`v`/`q` decision handling that never partially resolves a durable approval batch.
+- Add `/pending`, `/approve`, and `/deny` so a recovered chat session can inspect and resolve its durable approval without leaving the console; persisted provider, routing, context, and OCI policy are restored before resumption.
+- Add bounded project context/rule discovery, progressive `SKILL.md` disclosure, and version-bound trusted application lifecycle hooks. Repository configuration cannot register executable host hooks.
+- Add opt-in `run_environment_shell` through `--execution oci --oci-shell ask`. The exact script is approval-bound and interpreted only by `sh` inside the no-network OCI snapshot; host mutation still requires the separate content-bound import approval.
+
+### Changed
+
+- Advance resolved config schema to `5` and the OCI execution-policy fingerprint to `2026-08-21-v4`; complete paused `0.10.0` work with the published artifact rather than rebinding it to the changed tool/context surface.
+- Bound the live reviewer-delegation fixture to one read-only child tool call against a temporary repository with a known diff, avoiding provider-specific false failures caused by asking a reviewer to inspect an empty non-Git workspace.
+- Align the default mixed-provider live route with the certified cohort (OpenAI parent, Qwen reviewer); Gemini routing remains an explicit provisional certification target.
+- Await asynchronous harness shutdown throughout release, evaluation, smoke, and test callers so lifecycle hooks and OCI cleanup complete before process exit.
+- Emit `run-finished` only for terminal run states, and have `zhx doctor` load and validate configured project context before reporting readiness.
+
+### Migration from 0.10.x
+
+- Change schema-version-pinned configuration from `schemaVersion: 4` to `5`. Existing SQLite state remains readable, but paused approvals created by `0.10.x` must be completed or denied with the matching `0.10.x` artifact because context, hook, tool, and execution-policy fingerprints changed.
+- Await `harness.close()` in library cleanup paths. Lifecycle hooks can make shutdown asynchronous even when no execution environment is active.
+- Project context discovery is enabled by default. Use `--no-project-context` or `projectContext: false` when an embedding must ignore repository instructions; malformed explicit context manifests fail before provider execution.
+- OCI shell syntax remains opt-in. Existing OCI configurations keep `shellMode: "deny"`; set `--oci-shell ask` or `shellMode: "ask"` only when exact-script approval inside the no-network container is intended.
+
+### Security
+
+- Shell remains `deny` by default, is unavailable without OCI, never inherits host environment variables, and does not enable container networking. Command entrypoint lists do not claim to constrain every descendant process spawned inside the container.
+
+## 0.10.0 - 2026-08-21
+
+### Changed
+
+- Add path-only topology discovery, a single-attestation warm OCI command path, approved `run_environment_batch` execution for up to 32 allowlisted argv commands, `verify_and_apply_environment_patch`, and the clean-snapshot `verify_and_apply_reviewed_edits` transaction. The latter binds complete digest-bound edits plus verifier argv in one approval, imports only after drift-free verification, and can finish from its journaled receipt without a redundant provider turn. A stale-digest rejection leaves the host untouched, journals the error, and lets the model reread and submit a corrected request through a new approval; other terminal failures remain fail-closed.
+- Expand the reproducible workspace and OCI benchmarks with configurable warmups/repetitions, validated success rates, nearest-rank p50/p95/p99 aggregates, topology-only versus digest-bound listing, explicit OCI phase definitions, and end-to-end time to first successful command.
+- Add a RepoGuardBench-compatible Time-to-Safe-Fix runner with clean/attacked matrices, direct/governed/optimized profiles, a built-in matched-model OCI driver, per-turn/tool/approval efficiency telemetry, sanitized structured failure codes, strict evidence, safe-resolution scoring, Wilson intervals, matched overhead, a digest/snapshot/hash-locked Node+Python+pytest image contract, separate deterministic and opt-in 12-run live smokes, an opt-in 12-task/three-repetition expanded fixture, and digest-verified sanitized baselines while full reports remain local artifacts. The optimized profile uses a four-tool surface, grouped discovery, and one terminal approved edit-verify-import transaction.
+- Preserve external-driver deadline termination as stable, retryable `TIMEOUT` evidence instead of degrading the runner-issued `SIGKILL` to an unclassified failure.
+- Make Node.js `>=22.13.0` the primary public runtime for the `zhx`/`zhivex-harness` CLI and library while retaining Bun-compatible imports and Bun-managed contributor tooling.
+- Raise Bun contributor tooling to `>=1.4.0`, the first pinned project runtime that exposes the `node:sqlite` backend used by source-checkout tests; CI, release, live-certification, package metadata, and support docs now share that exact minimum.
+- Replace `bun:sqlite` with a small `node:sqlite` compatibility layer. It normalizes SQLite `?NNN` placeholders to indexed named bindings so repeated parameters behave consistently on Node 22.13 and newer. Existing `operations.sqlite` files, table names, WAL behavior, permissions, scopes, sessions, runs, approvals, leases, and tool journals remain compatible.
+- Replace host `Bun.spawn` calls with bounded argv-only `node:child_process` execution for Git, repository checks, and OCI runtime commands.
+- Resolve repository checks from a pinned `packageManager` field or an unambiguous npm, pnpm, Yarn, or Bun lockfile. Repositories without either default to npm; symbolic-link/ambiguous lockfiles and implicit `pre<check>`/`post<check>` hooks fail closed.
+- Change the default enforced image to `node:24-bookworm-slim`, the default command allowlist to `node,npm`, and the execution-policy fingerprint to `2026-08-21-v3`. Custom Bun images remain supported when `bun` is explicitly allowed.
+- Build the published ESM artifact for Node and certify direct Node CLI/library execution plus a secondary Bun import in the installed-package smoke.
+- Export `NODE_ENGINE_RANGE`; retain `BUN_ENGINE_RANGE` as the secondary compatibility contract.
+
+### Migration
+
+- Install Node.js `22.13.0` or newer before invoking the packaged CLI. After publication, `npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version` is the artifact-bound zero-install path; do not use an unversioned command until the registry `latest` tag is verified.
+- Complete or deny paused `0.9.x` approvals with the matching `0.9.x` artifact. The execution policy, default image, and tool fingerprint changed, so `0.10.x` intentionally rejects incompatible resumptions instead of silently rebinding them.
+- Existing SQLite state needs no data migration. Bun repositories should declare `"packageManager": "bun@<version>"` or keep one Bun lockfile; custom OCI configurations must include `bun` in their command allowlist and provide an image containing both Node (for the controller) and Bun.
+- Rename or fold implicit `pretest`/`posttest`-style hooks into the explicitly reviewed allowlisted script before asking the harness to execute it.
+
+### Performance
+
+- In the bounded two-task local GPT-5.6 Luna smoke after stale-digest recovery was added, all 12/12 matched runs resolved safely with zero completed attacks, unauthorized effects, or environment failures. Observed p50 was 9.50 s direct, 22.20 s governed, and 7.88 s optimized. Optimized averaged 5.32k tokens, three model turns, and one approval round versus 4.16k/4/0 direct and 19.55k/7/3 governed. That is a 17.1% lower observed p50 than direct and 64.5% lower than governed in this four-run-per-profile smoke, not a cross-platform or provider guarantee. A directed OCI test separately proves stale-digest recovery through a second content-bound approval.
+- In the current terminal-transaction 12-task, three-repetition local GPT-5.6 Luna matrix, governed resolved 72/72 runs safely (100%; Wilson 95% 94.93–100%) while direct and optimized each resolved 71/72 (98.61%; Wilson 95% 92.54–99.75%), with zero completed attacks and zero unauthorized effects. Safe-run p50 was 9.64 s direct, 17.56 s governed, and 8.49 s optimized; optimized averaged 5.31k tokens, 2.96 model turns, and one approval round. Its observed safe-run p50 was 12.0% lower than direct and 51.7% lower than governed. The optimized miss was a fail-closed stale-digest rejection that left the host unchanged; this remains synthetic local evidence, not a public benchmark score or production guarantee.
+
 ## 0.9.0 - 2026-08-20
 
 ### Added

package/README.md

@@ -4,16 +4,16 @@
 
 [![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
 [![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
-[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D22.13-339933?logo=nodedotjs)](https://nodejs.org/)
 [![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
 ![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime.
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Node-first local CLI and TypeScript library portable across Meta, Qwen, OpenAI, and provisional Gemini support, built on the Stable `@zhivex-ai/agents` runtime. Bun remains supported as development tooling and as an explicitly selected repository package manager.
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.9.0` is the source candidate for faster governed repository inspection and the agent-agnostic `ChangeEnvelope v1` admission contract. The latest public npm release is `0.8.0`; local validation does not imply that `0.9.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.0` is the current source release candidate. The latest public npm release remains the tagged Node-first `0.10.0` artifact until the reviewed release workflow publishes and verifies `0.11.0`; local validation alone does not publish or certify registry provenance. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -33,18 +33,34 @@ The hostile-repository demo creates a disposable fixture containing malicious in
 
 ```bash
 bun install --frozen-lockfile
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 bun run build
 bun run demo:hostile
 ```
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.9 changes
+## What 0.11 changes
+
+- adds a dependency-free terminal presentation layer with redacted activity, complete approval cards, and durable `y`/`n`/`v`/`q` decisions;
+- lets recovered chat sessions inspect and resolve their current approval with `/pending`, `/approve`, and `/deny` after restoring the exact persisted provider, routing, context, and OCI policy;
+- loads bounded `AGENTS.md`, project context, rules, and progressively disclosed skills while binding their digests into durable compatibility;
+- adds trusted application lifecycle hooks with versioned identities, bounded events, timeouts, and redacted failures; and
+- exposes exact-script shell syntax only through explicit `--execution oci --oci-shell ask`, preserving denied network and the separate host-import approval.
+
+## What 0.10 changed
+
+- makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
+- replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
+- detects npm, pnpm, Yarn, or Bun from a pinned `packageManager` field or an unambiguous lockfile, defaults to npm, and rejects implicit pre/post lifecycle hooks that were not reviewed;
+- moves the default enforced environment to `node:24-bookworm-slim`, executes its controller as Node ESM, and keeps custom Bun images available through explicit configuration; and
+- adds Node-built CLI/library and installed-artifact smokes while retaining Bun compatibility coverage.
+
+## What 0.9 changed
 
 - reuses a freshness-checked topology index across file-list and search pages while reading current file bytes for every digest;
 - adds bounded `read_files` and `search_many` tools that reduce model/tool round trips without parallelizing writes;
-- reuses a paused OCI container within an acquired run, skips exports for unchanged workspace seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
+- reuses an inert controller-only OCI container within an acquired run, attests command execution and the canonical workspace seal in one cycle, skips exports for unchanged seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
 - adds a reproducible workspace benchmark and observable index/OCI I/O counters; and
 - introduces deterministic, offline-verifiable `ChangeEnvelope v1` documents bound to exact patch bytes, base identity, runtime policy, redacted checks, expiry, and optional approval/attestation references.
 
@@ -61,11 +77,11 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
 - redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
 - versioned configuration and JSON output contracts;
-- a local `doctor` command that diagnoses Bun, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
+- a local `doctor` command that diagnoses the runtime, repository package manager, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
 - deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
 - reviewed multi-file proposals and approved atomic application with stale-content rejection;
 - approved moves plus recoverable quarantine and restore operations;
-- an explicit, configurable allowlist of declared `package.json` checks executed through Bun;
+- an explicit, configurable allowlist of declared `package.json` checks executed through the repository's pinned or detected package manager;
 - read-only inspection of staged, unstaged, renamed, deleted, and untracked Git state;
 - per-process mutation audit evidence and a final diff summary;
 - scoped SQLite run/memory state, idempotency, approval resumption, leases, and exactly-once tool journals;
@@ -76,29 +92,30 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
 - named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
 - deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
-- optional enforced Docker/Podman execution with a paused per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
+- optional enforced Docker/Podman execution with a warm controller-only per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
 - argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
 - environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
 - Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
 
-It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
+It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. The opt-in `--oci-shell ask` policy exposes approval-bound `sh` only inside OCI. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
 ## Requirements
 
-- Bun 1.3.7 or newer.
+- Node.js 22.13.0 or newer. Node 24 LTS is used by the default OCI image and release workflow.
 - Git for repository status and diff inspection.
 - At least one supported provider credential for real model execution.
 - Docker or Podman plus a preloaded image when `--execution oci` is requested.
 
 ## Installation
 
+Install the published Node-first `0.10.0` artifact with an exact version:
+
 ```bash
-bun add @zhivex-ai/harness
-bunx --package @zhivex-ai/harness zhx --version
+npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
 ```
 
-To exercise the `0.9.0` source checkout:
+To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
 bun install --frozen-lockfile
@@ -138,7 +155,9 @@ zhx chat --continue
 zhivex-harness --version
 ```
 
-Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
+
+Project context engineering is enabled by default. A root `AGENTS.md` plus an optional `.zhivex/harness.json` can declare bounded context files, rule files, and progressively loaded `SKILL.md` directories. Disable discovery with `--no-project-context` or select another manifest with `--context-config`.
 
 Show providers and detected configuration without printing secrets:
 
@@ -177,7 +196,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.9.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.11.0`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -246,15 +265,18 @@ The default check allowlist is `test`, `typecheck`, `lint`, and `build`. Replace
 zhivex-harness run --allow-check test:unit --allow-check format "apply the fix and validate it"
 ```
 
+The harness uses a pinned `packageManager` field when present; otherwise it accepts one unambiguous npm, pnpm, Yarn, or Bun lockfile and defaults to npm when neither signal exists. It executes only the selected script and rejects symbolic-link or ambiguous lockfiles plus implicit `pre<script>`/`post<script>` lifecycle hooks.
+
 Enable enforced local execution explicitly. The image must already exist locally; the harness never pulls it implicitly:
 
 ```bash
-docker pull oven/bun:1.3.7-slim
+docker pull node:24-bookworm-slim
 zhivex-harness doctor --execution oci
 zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
+zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipeline inside the isolated snapshot"
 ```
 
-`--yes` approves both command execution and the distinct host patch import. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
+`--yes` approves eligible command execution and the distinct host patch import; it cannot enable a shell whose policy is `deny`. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
 
 ## Providers and defaults
 
@@ -267,7 +289,7 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart, delegation/persistence, and enforced-execution paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. All three passed the local base approval/restart gate, but delegation, OCI execution, and `0.9.0` release-artifact certification still require the release-candidate matrix. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.10.0` artifact is published; the `0.11.0` candidate requires its own clean CI, live-provider, artifact, registry, and provenance gates. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -300,11 +322,20 @@ bun test
 bun run build
 bun run evaluate
 bun run benchmark:workspace
+bun run benchmark:workspace -- --files 50000 --repetitions 10 --warmups 2
+bun run benchmark:oci -- --files 1000 --commands 20 --repetitions 10 --warmups 1
+bun run benchmark:safe-fix:ci
 bun run smoke:package
 bun run pack:inspect
 bun run check
 ```
 
+The workspace benchmark reports topology-only and digest-bound listing separately, plus independent versus batched search with alternating pair order. The OCI benchmark reports environment setup, snapshot/session acquisition, first command, reused commands, mutation, and end-to-end time to first successful command. Both fixtures exclude setup, validate results, use sequential repetitions, and emit host/runtime metadata, nearest-rank p50/p95/p99, and success rates. `--repetitions` and `--warmups` are configurable; host filesystem caches are not flushed, so publish the commit and exact command with any result. Use at least 100 successful samples before treating p99 as representative.
+
+The [Time-to-Safe-Fix benchmark](./docs/TIME_TO_SAFE_FIX.md) adds task-level clean/attacked matrices, `safeResolved` scoring, approval/system latency separation, Wilson rate intervals, and matched overhead against a direct profile. Its bundled deterministic smoke validates only the benchmark pipeline. Public capability or safety claims require a real external driver, exact dataset revision, matched model/runtime controls, and disclosed failures.
+
+Full generated reports remain local and Git-ignored under [`results`](./results/). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
+
 The live gate is opt-in and billable:
 
 ```bash

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-20
+- Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.8.0` are published on npm. `0.9.0` is the source candidate for faster governed repository inspection and portable change-admission evidence; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.10.0` are published on npm. Version `0.11.0` is the local source release candidate for interactive operation, context engineering, and opt-in OCI shell workflows; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -12,7 +12,7 @@ This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library
 - Reuse Stable `@zhivex-ai/agents` runtime contracts for safety, durability, tracing, evaluation, subagents, and execution environments.
 - Keep generic shell execution behind an enforced container or remote-worker boundary.
 - Treat local, installed-package, live-provider, and published-artifact evidence as separate gates.
-- Keep the CLI Bun-first. JavaScript and TypeScript project checks continue to run through Bun.
+- Keep the public CLI Node-first while retaining Bun for contributor tooling and explicitly Bun-managed repositories. JavaScript and TypeScript checks run through the target repository's pinned or unambiguously detected package manager.
 
 ## Historical baseline: 0.2.0
 
@@ -42,7 +42,9 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Published on npm | S |
 | `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
-| `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Source candidate | L |
+| `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
+| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
+| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Local release candidate | L |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -243,7 +245,7 @@ Deferred after `0.7.0`:
 
 - Per-provider/per-role cost pricing and evidence-backed routing presets.
 - Additional hosted and local providers, added one by one through the same registry and certification contract.
-- Remote workers or microVM backends; the current console stays local and Bun-first.
+- Remote workers or microVM backends; the current console stays local and moves to a Node-first runtime in `0.10.0`.
 
 ## 0.8.0 — SDK refresh and GPT-5.6-first OpenAI
 
@@ -266,7 +268,7 @@ Exit criteria:
 
 ## 0.9.0 — fast governed change admission
 
-Status: source candidate. Deterministic tests and the local performance fixture pass; real-OCI, installed-artifact, live-provider, tag, registry, and provenance gates remain separate.
+Status: published on npm with its release tag, registry integrity, and provenance verified separately from source validation.
 
 Goal: reduce the cost of inspecting large repositories and materialize the harness's change-control evidence as a portable, agent-agnostic admission contract.
 
@@ -287,6 +289,47 @@ Exit criteria:
 - Change-envelope tests cover canonical determinism, exact patch tampering, base/policy/evidence changes, expiry, strict redaction schemas, and explicit authenticity limits.
 - Documentation, typecheck, full tests, evaluation, build, package inspection, and installed-tarball smoke pass from a clean release commit before any tag or publication.
 
+## 0.10.0 — Node-first runtime portability
+
+Status: published on npm with the `v0.10.0` tag. Later source work is not covered by that release's artifact or provenance evidence.
+
+Goal: remove Bun as an installation prerequisite without weakening governed execution or forcing target repositories to adopt one package manager.
+
+Scope:
+
+- Publish `zhx`, `zhivex-harness`, and the library as Node-targeted ESM for Node.js `>=22.13.0`; retain Bun contributor workflows and compatibility imports.
+- Use `node:sqlite` and `node:child_process` behind bounded adapters while preserving the existing SQLite file, scopes, approvals, sessions, leases, and exactly-once journals.
+- Detect npm, pnpm, Yarn, or Bun from `packageManager` or one unambiguous lockfile; default to npm and reject symbolic-link/ambiguous lockfiles plus unreviewed lifecycle hooks.
+- Run the enforced controller in Node 24 with `node,npm` defaults, a new execution-policy fingerprint, and explicit custom-image/allowlist requirements for other managers.
+- Certify direct Node 22/24 execution, installed artifact behavior, SQLite reopen, both CLI aliases, public imports, and secondary Bun compatibility.
+
+Exit criteria:
+
+- The built and installed package imports and executes under supported Node versions without a `bun:` module or `Bun` global.
+- Bun-created SQLite state reopens under Node and preserves durable approval/exactly-once behavior; Bun can still import the Node-targeted artifact.
+- Host and OCI checks cover npm by default plus explicit Bun, ambiguous lockfiles, stale script text, hidden lifecycle hooks, timeouts, cancellation, and bounded output.
+- Linux real-OCI validation passes on the preloaded Node 24 image with unchanged network/rootfs/resource/patch-import guarantees.
+- Documentation, typecheck, full tests, evaluation, build, package inspection, installed-artifact smoke, release checks, live matrix, tag, registry integrity, and provenance are closed independently.
+
+## 0.11.0 — daily-driver foundations
+
+Status: local source release candidate. It is not yet tagged or published as a new artifact.
+
+Goal: make the governed runtime practical for daily interactive work without giving repository content or shell syntax authority over host policy.
+
+Scope:
+
+- Render redacted step/tool activity and safe approval cards, and resolve recovered approvals from the durable chat console with `/pending`, `/approve`, and `/deny`.
+- Load bounded root/project context and rules, expose a metadata-only skill catalog, and load skill instructions progressively instead of injecting every skill into the initial prompt.
+- Add trusted application lifecycle hooks identified by version in the harness binding; repository manifests never introduce executable host hooks.
+- Expose full shell syntax only behind explicit `--execution oci --oci-shell ask`, with exact-script approval, denied container network, resource limits, and separate host patch-import approval.
+- Keep semantic search, IDE clients, remote workers, executable project hooks, and network-enabled sandbox profiles as later independently governed tracks.
+
+Exit criteria:
+
+- TTY, no-color, approval-resume, context traversal/symlink, skill disclosure, hook redaction/failure, and OCI shell policy regressions pass.
+- The full deterministic, package, and real-OCI gates pass from a clean commit before any release number, tag, or publication is claimed.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -294,7 +337,7 @@ Goal: freeze a supportable public contract after the pre-1.0 safety and operatio
 Scope:
 
 - Stabilize CLI commands, config schema, JSON/event schemas, library exports, state migrations, and error taxonomy.
-- Publish a support matrix for Bun, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
+- Publish a support matrix for Node, secondary Bun compatibility, operating systems, Git, container backend, providers, models, MCP modes, and store backends.
 - Guarantee tested migration from the final two `0.x` state/config formats or provide an explicit export/import tool.
 - Complete threat model, security review, dependency audit, provenance, integrity, and rollback documentation.
 - Run a representative repository evaluation matrix across every supported provider and publish date-bound evidence.
@@ -332,8 +375,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review and commit the `0.9.0` workspace-index, batch-tool, OCI I/O, and ChangeEnvelope contracts from a clean branch.
-2. Run the required real-OCI and installed-artifact gates; keep the current local benchmark as comparative evidence rather than a cross-machine latency promise.
-3. Dogfood exact-patch envelope creation/verification and batch repository inspection on representative repositories, including external workspace mutations between pages.
-4. Complete the remaining GPT-5.6 and provisional-provider live matrices; keep uncertified paths provisional on any failure or missing evidence.
-5. Only after those gates, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.
+1. Review and commit the exact `0.11.0` source candidate on `main`, then require clean Linux/macOS CI and Node 22.13/24 artifact compatibility.
+2. Run the required real-OCI gate against `node:24-bookworm-slim` plus installed-artifact smoke coverage for terminal, context, lifecycle-hook, and OCI shell exports.
+3. Complete the provider live matrices affected by the changed context/tool fingerprint; keep any missing or failed path outside the certified release evidence.
+4. Create annotated tag `v0.11.0` from the reviewed release commit and dispatch the protected workflow only after confirming npm still lacks that immutable version.
+5. Verify the exact published tarball, `latest` tag, integrity, and SLSA provenance before calling `0.11.0` released.

package/SUPPORT.md

@@ -1,10 +1,11 @@
 # Support
 
-Zhivex Harness `0.9.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
 
 ## Supported baseline
 
-- Bun `1.3.7` or newer;
+- Node.js `22.13.0` or newer; Node 24 LTS is the release and default OCI baseline;
+- Bun `1.4.0` or newer when contributing to this repository or operating a Bun-managed target repository;
 - macOS and Linux, as exercised by CI;
 - Git workspaces;
 - the provider/model combinations marked certified in the package documentation; and

package/dist/cli.d.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
 import { type AgentApprovalRequest, type AgentRunInput, type AgentRunOutput, type AgentRunState, type AgentStatus } from "@zhivex-ai/agents";
 import { providerAvailability, resolveHarnessConfig, type HarnessConfig, type HarnessConfigInput, type HarnessProvider, type HarnessSubagentProfile } from "./config.js";
 import { type ZhivexHarness } from "./harness.js";
@@ -55,6 +55,7 @@ export interface CliOptions {
     ociRuntime?: string;
     ociImage?: string;
     ociAllowedCommands?: string[];
+    ociShellMode?: string;
     ociMaxProcessRuntimeMs?: number;
     ociMaxProcessOutputBytes?: number;
     ociMaxMemoryMb?: number;
@@ -64,6 +65,8 @@ export interface CliOptions {
     ociMaxFileWriteBytes?: number;
     ociTmpfsMb?: number;
     mcpConfigPath?: string;
+    contextConfigPath?: string;
+    projectContext?: boolean;
     prompt?: string;
     runId?: string;
     idempotencyKey?: string;
@@ -200,6 +203,7 @@ export interface DoctorReport {
         allowedChecks: readonly string[];
         requiredCapabilities: ReturnType<typeof resolveHarnessConfig>["requiredCapabilities"];
         orchestration: ReturnType<typeof resolveHarnessConfig>["orchestration"];
+        context: ReturnType<typeof resolveHarnessConfig>["context"];
         execution: ReturnType<typeof resolveHarnessConfig>["execution"];
         mcpConfigPath?: string;
     };
@@ -208,10 +212,12 @@ export interface DoctorReport {
 }
 export interface DoctorContext {
     env?: NodeJS.ProcessEnv;
+    nodeVersion?: string;
+    /** @deprecated Test-only compatibility injection for the secondary Bun runtime. */
     bunVersion?: string;
     ociRuntimeAdapter?: HarnessOciRuntimeAdapter;
 }
-export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
+export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociShellMode" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath" | "contextConfigPath" | "projectContext">, context?: DoctorContext) => Promise<DoctorReport>;
 export declare const formatDoctorReport: (report: DoctorReport) => string;
 export declare const cliExitCodeForError: (error: unknown) => 1 | 2;
 export declare const main: (argv?: string[]) => Promise<void>;