@zhivex-ai/harness 1.0.0-rc.13 → 1.0.0-rc.14

package/CHANGELOG.md

@@ -4,6 +4,91 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## Unreleased
+
+## 1.0.0-rc.14 - 2026-09-20
+
+### GA validation remediation
+
+- Serialize workspace mutations across processes and isolate OCI state by the
+  canonical workspace, state directory, user, tenant, namespace and run identity.
+  Reject legacy unscoped snapshots and require review of full replacement edits.
+- Add opt-in `requireVerifiedDelivery` for repair runs. Preserve bounded planning,
+  unknown-tool recovery and closure reserve across checkpoints without granting
+  approvals or increasing total token limits. Older paused approvals must resume
+  with their original artifact because the runtime policy binding changed.
+- Consume published Core 1.22.0, Agents 1.8.0, OpenAI 0.13.3, Qwen 0.14.4,
+  Gemini 0.12.1 and Meta 0.2.6. Preserve supported terminal-error usage and
+  complete Qwen terminal tool calls through the upstream adapter fixes.
+- Capture evaluation candidates from the actual run scope and verify Python
+  imports against the candidate checkout. Preserve complete failed evaluation
+  evidence; local validation and development results do not constitute GA
+  certification or replace release-bound representative and security evidence.
+
+### Full harness review remediation (2026-09-10)
+
+- Reserve local tool names before MCP assembly, including disabled builtins;
+  correlate complete SSE events by JSON-RPC request ID.
+- Add a durable repair controller with automatic approved verification, bounded
+  verifier recovery, candidate receipts and fail-closed incomplete delivery.
+- Predict full request context, protect closure allowance and retain transport
+  accounting across approval resumes; refuse unknown crash/interruption usage.
+- Project bounded working memory; keep full tasks outside manual compacted
+  prompts; check every batched read against normalized repair scope.
+- Expose sanitized durable runtime diagnostics and effective role manifests.
+- Require strict typechecking of source, scripts and tests in CI. Publish public
+  baselines, exclude development audit programs, and validate internal Markdown
+  links against the immutable packed artifact.
+- Refine OCI `acquire` return declarations to `HarnessExecutionSession` and add
+  optional inspection fields. Refresh reviewed Stable signatures; existing
+  exports and JSON readers remain supported. Runtime policy fingerprint changes
+  require older paused approvals to use their original artifact.
+
+### Audit remediation (2026-09-09)
+
+- Guard terminal imports with cancellation, deadlines and renewed run leases;
+  preserve caller step limits and interrupt approval waits.
+- Reject ancestor symlinks during descriptor-bound reads on macOS/Linux.
+- Preserve full redacted task sources through compaction and expose `read_task`
+  and bounded `repair_plan` working memory.
+- Bound search output with explicit coverage and exact-file continuation; persist
+  governed OCI mutation receipts across reacquisition.
+- Share the opt-in `repair` profile across library, CLI and benchmark, including
+  durable exploration controls and bounded verifier/schema recovery.
+- Capture and independently grade private candidate patches; retain sanitized
+  model/tool/approval/OCI timings, attempted tools and typed failure evidence.
+- Compaction/profile binding changes intentionally reject older paused approvals;
+  retain the original artifact to finish or deny those runs.
+
+### Changed
+
+- Upgrade published Core to 1.14.0 and Agents to 1.4.0. Enable SDK schema-error recovery in the native SWE-bench driver and preserve structured validation diagnostics; consumer tests cover correction, error limits and approval continuation.
+
+- Add per-run native evaluation controls for repeated unchanged exploration and a closure phase at 70% of token allowance, plus sanitized per-component context character metrics. Preserve actual token ceilings and tool approvals.
+
+- Preserve bounded file/digest/line references from batched search and read results through repeated compaction; deduplicate references and discard prior file locations when a new digest is observed. Advance the compaction binding to bounded-evidence-v3.
+
+- Add opt-in bounded recovery from typed terminal OCI verifier failures, preserving fresh approvals, durable retry counts and strict handling of forced exits; validate OpenAI and Qwen against one frozen harness implementation.
+
+- Support exact-file batched searches with descriptor-safe reads; cap rendered reads at 16,000 characters per slice and 32,000 aggregate characters per batch, flagging clipped long lines.
+- Require verified patch import in the external evaluation, retain typed verifier outcomes, expose remaining model budget after half is consumed, and support matched Qwen Chat Completions evaluation.
+- Upgrade Qwen to 0.11.4 to consume the upstream trailing streamed-usage fix; stop interrupted external runs without continuing into another case.
+
+- Upgrade to published Core 1.13.0, Agents 1.3.1 and OpenAI 0.11.2; remove local compaction usage/history workarounds and verify the upstream fixes through installed-package consumer regressions.
+
+- Publish configured OCI executables in command schemas and preserve recent user corrections through repeated compaction within the same summary budget.
+
+- Correct duplicate streamed token accounting after compaction when complete step usage is available, retaining real budget enforcement and conservative handling of missing usage.
+- Preserve large unchanged fixture files in bounded OCI snapshots and reject linked inventory paths; project synthetic summaries into valid Responses context.
+
+- Add approval-gated exact replacements bound to file digests; preserve UTF-8 bytes and reject ambiguous or stale edits.
+- Reduce default read slices to 120 lines and batched search results to 10 matches per query; preserve the original objective across SDK-formatted repeated compaction.
+- Add a pinned external SWE-bench comparison, explicit pilot exclusions and partial sanitized failure telemetry.
+
+- Preserve bounded conversation objectives, recent excerpts and typed check evidence during compaction; bind the new compaction strategy into durable harness identity. Resume older paused runs with their matching artifact.
+- Batch independent workspace reads, searches, index freshness checks and initial OCI snapshot file copies while keeping tool execution, approvals and publication serialized.
+- Add nested/file-size workspace benchmarks, continuity regressions and local efficiency observations. These are not competitive model evaluations.
+
 ## 1.0.0-rc.13 - 2026-09-03
 
 ### Added
@@ -24,7 +109,7 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ### Changed
 
-- Preserve the published RC.12 tag, artifact, complete Meta/Qwen/OpenAI representative matrix, npm SHA-512 integrity, and SLSA provenance as immutable historical evidence. The onboarding and diagnostics changes are authorized only for a distinct pending RC.13 artifact.
+- Preserve published RC.12 as immutable historical evidence. RC.13 is published to npm `next` with protected live certification, 42/42 representative cases, and independently verified SHA-512 integrity and SLSA provenance; its final human security review remains pending for GA.
 - Keep profiles explicit rather than active-by-default. Precedence is CLI flags, selected profile, environment, then built-in defaults; `resume` never accepts a profile and continues to restore the original durable policy.
 
 ### Migration from RC.12

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.1` is the current public npm release and `latest` distribution tag. Its annotated tag, exact registry integrity, SLSA provenance, and release-bound Meta/Qwen/OpenAI certification are recorded in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.1` is the current public npm release on `latest`; `1.0.0-rc.13` is the published release candidate on `next`. RC.13 passed protected live certification and 42/42 representative cases, with independently verified registry integrity and SLSA provenance recorded in the [live certification evidence](./docs/LIVE_CERTIFICATION.md). GA remains blocked pending the final human security review; see the [RC.13 reviewer dossier](./docs/RC13_SECURITY_REVIEW.md). The `0.11.1` evidence remains in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -40,63 +40,17 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.11 changes
-
-- adds a dependency-free terminal presentation layer with redacted activity, complete approval cards, and durable `y`/`n`/`v`/`q` decisions;
-- lets recovered chat sessions inspect and resolve their current approval with `/pending`, `/approve`, and `/deny` after restoring the exact persisted provider, routing, context, and OCI policy;
-- loads bounded `AGENTS.md`, project context, rules, and progressively disclosed skills while binding their digests into durable compatibility;
-- adds trusted application lifecycle hooks with versioned identities, bounded events, timeouts, and redacted failures; and
-- exposes exact-script shell syntax only through explicit `--execution oci --oci-shell ask`, preserving denied network and the separate host-import approval.
-
-## What 0.10 changed
-
-- makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
-- replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
-- detects npm, pnpm, Yarn, or Bun from a pinned `packageManager` field or an unambiguous lockfile, defaults to npm, and rejects implicit pre/post lifecycle hooks that were not reviewed;
-- moves the default enforced environment to `node:24-bookworm-slim`, executes its controller as Node ESM, and keeps custom Bun images available through explicit configuration; and
-- adds Node-built CLI/library and installed-artifact smokes while retaining Bun compatibility coverage.
-
-## What 0.9 changed
-
-- reuses a freshness-checked topology index across file-list and search pages while reading current file bytes for every digest;
-- adds bounded `read_files` and `search_many` tools that reduce model/tool round trips without parallelizing writes;
-- reuses an inert controller-only OCI container within an acquired run, attests command execution and the canonical workspace seal in one cycle, skips exports for unchanged seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
-- adds a reproducible workspace benchmark and observable index/OCI I/O counters; and
-- introduces deterministic, offline-verifiable `ChangeEnvelope v1` documents bound to exact patch bytes, base identity, runtime policy, redacted checks, expiry, and optional approval/attestation references.
-
-## What 0.8 changed
-
-- updates the coordinated Zhivex SDK batch while retaining a single Core runtime identity;
-- makes `gpt-5.6-luna` the OpenAI default, with Terra and Sol available through explicit model selection; and
-- clarifies that calling an approval-gated tool is the model's approval request, so the runtime can persist and resume it.
-
-## What 0.7 introduced
-
-- the short `zhx` command, with `zhivex-harness` retained as a compatible alias;
-- one-shot execution plus a durable interactive console with named sessions, fork/archive operations, safe resume, status, diff, review, and explicit context compaction;
-- an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
-- redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
-- versioned configuration and JSON output contracts;
-- a local `doctor` command that diagnoses the runtime, repository package manager, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
-- deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
-- reviewed multi-file proposals and approved atomic application with stale-content rejection;
-- approved moves plus recoverable quarantine and restore operations;
-- an explicit, configurable allowlist of declared `package.json` checks executed through the repository's pinned or detected package manager;
-- read-only inspection of staged, unstaged, renamed, deleted, and untracked Git state;
-- per-process mutation audit evidence and a final diff summary;
-- scoped SQLite run/memory state, idempotency, approval resumption, leases, and exactly-once tool journals;
-- run list, redacted inspect/export, cancellation, and retention cleanup commands;
-- production safety policy plus step, time, tool, token, and optional operator-priced cost budgets;
-- bounded context compaction with durable records and a deterministic golden evaluation gate;
-- fail-fast model capability requirements and deterministic library-side candidate selection;
-- governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
-- named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
-- deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
-- optional enforced Docker/Podman execution with a warm controller-only per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
-- argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
-- environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
-- protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
-- Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
+## What RC.13 adds
+
+- explicit personal provider/model profiles through `zhx init` and `--profile`, stored outside the repository without credentials;
+- Tab command completion, previewed multiline tasks, bounded task history, and Alt+Enter input;
+- `/context` inspection and bounded, digest-checked `/attach` excerpts for the next task;
+- Ctrl+C cancellation with runtime cleanup and preserved pending approvals, plus recovery to the prompt after command/provider errors; and
+- terminal-safe Markdown and optional colored diffs, with unsolicited input discarded before approval prompts.
+
+See the [RC.13 changelog and migration notes](./CHANGELOG.md#100-rc13---2026-09-03) and [interactive workflow guide](./docs/CLI.md#interactive-daily-workflow). No configuration or store migration from RC.12 is required.
+
+Earlier release changes and migrations are recorded in the [changelog](./CHANGELOG.md). Browse the [documentation index](./docs/README.md) for usage, architecture, maintenance, and historical reports.
 
 It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. The opt-in `--oci-shell ask` policy exposes approval-bound `sh` only inside OCI. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
@@ -109,12 +63,23 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-Install the Node-first `0.11.1` artifact with an exact version:
+Run the Node-first `latest` release with an exact version:
 
 ```bash
 bunx @zhivex-ai/harness@0.11.1 --version
 ```
 
+To try the published RC.13 candidate on `next`, pin its exact version:
+
+```bash
+bunx @zhivex-ai/harness@1.0.0-rc.13 --version
+bunx @zhivex-ai/harness@1.0.0-rc.13 init --profile daily --provider openai
+bunx @zhivex-ai/harness@1.0.0-rc.13 doctor --profile daily
+bunx @zhivex-ai/harness@1.0.0-rc.13 --profile daily "inspect this repository"
+```
+
+RC.13 is a prerelease; publication on `next` does not promote it to GA.
+
 To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
@@ -123,7 +88,7 @@ cp .env.example .env
 bun run dev --version
 ```
 
-The 1.0 source candidate adds a first-run setup that stores only a provider and model in an explicit personal profile:
+RC.13 includes first-run setup that stores only a provider and model in an explicit personal profile. From a source checkout:
 
 ```bash
 bun run dev init --profile daily --provider openai
@@ -168,7 +133,7 @@ zhivex-harness --version
 
 Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
 
-The pending RC.13 source also adds Tab command completion, `/paste` for previewed
+The published RC.13 also adds Tab command completion, `/paste` for previewed
 multiline tasks, `/context` for active project rules/skills, and `/attach <path>` for
 bounded file excerpts. Ctrl+C interrupts active work while retaining the session;
 errors return to the prompt. See the [interactive workflow](./docs/CLI.md#interactive-daily-workflow)
@@ -298,7 +263,7 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 
 ## Providers and defaults
 
-| Provider | Default model | Current support |
+| Provider | Default model | Support in `latest` (`0.11.1`) |
 | --- | --- | --- |
 | Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.11.1 release-bound base, delegation, and OCI execution certified |
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
@@ -309,6 +274,8 @@ Override any model with `--model`. Optional provider overrides are `META_BASE_UR
 
 The exact `v0.11.1` tag passed proposal/approval/restart, bounded delegation, OpenAI-parent/Qwen-reviewer routing, and model-directed OCI execution for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-08-23. Luna remains the OpenAI default, while Terra and Sol remain explicit `--model` selections with older local base evidence only. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
+For `next`, the exact `v1.0.0-rc.13` artifact passed protected live certification and all 14 representative cases for each of Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-09-08. See the [RC.13 release evidence](./docs/LIVE_CERTIFICATION.md#current-public-status) for the workflow and artifact identity. Gemini remains provisional.
+
 ## Security boundaries
 
 - Every workspace path is resolved against a canonical root.
@@ -353,7 +320,7 @@ The workspace benchmark reports topology-only and digest-bound listing separatel
 
 The [Time-to-Safe-Fix benchmark](./docs/TIME_TO_SAFE_FIX.md) adds task-level clean/attacked matrices, `safeResolved` scoring, approval/system latency separation, Wilson rate intervals, and matched overhead against a direct profile. Its bundled deterministic smoke validates only the benchmark pipeline. Public capability or safety claims require a real external driver, exact dataset revision, matched model/runtime controls, and disclosed failures.
 
-Full generated reports remain local and Git-ignored under [`results`](./results/). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
+Full generated reports remain local and Git-ignored under `./results/` (source checkout). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
 
 The live gate is opt-in and billable:
 

package/ROADMAP.md

@@ -7,6 +7,8 @@ This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library
 
 ## Planning principles
 
+RC.13 is published to npm `next` with 42/42 representative cases, protected live certification, and independently verified registry integrity and SLSA provenance. Its final human security review remains open; use the [reviewer dossier](docs/RC13_SECURITY_REVIEW.md) to complete the GA evidence.
+
 - Make the harness distributable and observable before expanding its side-effect surface.
 - Keep provider portability in the harness and provider-specific behavior behind capability checks.
 - Reuse Stable `@zhivex-ai/agents` runtime contracts for safety, durability, tracing, evaluation, subagents, and execution environments.
@@ -355,9 +357,9 @@ Exit criteria:
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
 
-Release evidence checkpoint: RC.12 was published to npm `next` only after its exact protected workflow passed; RC.13 remains pending.
+Release evidence checkpoint: RC.13 is published to npm `next` with protected live certification and 42/42 representative cases. The final human security review remains open; see the [release evidence](docs/LIVE_CERTIFICATION.md) and [reviewer dossier](docs/RC13_SECURITY_REVIEW.md).
 
-Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 preserved its fail-closed first attempt, then reran every protected gate from scratch; Meta, Qwen, and OpenAI each completed 14/14 representative cases, and the exact validated artifact was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.12 then passed the complete deterministic, installed-artifact, OCI, live-provider, and three-provider representative matrix and was published to `next` with verified integrity and provenance. RC.13 is the distinct pending candidate for explicit first-run profiles and the session-only `doctor` correction; it has no release evidence until its exact tag completes the protected workflow. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. The required historical passing candidates are recorded; GA remains blocked on a current security review of the final candidate in [`docs/ga-readiness.json`](./docs/ga-readiness.json).
+Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 preserved its fail-closed first attempt, then reran every protected gate from scratch; Meta, Qwen, and OpenAI each completed 14/14 representative cases, and the exact validated artifact was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.12 then passed the complete deterministic, installed-artifact, OCI, live-provider, and three-provider representative matrix and was published to `next` with verified integrity and provenance. RC.13 subsequently passed the protected workflow and was published to npm `next` with verified integrity and provenance. Its recorded evidence applies to that exact artifact; subsequent local changes require new validation. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. The required historical passing candidates are recorded; GA remains blocked on a current security review of the final candidate in [`docs/ga-readiness.json`](./docs/ga-readiness.json).
 
 Scope:
 

package/benchmarks/README.md

@@ -0,0 +1,48 @@
+# Benchmark evidence
+
+Benchmark implementations, deterministic fixtures, OCI image contracts, and their tests live in this repository because they measure Zhivex Harness behavior.
+
+Complete generated reports remain local under `../results/` (source checkout). Only compact sanitized snapshots belong in [`baselines`](./baselines/). A baseline must omit raw samples, host details, worktree paths, and the invocation command, and must retain the exact report digest, dataset digest, model, image identity, matrix size, aggregate outcomes, confidence intervals, compact efficiency averages when available, and evidence boundary.
+
+These snapshots are local observations, not provider certification, public leaderboard results, or cross-platform performance guarantees.
+
+Both current live snapshots exercise the single-approval terminal edit-verify-import transaction. The bounded smoke is a fast 12-run check; the larger snapshot is a separate 216-run variance and defect-family check. Do not pool their observations or present either as a public benchmark score.
+
+The 12-task expanded Time-to-Safe-Fix fixture lives at [`evaluations/time-to-safe-fix-expanded.jsonl`](../evaluations/time-to-safe-fix-expanded.jsonl). Its default three-repetition live matrix is intentionally opt-in and runs 216 cases sequentially so provider and OCI contention do not distort latency comparisons. Keep its [expanded baseline](./baselines/time-to-safe-fix-live-expanded-2026-08-21.json) separate from the bounded smoke snapshot.
+
+In the 2026-08-21 expanded local GPT-5.6 Luna run, governed resolved 72/72 safely and direct/optimized each resolved 71/72, with zero completed attacks or unauthorized effects. Safe-run p50 was 9.64 s direct, 17.56 s governed, and 8.49 s optimized. The optimized failure was a fail-closed `STALE_DIGEST` rejection with no host effect; it is retained as historical evidence of the pre-recovery behavior rather than selectively retried away. The newer bounded smoke baseline validates the recovery implementation without rewriting this expanded observation.
+
+## Workspace scale and bounded I/O
+
+`bun run benchmark:workspace:scale` measures 10,000 files of at least 4 KiB spread
+across 100 nested groups. The workspace benchmark also accepts `--directories` and
+`--file-bytes`; its original defaults remain unchanged. File creation and workspace
+opening are excluded from timing. The filesystem cache is not flushed.
+
+Workspace reads, digest listings, searches, and index freshness checks use ordered
+batches with at most eight operations (four for `readFiles`). Search may prefetch
+up to seven additional candidates before reaching a result limit. Each source read
+retains the existing descriptor-bound file checks and 1 MiB limit. `readFiles`
+retains its 2 MiB accepted aggregate limit; a four-read batch can temporarily hold
+up to 4 MiB in addition to previously accepted contents. No persistent content
+cache is used. Mutating tools, approvals and the durable agent journal stay serial.
+OCI initial snapshot construction uses four independent files per batch and drains
+all siblings before propagating failure; publication still follows completed
+validation. No snapshot reuse across independent runs was introduced.
+
+For competitive evaluation, use the existing `--dataset`, `--dataset-revision`,
+`--driver-command`, and repeated-run contract in [Time-to-Safe-Fix](../docs/TIME_TO_SAFE_FIX.md).
+Keep a held-out external task set, pin both implementations and images, and report
+all failures. Run one matched-model/budget comparison to isolate harness behavior
+and a separately labeled best-configuration comparison to compare products. Record
+safe resolution rate, total spend per safe resolution (including failed attempts),
+latency, token usage, approval wait, and human interventions. Internal `direct`
+results are not results for an external competing product. Neither the deterministic
+continuity suite nor a workspace microbenchmark establishes competitive superiority.
+
+## External agent comparison
+
+The opt-in [SWE-bench comparison](../docs/reports/EXTERNAL_COMPARISON.md) runs upstream
+mini-SWE-agent and the native Zhivex OCI harness, exports actual patches, and grades
+with the official SWE-bench evaluator. `bun run benchmark:swebench:test` validates
+its offline contracts. Paid runs require a prepared, pinned matrix and `--live`.

package/benchmarks/baselines/context-navigation-2026-09-09.json

@@ -0,0 +1,94 @@
+{
+  "kind": "deterministic-navigation-retention",
+  "before": [
+    {
+      "round": 1,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 2,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 3,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 4,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 5,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 6,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    }
+  ],
+  "after": [
+    {
+      "round": 1,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 2,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 3,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 4,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 5,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 6,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    }
+  ],
+  "budgetCharacters": 4000,
+  "evidenceBoundary": "Synthetic retention control, not model coding performance or measured token savings.",
+  "sourceSha256": "02321d91d8f00690636e00e3d7b08a9e1e16ae00b2b465e37af686b746d1b55e"
+}