@zhivex-ai/harness 1.0.0-rc.14 → 1.0.0

package/CHANGELOG.md

@@ -6,6 +6,23 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ## Unreleased
 
+## 1.0.0 - 2026-09-20
+
+### GA promotion
+
+- Promote the RC.14 runtime and dependency set without further runtime changes.
+  Stable API/CLI/schema contracts, supported Node runtimes and migration policies
+  are defined in the published stability and support documents.
+- Bind readiness to the published RC evidence, including RC.14 protected live
+  certification and its complete 42-case Meta/Qwen/OpenAI representative matrix.
+  Gemini remains provisional and outside the GA-certified cohort.
+- Complete the artifact-bound security assessment under the explicitly documented
+  RC.14-only delegated AI review exception. This is not an independent human audit.
+  Preserve all four resolved findings, residual risks and negative exploratory
+  SWE-bench results; no broad coding-accuracy claim is made.
+- Existing paused approvals remain bound to their original artifact. Stable
+  publication and provenance require their own protected release workflow.
+
 ## 1.0.0-rc.14 - 2026-09-20
 
 ### GA validation remediation

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.1` is the current public npm release on `latest`; `1.0.0-rc.13` is the published release candidate on `next`. RC.13 passed protected live certification and 42/42 representative cases, with independently verified registry integrity and SLSA provenance recorded in the [live certification evidence](./docs/LIVE_CERTIFICATION.md). GA remains blocked pending the final human security review; see the [RC.13 reviewer dossier](./docs/RC13_SECURITY_REVIEW.md). The `0.11.1` evidence remains in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `1.0.0` is the current source release candidate for stable publication; it is not yet published. The latest public stable release remains `0.11.1`, and `1.0.0-rc.14` is published on `next`. RC.14 passed protected live certification and 42/42 representative cases; its security review is complete under the explicit [user-delegated AI exception](./docs/RC14_DELEGATED_SECURITY_DECISION.md), not an independent human audit. The [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json) records the pending stable candidate. Stable publication requires its own deterministic, installed-package, OCI, live-provider and representative gates and verified provenance. See the [readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), [threat model](./docs/THREAT_MODEL.md), [roadmap](./ROADMAP.md) and [changelog](./CHANGELOG.md).
 
 ## Why Zhivex Harness
 

package/ROADMAP.md

@@ -5,9 +5,13 @@
 
 This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.1` are published on npm. Version `0.11.1` delivers file and release hardening without a `0.11.x` contract change; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
+Version `1.0.0` is the local source release candidate. It is not yet tagged or published as a new artifact. Its protected stable certification and publication remain pending; published RC.14 evidence supports preparation, not a claim that stable bytes have shipped.
+
 ## Planning principles
 
-RC.13 is published to npm `next` with 42/42 representative cases, protected live certification, and independently verified registry integrity and SLSA provenance. Its final human security review remains open; use the [reviewer dossier](docs/RC13_SECURITY_REVIEW.md) to complete the GA evidence.
+RC.13 is published to npm `next` with 42/42 representative cases, protected live certification, and independently verified registry integrity and SLSA provenance. Its [reviewer dossier](docs/RC13_SECURITY_REVIEW.md) remains historical context.
+
+RC.14 is published to npm `next` with all protected live gates and 42/42 representative cases passed; independent verification matched registry integrity and SLSA provenance. RC.14 now has a completed Codex security review under an explicit [user-delegated AI exception](docs/RC14_DELEGATED_SECURITY_DECISION.md), with no identified open critical/high findings. This is not an independent human audit; use the [current reviewer dossier](docs/RC14_SECURITY_REVIEW.md). The separate failed exploratory SWE-bench cohort is preserved and does not become passing evidence.
 
 - Make the harness distributable and observable before expanding its side-effect surface.
 - Keep provider portability in the harness and provider-specific behavior behind capability checks.

package/docs/GA_READINESS.md

@@ -20,9 +20,10 @@ The preparation gate does not certify production readiness. It verifies that pub
 6. Preserve `1.0.0-rc.10` as an immutable failed attempt: its exact tarball passed artifact binding, but an OpenAI account-funding issue surfaced as retryable HTTP 500 failures in live and representative gates and Qwen resolved 13/14 representative cases; npm publication was skipped.
 7. Preserve the published `1.0.0-rc.11` evidence: OpenAI's release precheck and Qwen's complete representative precheck passed, the protected workflow's first attempt failed closed on one Qwen representative case without publishing, and its complete second attempt passed every live and representative gate before publishing the exact artifact to `next` with verified npm integrity and SLSA provenance.
 8. Preserve the published `1.0.0-rc.12` evidence: the protected workflow passed deterministic, installed-artifact, OCI, live-provider, complete Meta/Qwen/OpenAI representative, registry-integrity, and SLSA-provenance gates for the exact annotated tag.
-9. Preserve published RC.13, including onboarding, daily console workflow, cancellation, and diagnostics: protected workflow `34263591864` passed all live gates and 42/42 representative cases, then published `next` with independently verified integrity and SLSA provenance. Review this final recorded candidate using [the RC.13 reviewer dossier](./RC13_SECURITY_REVIEW.md).
-10. Record a current security review with no open critical/high findings against the final passing candidate.
-11. Change the readiness phase to `ready` only after all evidence is committed and passes the release gate.
-12. Publish `1.0.0` to `latest`; never promote an RC by merely moving a dist-tag.
+9. Preserve published RC.13, including onboarding, daily console workflow, cancellation, and diagnostics: protected workflow `34263591864` passed all live gates and 42/42 representative cases, then published `next` with independently verified integrity and SLSA provenance. Retain [the RC.13 reviewer dossier](./RC13_SECURITY_REVIEW.md) as historical context.
+10. Record published RC.14: protected workflow `35510484383` passed all live gates and 42/42 representative cases, and independent verification matched the published `next` artifact integrity and SLSA provenance. The final candidate is now RC.14; use [its reviewer dossier](./RC14_SECURITY_REVIEW.md).
+11. RC.14 has a completed Codex security review with no identified open critical/high findings under the explicit [user-delegated AI exception](./RC14_DELEGATED_SECURITY_DECISION.md). This is not an independent human audit; the strict artifact/workflow/coverage verifier remains unchanged.
+12. Change the readiness phase to `ready` only after all evidence is committed and passes the release gate.
+13. Publish `1.0.0` to `latest`; never promote an RC by merely moving a dist-tag.
 
 Gemini is explicitly provisional and excluded from the 1.0 GA-certified cohort. The decision and its promotion criteria are recorded in [GEMINI_1_0_DECISION.md](./GEMINI_1_0_DECISION.md); partial or capacity-blocked evidence is never certification.

package/docs/RC14_DELEGATED_SECURITY_DECISION.md

@@ -0,0 +1,80 @@
+# RC14 delegated security decision
+
+## Authorization and attribution
+
+On 2026-09-20, after the independent-human-review requirement and the pending
+RC14 dossier had been explained, the requesting user instructed:
+“Haz la revision humana, confiamos en tu criterio”. This explicitly delegates
+the technical security judgment to Codex. It does not make Codex a human.
+
+For this exact RC14 promotion decision, the project records an explicit exception
+to the independent human authorship requirement: the review is performed by
+Codex, an AI assistant acting under that delegation. No human signature,
+independent human audit, OpenAI organizational certification or external auditor
+accreditation is asserted. This exception does not apply automatically to a new
+candidate or future releases. The user has delegated judgment, not personally
+attested to inspection of each source file or test.
+
+The machine-readable review identifies Codex explicitly. Its HTTPS identity
+identifies the Codex service, not a human reviewer. This policy decision is
+reviewable in the same PR as the evidence. No evidence-validator code, severity
+threshold, coverage inventory, provenance check or runtime approval is relaxed.
+
+## Object and method
+
+- Candidate: `v1.0.0-rc.14`, commit `d1c5abcc6d1fa482c211c4327c86f592663d559b`.
+- Exact artifact identity and observation time: `../security-reviews/rc14-review.json` in the source checkout.
+- Verification record: [delegated review evidence](reports/evidence/rc14-delegated-security-review-2026-09-20.json).
+- Scope: 10 controls, 11 trust boundaries and 31 authority-bearing tool classes.
+
+This review continues the directed source assessment recorded on 2026-09-19,
+assesses the subsequent security and repair-controller changes, and binds the
+decision to the final published candidate. Changes after that candidate are
+documentation and evaluation evidence; runtime and dependency files are
+unchanged. Historical review findings are preserved rather than erased.
+
+The final assessment includes approval payload visibility and replay binding,
+descriptor-bound repository reads, mutation concurrency, complete OCI scope
+identity and import, scoped durable state, task memory, MCP authority, delegation,
+subprocess isolation, budget failure accounting, bounded repair recovery,
+personal profiles and publication identity. It is not an exhaustive audit of
+all transitive dependency source or a proof that unknown vulnerabilities are absent.
+
+Fresh validation passed the five adversarial checks (four original findings plus
+the stale-digest control) and 137 security/regression tests across ten files,
+with 659 assertions. Published bytes, the `next` tag and SLSA source/workflow
+binding were reverified. The unchanged review validator also checks the exact
+candidate's CI, CodeQL, dependency audit, OCI and protected release workflows.
+
+## Findings and judgment
+
+The four known findings are resolved by the changes merged in PR #77 and present
+in the published candidate: `sec-04` (high, cross-scope OCI artifacts), `sec-01`
+(medium, concurrent writes), `sec-02` (medium, replacement visibility), and
+`sec-03` (low, incomplete authority inventory). Lowercase IDs in the final JSON
+are the schema-compatible spellings of the historical uppercase IDs.
+
+There are no identified open critical or high findings in this directed review.
+The security decision is **passed under the explicit delegated-AI exception**,
+within the documented threat model. This is not a statement that risk is zero.
+
+Residual risks remain material: the host account/kernel/daemon and configured
+service identities are trusted; approved services receive their inputs; pattern
+redaction is incomplete; cooperative locks do not govern external writers or
+provide power-loss atomicity for all files; approved host execution can run
+repository code; a model-authored verifier may be inadequate. Simple
+`apply_environment_patch` imports do not themselves execute a verifier. The
+operator must assess the granted authority and verifier coverage.
+
+The separate fresh SWE-bench cohort remains Harness 0/5 versus control 1/5.
+The protected representative matrix passed 42/42 on RC14, but that does not
+establish broad coding accuracy or reverse the exploratory result. This
+decision addresses the security gate only.
+
+## Remaining promotion work
+
+The security ledger may reference this completed review with the exception
+visible in the readiness documentation. GA still requires the exact `1.0.0`
+version, readiness phase, release checks and protected stable publication,
+followed by verification of its own artifact. No tag, dist-tag or package is
+published by this review.

package/docs/RC14_SECURITY_REVIEW.md

@@ -0,0 +1,40 @@
+# RC.14 security review dossier
+
+Current decision: the [delegated AI review](RC14_DELEGATED_SECURITY_DECISION.md) is complete, with no identified open critical/high findings. Its machine-readable result is `../security-reviews/rc14-review.json` in the source checkout. This is an explicitly authorized exception to human authorship, not a human signature. The original preparation instructions and pending draft below are retained as history.
+
+## Historical preparation instructions
+
+This dossier prepares the independent human review required by HAR-HU-03. It is not a completed security review and does not authorize GA. The machine-prepared `../security-reviews/rc14-review-draft.json` (source checkout) deliberately fails the passing-review schema: reviewer, date, coverage decisions, and findings must be supplied or confirmed by the human reviewer. Copied control-map text is a review starting point, not evidence that the reviewer assessed it. The draft includes all four known findings with their technically verified remediation; the reviewer must confirm dispositions, supply owners, and add any further findings. Their presence does not establish a completed human review.
+
+The draft now includes machine-prepared source and regression references for all 10 controls, 11 trust boundaries and 31 authority-bearing tools. Technical notes incorporate the published RC14 remediation evidence; they do not carry forward the original pre-remediation findings as current defects. Residual-risk statements are proposed review inputs, not accepted risks. Every coverage decision remains pending, and reviewer identity, timestamp and finding owners remain unset. Source paths refer to the exact candidate commit below; the original automated review remains historical evidence.
+
+## Exact candidate
+
+- Tag: `v1.0.0-rc.14`
+- Commit: `d1c5abcc6d1fa482c211c4327c86f592663d559b`
+- npm: `@zhivex-ai/harness@1.0.0-rc.14` on `next`
+- SHA-512: `sha512-UMu4JFUNs/kOTJETZSJMMvVYlo+a4MKG6PoSvE313QxMEqK1z420AXVgPOGJ8jj2jp6mQud/Rvc7+ixKyH/4og==`
+- [Protected release, audit, OCI, and 42 representative cases](https://github.com/Zhivex/zhivex-harness/actions/runs/35510484383)
+- [CI at the candidate commit](https://github.com/Zhivex/zhivex-harness/actions/runs/35510241338)
+- [CodeQL at the candidate commit](https://github.com/Zhivex/zhivex-harness/actions/runs/35510241346)
+- [Registry attestation](https://registry.npmjs.org/-/npm/v1/attestations/@zhivex-ai%2fharness@1.0.0-rc.14)
+
+The release completed successfully. Meta, Qwen, and OpenAI each passed the complete 14-case inventory. Independent verification matched the published bytes, dist-tag, SLSA source/workflow binding, and exact artifact content; the protected workflow also installed and exercised the same tarball. This evidence does not replace human assessment of residual risk.
+
+## Reviewer work
+
+1. Inspect the exact tag and published artifact; verify its hash and provenance. Review [the threat model](THREAT_MODEL.md), [control map](../contracts/security-controls.json), and [schema requirements](SECURITY_REVIEW_EVIDENCE.md).
+2. Review all controls, trust boundaries, and authority-bearing tools enumerated in the draft. For every entry record the mitigation actually reviewed, regression evidence, and residual risk. Check approval replay/substitution, hostile repository instructions, protected files and symlinks, SQLite scope/concurrency, subprocess/OCI boundaries, MCP, delegation, credentials, and supply-chain identity.
+3. Review the RC.14 changes: cross-process mutation locks; full replacement review; complete OCI scope identity; required verified delivery; bounded tool selection, planning and verifier recovery; durable usage and closure reserves; terminal provider usage/tool-call fixes; task memory and candidate export scope. Inspect implementations and regression evidence, including [the tagged security regressions](reports/evidence/rc14-security-regressions-2026-09-20.json), rather than relying solely on green CI.
+4. Record all findings, including resolved ones. Non-informational findings require owner, disposition, rationale, and HTTPS follow-up. Critical/high findings must be mitigated and resolved, not merely accepted. If a fix changes runtime code, create and certify a new immutable candidate before final review.
+5. Supply your name, HTTPS identity, and actual UTC review timestamp. Only mark reviewed coverage and the document `passed` after completing the review. Save the completed JSON as `security-reviews/rc14-review.json` and submit it for validation. Do not invent a passing status to satisfy the schema.
+
+## Mechanical promotion after review
+
+Validate the completed JSON against `scripts/security-review-evidence.ts`, update the ledger from its actual timestamp and finding counts, and close the security blocker through reviewed evidence. Then prepare exact `1.0.0` version/lockfile/changelog changes, set readiness to `ready`, and run `bun run readiness:1.0:release` plus the complete release checks. Merge the promotion changes before creating the annotated `v1.0.0` tag and dispatching the protected release to `latest`. Verify npm integrity, provenance, installation, and rollback references afterward. The reviewer is not required to publish or approve npm deployment.
+
+## Evaluation limits
+
+The protected representative matrix passed 42/42 cases on this exact artifact. The separate fresh SWE-bench exploratory cohort remains 0/5 for Harness versus 1/5 for control, and its subsequent known-case development rerun remained unresolved. Those failures are preserved in [the recovery report](reports/GA_REPAIR_RECOVERY_2026-09-19.md); representative certification does not replace them or establish broad coding-agent accuracy.
+
+The post-publication [GA gate result](reports/evidence/rc14-ga-gate-2026-09-20.json) retains five explicit failures: package version, readiness phase, open security blocker, missing passing review and missing review evidence path. Published RC and representative verification produced no additional failures. That gate record is historical. The completed delegated review closes the security-specific failures; package version, readiness phase and stable publication remain separate promotion work.

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
 # Release process
 
-`@zhivex-ai/harness@0.11.1` is the latest public npm release and `v0.11.1` its annotated tag. Its exact source, registry integrity, SLSA provenance, GitHub Release, and release-bound live-certification evidence are tracked in the mutable repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), which is intentionally excluded from immutable npm artifacts. Publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, certifies, transfers, and publishes one exact tag-bound tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything, and publication does not retroactively substitute for a missing live-provider gate.
+Version `1.0.0` is the current local source release candidate; stable publication is pending. `@zhivex-ai/harness@0.11.1` remains the latest public stable release. The mutable repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json) tracks the current candidate and is intentionally excluded from immutable npm artifacts. Its candidate source commit records the preparation baseline until an exact release commit is finalized. Publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, certifies, transfers and publishes one exact tag-bound tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything.
 
 ## Deterministic gates
 

package/docs/SECURITY_REVIEW_EVIDENCE.md

@@ -1,6 +1,8 @@
 # Security review evidence
 
-Harness 1.0 promotion requires one current, human-authored JSON review under `security-reviews/` bound to the final recorded release candidate. The reviewer must inspect the exact candidate, not a mutable branch or a different artifact.
+Harness 1.0 promotion normally requires one current, human-authored JSON review under `security-reviews/` bound to the final recorded release candidate. The reviewer must inspect the exact candidate, not a mutable branch or a different artifact.
+
+For RC14 only, the user explicitly delegated the assessment to Codex after the human-review requirement was explained. The [scoped decision record](RC14_DELEGATED_SECURITY_DECISION.md) permits the clearly attributed AI review for this candidate. It is not an independent human audit and does not change machine verification, coverage or severity requirements. Future candidates do not inherit this exception.
 
 The schema is implemented by `scripts/security-review-evidence.ts` and rejects unknown fields. A passing document records:
 

package/docs/ga-readiness.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "targetVersion": "1.0.0",
-  "phase": "preparation",
+  "phase": "ready",
   "evidenceMaxAgeDays": 30,
   "contractManifest": "contracts/public-api.json",
   "stabilityPolicy": "docs/STABILITY.md",
@@ -30,11 +30,11 @@
     ]
   },
   "securityReview": {
-    "status": "pending",
-    "criticalFindings": null,
-    "highFindings": null,
-    "observedAt": null,
-    "evidence": null
+    "status": "passed",
+    "criticalFindings": 0,
+    "highFindings": 0,
+    "observedAt": "2026-09-20T13:25:48.476Z",
+    "evidence": "security-reviews/rc14-review.json"
   },
   "releaseCandidates": [
     {
@@ -260,16 +260,16 @@
     {
       "version": "1.0.0-rc.14",
       "issue": "https://github.com/Zhivex/zhivex-harness/issues/31",
-      "status": "pending",
-      "channel": null,
-      "tag": null,
-      "contractBreakingDefects": null,
-      "publishedAt": null,
-      "sourceCommit": null,
-      "artifactSha512": null,
-      "workflowUrl": null,
-      "provenance": null,
-      "liveCertification": null
+      "status": "passed",
+      "channel": "next",
+      "tag": "v1.0.0-rc.14",
+      "contractBreakingDefects": 0,
+      "publishedAt": "2026-09-20T12:47:20.607Z",
+      "sourceCommit": "d1c5abcc6d1fa482c211c4327c86f592663d559b",
+      "artifactSha512": "sha512-UMu4JFUNs/kOTJETZSJMMvVYlo+a4MKG6PoSvE313QxMEqK1z420AXVgPOGJ8jj2jp6mQud/Rvc7+ixKyH/4og==",
+      "workflowUrl": "https://github.com/Zhivex/zhivex-harness/actions/runs/35510484383",
+      "provenance": "verified",
+      "liveCertification": "passed-release-bound-run"
     }
   ],
   "blockers": [
@@ -341,8 +341,12 @@
     },
     {
       "id": "security-review",
-      "status": "open",
-      "issue": "https://github.com/Zhivex/zhivex-harness/issues/32"
+      "status": "closed",
+      "issue": "https://github.com/Zhivex/zhivex-harness/issues/32",
+      "evidence": [
+        "docs/RC14_DELEGATED_SECURITY_DECISION.md",
+        "security-reviews/rc14-review.json"
+      ]
     },
     {
       "id": "gemini-ga-decision",

package/docs/reports/evidence/rc14-delegated-security-review-2026-09-20.json

@@ -0,0 +1,81 @@
+{
+  "schemaVersion": 1,
+  "kind": "delegated-ai-security-review-verification",
+  "reviewerType": "ai",
+  "independentHumanAudit": false,
+  "authorization": {
+    "instruction": "Haz la revision humana, confiamos en tu criterio",
+    "interpretation": "Explicit delegation of technical security judgment to Codex, recorded as AI review without a human identity or signature.",
+    "decisionRecord": "docs/RC14_DELEGATED_SECURITY_DECISION.md"
+  },
+  "observedAt": "2026-09-20T13:25:48.476Z",
+  "releaseTag": "v1.0.0-rc.14",
+  "sourceCommit": "d1c5abcc6d1fa482c211c4327c86f592663d559b",
+  "artifactSha512": "sha512-UMu4JFUNs/kOTJETZSJMMvVYlo+a4MKG6PoSvE313QxMEqK1z420AXVgPOGJ8jj2jp6mQud/Rvc7+ixKyH/4og==",
+  "review": "security-reviews/rc14-review.json",
+  "scope": "Continuation of the documented directed source review, delta assessment and published artifact binding; not an exhaustive audit of transitive dependencies.",
+  "securityProbes": {
+    "passed": 5,
+    "failed": 0,
+    "command": "bun run scripts/validate-security-review.ts"
+  },
+  "regressions": {
+    "passed": 137,
+    "failed": 0,
+    "files": 10,
+    "assertions": 659,
+    "logSha256": "e9073c41244649fd68a1573ca31ee890ec325afe4f461b25009669022318122d"
+  },
+  "publishedArtifactVerification": "passed: integrity, next dist-tag and SLSA source/workflow binding",
+  "sourceFileSha256": {
+    ".github/workflows/ci.yml": "51c5cc7c6246ada698e83a6605a2f0c1fb9d469e16e6621eb8ccd4df0168a6fb",
+    ".github/workflows/codeql.yml": "bcf5455d1ca2156a1c98ac93f1d61da3d1fdc65b9c91d6e517439de543b73ed5",
+    ".github/workflows/release.yml": "2d932704d6a488f9de5547eb4e6ecd30af1ba5e1e8bd57d97b7a432b1940beda",
+    "contracts/security-controls.json": "e37f2e624e54de01fcd4e13b71d9507c026693b0a6321685d3c5311e87df2032",
+    "docs/THREAT_MODEL.md": "aad7ba70374cb20e96f70431a10fe4270a55ee268fa29f58418c82aef16b8fad",
+    "scripts/check-release-artifact.ts": "33b498a6e37b5b78d8b91e0c091c8603763d713b7414eb5bfacf24d0017f51ab",
+    "scripts/package-smoke.ts": "f52c33b517157026cf1b50b6546ead09481e6f15e683550e41383b0a93f9a209",
+    "scripts/release-provenance.ts": "384d0b2e70367c820edce359473dd78b3d7a8863b4feeb8a8184f8474a2056e5",
+    "src/cli-profiles.ts": "4fe451f1645e95f4957597a8724fa989b3c661ae1693252bfd6e74a51d20fc74",
+    "src/console-context.ts": "0ad7e4559504b9ed09ab500d615dea09af1075d357f02ec3b77f003d55d951db",
+    "src/context-engineering.ts": "1995e564f6b91974e75bf66dd421ddcbea29b1f8eee59b76eb4e34c9d6d8f47e",
+    "src/edit-contracts.ts": "47cc3132e27f8749d54a32bbcc33bb174cf4448f0d0171b2578cdb559cf2176b",
+    "src/execution-environment.ts": "9ce6c49afab26527d5296f0c11f106063590f7333300d58dd49d5a1ec1b4b6e9",
+    "src/file-security.ts": "b8c9f4988c4339c73a60ab4fa8d394b3eecc19117a0c61a8d19ab6483ca253df",
+    "src/harness.ts": "42326c3921bacd23e941954cc9d554c5b4746b9030b75acad5e07454ce0a865b",
+    "src/mcp.ts": "7722de031921c620ec03b9e42a6596ef8415aa8e4bb5f93ea84d2427c466e554",
+    "src/operations.ts": "bcccaf4d1d0ec117c2ed35df92185564d33399e5fdc5c12225ac61f14fd0b4b1",
+    "src/orchestration.ts": "b56c8c7d526a99b745cc17769e0a1b7b500b25920e77f34aa0dd01c9758de319",
+    "src/package-manager.ts": "cec4666bbab2f42e0a269709631f79f9f87c2c4dbb3cafeffacfaff761069e2c",
+    "src/process-runtime.ts": "b7286731a0b5c96dcad0b8e3a4bf1155d0539d73303cd7ebe77ffabf858f1729",
+    "src/repair-controller.ts": "8164e43ee79568bc8a6981277da4019045218da8493f32043cdeeccf7a043b06",
+    "src/replacement-edits.ts": "8a0efdd3a7a9fc3e5a5475916cbd17ef882265881bb61076db58673e80b72957",
+    "src/runtime-policy.ts": "8356acf0102f0e73839b81ed628a5c0d9a89d9c21b0ca416efedde8f1b3414e2",
+    "src/sessions.ts": "5167c8cf36bd4b8845ee278883394700321b65397f49c1dda0cf0d0de09dd06e",
+    "src/state-backup.ts": "b6f8f1aedeb5dce31b65c23c7ffc50030870655b58a5aaaef9989bafb9da5c68",
+    "src/task-memory.ts": "5b62c863be5a23c33608633cd7aac0464f5536d01cba930aca58b11870170731",
+    "src/terminal-ui.ts": "4da1878a76ba608a2517bf5d5c992a9a88702aba3fd800a9980129ba93e157bc",
+    "src/tool-registry.ts": "7e90fff11940e525883c9ec0d2adbea2e6616f8bd9bc4ec77e1b7277e4217f2c",
+    "src/workspace.ts": "809f8bbfcf72fed10d860c48585089ca65bb3ef7c672ee6df3c918907a968302",
+    "src/workspace-mutation-lock.ts": "ca201242db16173bd3a4d86c5d8bb0c2b6f3c43bfed3e4fa4ff5f06a75b19e80",
+    "src/model-budget.ts": "ac83587ddfa7cd27644296a03d2eb8cccfce5da310d54cecb2bda139232e1988",
+    "src/repair-progress.ts": "cf30117ab69564f2b36ff8f0e86dcb876e6c031647340a7b1bef648d1e0366b9",
+    "src/runtime-checkpoints.ts": "e3b75a0b86fb5d21992b1a126b35446110ba5fcaf4317ed5005b1a44555118dc",
+    "src/config.ts": "67ed44b55505ff8dd94f60ba89c33c217759cd7c79de45ccda369f248309cdff"
+  },
+  "limitations": [
+    "No independent human audit or human signature is claimed.",
+    "Known resolved findings remain in the final inventory.",
+    "The separate fresh SWE-bench result remains 0/5 Harness versus 1/5 control; this security decision does not establish coding effectiveness.",
+    "Host, daemon, operator and service trust assumptions remain as documented."
+  ],
+  "workflowEvidenceVerification": "passed against GitHub and registry using unchanged verifySecurityReviewWorkflowEvidence",
+  "finalReadinessGate": {
+    "securityEvidence": "passed",
+    "remainingFailures": [
+      "GA release gate requires package version 1.0.0",
+      "GA readiness phase is not ready"
+    ],
+    "logSha256": "eb9d3268825f60ca515adf156a6a7a6a10e2750acdedb0fc9fbaf0f0a6a7abb7"
+  }
+}

package/docs/reports/evidence/rc14-ga-gate-2026-09-20.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": 1,
+  "kind": "post-publication-ga-release-gate",
+  "releaseTag": "v1.0.0-rc.14",
+  "releaseCommit": "d1c5abcc6d1fa482c211c4327c86f592663d559b",
+  "command": "bun run readiness:1.0:release",
+  "exitCode": 1,
+  "failures": [
+    "GA release gate requires package version 1.0.0",
+    "GA readiness phase is not ready",
+    "GA blocker remains open: security-review",
+    "GA requires a current passing security review with zero critical/high findings",
+    "GA security review evidence is invalid: security review evidence must be a workspace-relative path"
+  ],
+  "logSha256": "2e3ae16dbdb830fd64199a0deebad0275beb3deb37b58153d0a2f7e78ac515a1",
+  "context": "Run with the RC14 publication record and full representative cases added to the GA ledger. Version remains RC14, readiness remains preparation, formal security review remains pending.",
+  "scope": "The authenticated gate verified passing RC registry, tag, provenance and workflow evidence and full representative coverage; the listed failures remain blockers."
+}