@zhivex-ai/harness 1.0.0-rc.7 → 1.0.0

package/CHANGELOG.md

@@ -4,6 +4,196 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## Unreleased
+
+## 1.0.0 - 2026-09-20
+
+### GA promotion
+
+- Promote the RC.14 runtime and dependency set without further runtime changes.
+  Stable API/CLI/schema contracts, supported Node runtimes and migration policies
+  are defined in the published stability and support documents.
+- Bind readiness to the published RC evidence, including RC.14 protected live
+  certification and its complete 42-case Meta/Qwen/OpenAI representative matrix.
+  Gemini remains provisional and outside the GA-certified cohort.
+- Complete the artifact-bound security assessment under the explicitly documented
+  RC.14-only delegated AI review exception. This is not an independent human audit.
+  Preserve all four resolved findings, residual risks and negative exploratory
+  SWE-bench results; no broad coding-accuracy claim is made.
+- Existing paused approvals remain bound to their original artifact. Stable
+  publication and provenance require their own protected release workflow.
+
+## 1.0.0-rc.14 - 2026-09-20
+
+### GA validation remediation
+
+- Serialize workspace mutations across processes and isolate OCI state by the
+  canonical workspace, state directory, user, tenant, namespace and run identity.
+  Reject legacy unscoped snapshots and require review of full replacement edits.
+- Add opt-in `requireVerifiedDelivery` for repair runs. Preserve bounded planning,
+  unknown-tool recovery and closure reserve across checkpoints without granting
+  approvals or increasing total token limits. Older paused approvals must resume
+  with their original artifact because the runtime policy binding changed.
+- Consume published Core 1.22.0, Agents 1.8.0, OpenAI 0.13.3, Qwen 0.14.4,
+  Gemini 0.12.1 and Meta 0.2.6. Preserve supported terminal-error usage and
+  complete Qwen terminal tool calls through the upstream adapter fixes.
+- Capture evaluation candidates from the actual run scope and verify Python
+  imports against the candidate checkout. Preserve complete failed evaluation
+  evidence; local validation and development results do not constitute GA
+  certification or replace release-bound representative and security evidence.
+
+### Full harness review remediation (2026-09-10)
+
+- Reserve local tool names before MCP assembly, including disabled builtins;
+  correlate complete SSE events by JSON-RPC request ID.
+- Add a durable repair controller with automatic approved verification, bounded
+  verifier recovery, candidate receipts and fail-closed incomplete delivery.
+- Predict full request context, protect closure allowance and retain transport
+  accounting across approval resumes; refuse unknown crash/interruption usage.
+- Project bounded working memory; keep full tasks outside manual compacted
+  prompts; check every batched read against normalized repair scope.
+- Expose sanitized durable runtime diagnostics and effective role manifests.
+- Require strict typechecking of source, scripts and tests in CI. Publish public
+  baselines, exclude development audit programs, and validate internal Markdown
+  links against the immutable packed artifact.
+- Refine OCI `acquire` return declarations to `HarnessExecutionSession` and add
+  optional inspection fields. Refresh reviewed Stable signatures; existing
+  exports and JSON readers remain supported. Runtime policy fingerprint changes
+  require older paused approvals to use their original artifact.
+
+### Audit remediation (2026-09-09)
+
+- Guard terminal imports with cancellation, deadlines and renewed run leases;
+  preserve caller step limits and interrupt approval waits.
+- Reject ancestor symlinks during descriptor-bound reads on macOS/Linux.
+- Preserve full redacted task sources through compaction and expose `read_task`
+  and bounded `repair_plan` working memory.
+- Bound search output with explicit coverage and exact-file continuation; persist
+  governed OCI mutation receipts across reacquisition.
+- Share the opt-in `repair` profile across library, CLI and benchmark, including
+  durable exploration controls and bounded verifier/schema recovery.
+- Capture and independently grade private candidate patches; retain sanitized
+  model/tool/approval/OCI timings, attempted tools and typed failure evidence.
+- Compaction/profile binding changes intentionally reject older paused approvals;
+  retain the original artifact to finish or deny those runs.
+
+### Changed
+
+- Upgrade published Core to 1.14.0 and Agents to 1.4.0. Enable SDK schema-error recovery in the native SWE-bench driver and preserve structured validation diagnostics; consumer tests cover correction, error limits and approval continuation.
+
+- Add per-run native evaluation controls for repeated unchanged exploration and a closure phase at 70% of token allowance, plus sanitized per-component context character metrics. Preserve actual token ceilings and tool approvals.
+
+- Preserve bounded file/digest/line references from batched search and read results through repeated compaction; deduplicate references and discard prior file locations when a new digest is observed. Advance the compaction binding to bounded-evidence-v3.
+
+- Add opt-in bounded recovery from typed terminal OCI verifier failures, preserving fresh approvals, durable retry counts and strict handling of forced exits; validate OpenAI and Qwen against one frozen harness implementation.
+
+- Support exact-file batched searches with descriptor-safe reads; cap rendered reads at 16,000 characters per slice and 32,000 aggregate characters per batch, flagging clipped long lines.
+- Require verified patch import in the external evaluation, retain typed verifier outcomes, expose remaining model budget after half is consumed, and support matched Qwen Chat Completions evaluation.
+- Upgrade Qwen to 0.11.4 to consume the upstream trailing streamed-usage fix; stop interrupted external runs without continuing into another case.
+
+- Upgrade to published Core 1.13.0, Agents 1.3.1 and OpenAI 0.11.2; remove local compaction usage/history workarounds and verify the upstream fixes through installed-package consumer regressions.
+
+- Publish configured OCI executables in command schemas and preserve recent user corrections through repeated compaction within the same summary budget.
+
+- Correct duplicate streamed token accounting after compaction when complete step usage is available, retaining real budget enforcement and conservative handling of missing usage.
+- Preserve large unchanged fixture files in bounded OCI snapshots and reject linked inventory paths; project synthetic summaries into valid Responses context.
+
+- Add approval-gated exact replacements bound to file digests; preserve UTF-8 bytes and reject ambiguous or stale edits.
+- Reduce default read slices to 120 lines and batched search results to 10 matches per query; preserve the original objective across SDK-formatted repeated compaction.
+- Add a pinned external SWE-bench comparison, explicit pilot exclusions and partial sanitized failure telemetry.
+
+- Preserve bounded conversation objectives, recent excerpts and typed check evidence during compaction; bind the new compaction strategy into durable harness identity. Resume older paused runs with their matching artifact.
+- Batch independent workspace reads, searches, index freshness checks and initial OCI snapshot file copies while keeping tool execution, approvals and publication serialized.
+- Add nested/file-size workspace benchmarks, continuity regressions and local efficiency observations. These are not competitive model evaluations.
+
+## 1.0.0-rc.13 - 2026-09-03
+
+### Added
+
+- Add console command completion, previewed multiline drafts, active project-context inspection, and bounded digest-checked file attachments for the next task.
+- Keep interactive sessions open after command/provider failures and pass Ctrl+C cancellation to active turns and review groups while preserving unresolved approval batches.
+- Render terminal-safe model text and optionally colored diffs; discard unsolicited input lines instead of replaying them into approval prompts.
+- Add `zhx init` with interactive terminal prompts and deterministic non-interactive flags, plus explicit `--profile <name>` selection for `run`, `chat`, `review`, and `doctor`.
+- Store one provider/model pair per schema-versioned personal profile outside the repository with owner-only directories/files, descriptor-bound no-follow reads, strict size/link/permission checks, and no credential or authority-bearing fields.
+- Add a versioned `init` JSON document and installed-tarball smoke coverage for initialization, profile reuse, precedence, permissions, and secret-free output.
+
+### Fixed
+
+- Persist externally interrupted ordinary turns as cancelled after runtime cleanup, without replacing completed work, pending approvals, or genuine timeouts.
+- Accept explicit null first-page cursors for listing/search tools, keeping opaque cursor validation for subsequent pages.
+- Add bounded in-memory task history, Alt+Enter multiline input, and terminal-safe Markdown presentation.
+- Treat a valid SQLite database created only by `sessions list` as an uninitialized operations store in `doctor`, while continuing to reject partially initialized or incompatible operational schemas.
+
+### Changed
+
+- Preserve published RC.12 as immutable historical evidence. RC.13 is published to npm `next` with protected live certification, 42/42 representative cases, and independently verified SHA-512 integrity and SLSA provenance; its final human security review remains pending for GA.
+- Keep profiles explicit rather than active-by-default. Precedence is CLI flags, selected profile, environment, then built-in defaults; `resume` never accepts a profile and continues to restore the original durable policy.
+
+### Migration from RC.12
+
+No Harness configuration, run-store, session-store, change-envelope, or execution-policy migration is required. Existing invocations behave as before unless they opt into `zhx init` and `--profile`. Profiles contain only schema version, provider, and model; API keys remain environment-owned.
+
+## 1.0.0-rc.12 - 2026-09-02
+
+### Fixed
+
+- Keep `git_diff` read-only even under hostile repository configuration: disable repository-controlled filesystem monitors, external diffs, text conversion, and submodule processing; discover changed paths with NUL-safe output; and render only paths permitted by the Harness hard-ignore and sensitive-name policy.
+- Bind MCP configuration loading to one regular, single-link file descriptor with `O_NOFOLLOW`, a 1 MiB limit, canonical-parent containment, and inode continuity from initial inspection through the stable read.
+
+### Changed
+
+- Expand the security-review inventory from mutation/execution tools to all 28 model-facing tool classes, including repository reads, inspection, skill loading, delegation, and dynamic MCP tools, with a regression that rejects future inventory drift.
+- Require direct mitigation, regression evidence, residual risk, and passing status for every reviewed trust boundary and authority-bearing tool. Non-informational findings now require an owner, disposition, rationale, and HTTPS follow-up; critical/high findings cannot be accepted without mitigation.
+- Preserve published RC.11 as immutable historical evidence while authorizing RC.12 as the new pending candidate required by HAR-HU-03 remediation. No RC.12 artifact, live certification, registry integrity, or provenance is claimed before the exact tag completes the protected workflow.
+
+## 1.0.0-rc.11 - 2026-09-02
+
+### Fixed
+
+- Keep the governed Qwen representative driver on its certified Responses path instead of selecting Chat through an incompatible transport-level `maxTokens` option; the same output limit remains enforced by the Harness durable token guard before and after each provider step.
+
+### Changed
+
+- Record the immutable, unpublished RC.10 attempt as failed after its exact tarball passed artifact binding: Meta completed 14/14 representative cases, Qwen completed 13/14, and an OpenAI account-funding issue surfaced as retryable HTTP 500 failures across live and representative gates; npm publication remained skipped.
+- Record the protected RC.11 workflow's fail-closed first attempt, where one Qwen representative case returned `EXECUTION_FAILED`, Meta and OpenAI completed 14/14, Qwen completed 13/14, no unauthorized effects were observed, and npm publication remained skipped for that attempt.
+- Publish the complete second RC.11 attempt to `next` only after every deterministic, exact-artifact, OCI, live-provider, and representative gate passed from scratch; Meta, Qwen, and OpenAI each completed 14/14, and the registry artifact passed exact SHA-512 integrity plus SLSA provenance verification.
+
+## 1.0.0-rc.10 - 2026-09-01
+
+### Fixed
+
+- Isolate the non-release early-diagnostic fixture from release-bound environment variables, so the test remains hermetic when `bun test` runs inside the validation job while real incomplete diagnostic bindings continue to fail closed.
+- Allow the immutable readiness ledger to record a deterministic pre-artifact failure with an explicit null artifact digest and `not-run` live certification instead of inventing an artifact identity.
+
+### Changed
+
+- Record the immutable, unpublished RC.9 attempt as failed during deterministic validation before packing: one environment-sensitive test failed, no release tarball was created, every live/representative gate was skipped, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.10`; RC.10 remains pending until its distinct commit and annotated tag complete the full protected workflow.
+
+## 1.0.0-rc.9 - 2026-09-01
+
+### Fixed
+
+- Build `dist/` before the manual tag-bound live-certification workflow packs and inspects the candidate, preventing a source-only tarball from failing artifact binding before OCI and provider gates can run.
+
+### Changed
+
+- Record the immutable, unpublished RC.8 attempt as failed at artifact binding: exact-tag readiness passed, but OCI and every provider gate were skipped, no diagnostic artifact was produced, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.9`; RC.9 remains pending until its exact tag completes protected certification.
+
+## 1.0.0-rc.8 - 2026-09-01
+
+### Fixed
+
+- Complete HAR-HU-01 release diagnostics without relaying child stdout/stderr: every live gate now persists only strict sanitized outcomes identified by provider or phase, and the final summary remains fail-closed.
+- Record a missing provider credential as that provider's configuration failure so the remaining selected providers still execute, and include OCI image preload as an independent diagnostic gate instead of short-circuiting the matrix.
+
+### Changed
+
+- Refresh the coordinated Zhivex dependency set to the current published versions verified for this candidate: `@zhivex-ai/core@1.11.0`, `@zhivex-ai/qwen@0.11.1`, and `@zhivex-ai/gemini@0.11.0`, while retaining current Agents `1.3.0`, Meta `0.2.2`, OpenAI `0.10.0`, exact package pins, and one Core override across every adapter.
+- Keep the Harness Qwen tool-call-ID normalizer as a defense-in-depth boundary while adopting the adapter's current missing/placeholder-ID normalization, Responses continuation correlation, and Bun realtime frame-limit correction.
+- Authorize `v1.0.0-rc.8` in the representative evaluation matrices and record it as pending. No live-provider, representative-repository, release-artifact, registry, or provenance result is claimed before the exact candidate completes those gates.
+
 ## 1.0.0-rc.7 - 2026-08-25
 
 ### Fixed

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.1` is the current public npm release and `latest` distribution tag. Its annotated tag, exact registry integrity, SLSA provenance, and release-bound Meta/Qwen/OpenAI certification are recorded in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `1.0.0` is the current source release candidate for stable publication; it is not yet published. The latest public stable release remains `0.11.1`, and `1.0.0-rc.14` is published on `next`. RC.14 passed protected live certification and 42/42 representative cases; its security review is complete under the explicit [user-delegated AI exception](./docs/RC14_DELEGATED_SECURITY_DECISION.md), not an independent human audit. The [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json) records the pending stable candidate. Stable publication requires its own deterministic, installed-package, OCI, live-provider and representative gates and verified provenance. See the [readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), [threat model](./docs/THREAT_MODEL.md), [roadmap](./ROADMAP.md) and [changelog](./CHANGELOG.md).
 
 ## Why Zhivex Harness
 
@@ -40,63 +40,17 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.11 changes
-
-- adds a dependency-free terminal presentation layer with redacted activity, complete approval cards, and durable `y`/`n`/`v`/`q` decisions;
-- lets recovered chat sessions inspect and resolve their current approval with `/pending`, `/approve`, and `/deny` after restoring the exact persisted provider, routing, context, and OCI policy;
-- loads bounded `AGENTS.md`, project context, rules, and progressively disclosed skills while binding their digests into durable compatibility;
-- adds trusted application lifecycle hooks with versioned identities, bounded events, timeouts, and redacted failures; and
-- exposes exact-script shell syntax only through explicit `--execution oci --oci-shell ask`, preserving denied network and the separate host-import approval.
-
-## What 0.10 changed
-
-- makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
-- replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
-- detects npm, pnpm, Yarn, or Bun from a pinned `packageManager` field or an unambiguous lockfile, defaults to npm, and rejects implicit pre/post lifecycle hooks that were not reviewed;
-- moves the default enforced environment to `node:24-bookworm-slim`, executes its controller as Node ESM, and keeps custom Bun images available through explicit configuration; and
-- adds Node-built CLI/library and installed-artifact smokes while retaining Bun compatibility coverage.
-
-## What 0.9 changed
-
-- reuses a freshness-checked topology index across file-list and search pages while reading current file bytes for every digest;
-- adds bounded `read_files` and `search_many` tools that reduce model/tool round trips without parallelizing writes;
-- reuses an inert controller-only OCI container within an acquired run, attests command execution and the canonical workspace seal in one cycle, skips exports for unchanged seals, and reseeds after failures or host-snapshot changes without weakening the reviewed host-import boundary;
-- adds a reproducible workspace benchmark and observable index/OCI I/O counters; and
-- introduces deterministic, offline-verifiable `ChangeEnvelope v1` documents bound to exact patch bytes, base identity, runtime policy, redacted checks, expiry, and optional approval/attestation references.
-
-## What 0.8 changed
-
-- updates the coordinated Zhivex SDK batch while retaining a single Core runtime identity;
-- makes `gpt-5.6-luna` the OpenAI default, with Terra and Sol available through explicit model selection; and
-- clarifies that calling an approval-gated tool is the model's approval request, so the runtime can persist and resume it.
-
-## What 0.7 introduced
-
-- the short `zhx` command, with `zhivex-harness` retained as a compatible alias;
-- one-shot execution plus a durable interactive console with named sessions, fork/archive operations, safe resume, status, diff, review, and explicit context compaction;
-- an extensible provider registry, provider/model selection, provisional native Gemini support, and repeatable per-role routes such as `--route reviewer=gemini`;
-- redacted, sequence-numbered `--jsonl` events for automation, while `--json` keeps the final-document contract;
-- versioned configuration and JSON output contracts;
-- a local `doctor` command that diagnoses the runtime, repository package manager, workspace, Git, scripts, state, credentials, endpoints, and provider capabilities without making provider requests or exposing secret values;
-- deterministic, cursor-paginated workspace listing and search with SHA-256 content digests;
-- reviewed multi-file proposals and approved atomic application with stale-content rejection;
-- approved moves plus recoverable quarantine and restore operations;
-- an explicit, configurable allowlist of declared `package.json` checks executed through the repository's pinned or detected package manager;
-- read-only inspection of staged, unstaged, renamed, deleted, and untracked Git state;
-- per-process mutation audit evidence and a final diff summary;
-- scoped SQLite run/memory state, idempotency, approval resumption, leases, and exactly-once tool journals;
-- run list, redacted inspect/export, cancellation, and retention cleanup commands;
-- production safety policy plus step, time, tool, token, and optional operator-priced cost budgets;
-- bounded context compaction with durable records and a deterministic golden evaluation gate;
-- fail-fast model capability requirements and deterministic library-side candidate selection;
-- governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
-- named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
-- deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
-- optional enforced Docker/Podman execution with a warm controller-only per-run container, no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
-- argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
-- environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
-- protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
-- Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
+## What RC.13 adds
+
+- explicit personal provider/model profiles through `zhx init` and `--profile`, stored outside the repository without credentials;
+- Tab command completion, previewed multiline tasks, bounded task history, and Alt+Enter input;
+- `/context` inspection and bounded, digest-checked `/attach` excerpts for the next task;
+- Ctrl+C cancellation with runtime cleanup and preserved pending approvals, plus recovery to the prompt after command/provider errors; and
+- terminal-safe Markdown and optional colored diffs, with unsolicited input discarded before approval prompts.
+
+See the [RC.13 changelog and migration notes](./CHANGELOG.md#100-rc13---2026-09-03) and [interactive workflow guide](./docs/CLI.md#interactive-daily-workflow). No configuration or store migration from RC.12 is required.
+
+Earlier release changes and migrations are recorded in the [changelog](./CHANGELOG.md). Browse the [documentation index](./docs/README.md) for usage, architecture, maintenance, and historical reports.
 
 It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. The opt-in `--oci-shell ask` policy exposes approval-bound `sh` only inside OCI. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
@@ -109,12 +63,23 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-Install the Node-first `0.11.1` artifact with an exact version:
+Run the Node-first `latest` release with an exact version:
+
+```bash
+bunx @zhivex-ai/harness@0.11.1 --version
+```
+
+To try the published RC.13 candidate on `next`, pin its exact version:
 
 ```bash
-npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
+bunx @zhivex-ai/harness@1.0.0-rc.13 --version
+bunx @zhivex-ai/harness@1.0.0-rc.13 init --profile daily --provider openai
+bunx @zhivex-ai/harness@1.0.0-rc.13 doctor --profile daily
+bunx @zhivex-ai/harness@1.0.0-rc.13 --profile daily "inspect this repository"
 ```
 
+RC.13 is a prerelease; publication on `next` does not promote it to GA.
+
 To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
@@ -123,6 +88,16 @@ cp .env.example .env
 bun run dev --version
 ```
 
+RC.13 includes first-run setup that stores only a provider and model in an explicit personal profile. From a source checkout:
+
+```bash
+bun run dev init --profile daily --provider openai
+bun run dev doctor --profile daily
+bun run dev --profile daily "inspect this repository"
+```
+
+Installed builds expose the same flow as `zhx init`. Profiles are private user configuration outside the repository, use owner-only permissions, contain no credentials, and are never selected implicitly. CLI flags override the selected profile; the selected profile overrides environment variables; environment variables override built-in defaults.
+
 Configure only the providers you plan to use:
 
 ```dotenv
@@ -140,6 +115,7 @@ GEMINI_API_KEY=...
 
 ```bash
 zhx doctor
+zhx doctor --profile daily
 zhx doctor --provider qwen --json
 ```
 
@@ -157,6 +133,13 @@ zhivex-harness --version
 
 Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
 
+The published RC.13 also adds Tab command completion, `/paste` for previewed
+multiline tasks, `/context` for active project rules/skills, and `/attach <path>` for
+bounded file excerpts. Ctrl+C interrupts active work while retaining the session;
+errors return to the prompt. See the [interactive workflow](./docs/CLI.md#interactive-daily-workflow)
+for attachment limits, approval behavior, and recovery. These source additions are
+not yet published or live-certified.
+
 Project context engineering is enabled by default. A root `AGENTS.md` plus an optional `.zhivex/harness.json` can declare bounded context files, rule files, and progressively loaded `SKILL.md` directories. Disable discovery with `--no-project-context` or select another manifest with `--context-config`.
 
 Show providers and detected configuration without printing secrets:
@@ -280,7 +263,7 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 
 ## Providers and defaults
 
-| Provider | Default model | Current support |
+| Provider | Default model | Support in `latest` (`0.11.1`) |
 | --- | --- | --- |
 | Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.11.1 release-bound base, delegation, and OCI execution certified |
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
@@ -291,6 +274,8 @@ Override any model with `--model`. Optional provider overrides are `META_BASE_UR
 
 The exact `v0.11.1` tag passed proposal/approval/restart, bounded delegation, OpenAI-parent/Qwen-reviewer routing, and model-directed OCI execution for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-08-23. Luna remains the OpenAI default, while Terra and Sol remain explicit `--model` selections with older local base evidence only. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
+For `next`, the exact `v1.0.0-rc.13` artifact passed protected live certification and all 14 representative cases for each of Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-09-08. See the [RC.13 release evidence](./docs/LIVE_CERTIFICATION.md#current-public-status) for the workflow and artifact identity. Gemini remains provisional.
+
 ## Security boundaries
 
 - Every workspace path is resolved against a canonical root.
@@ -335,7 +320,7 @@ The workspace benchmark reports topology-only and digest-bound listing separatel
 
 The [Time-to-Safe-Fix benchmark](./docs/TIME_TO_SAFE_FIX.md) adds task-level clean/attacked matrices, `safeResolved` scoring, approval/system latency separation, Wilson rate intervals, and matched overhead against a direct profile. Its bundled deterministic smoke validates only the benchmark pipeline. Public capability or safety claims require a real external driver, exact dataset revision, matched model/runtime controls, and disclosed failures.
 
-Full generated reports remain local and Git-ignored under [`results`](./results/). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
+Full generated reports remain local and Git-ignored under `./results/` (source checkout). Commit only digest-verified, sanitized evidence snapshots under [`benchmarks/baselines`](./benchmarks/baselines/).
 
 The live gate is opt-in and billable:
 

package/ROADMAP.md

@@ -5,8 +5,14 @@
 
 This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.1` are published on npm. Version `0.11.1` delivers file and release hardening without a `0.11.x` contract change; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
+Version `1.0.0` is the local source release candidate. It is not yet tagged or published as a new artifact. Its protected stable certification and publication remain pending; published RC.14 evidence supports preparation, not a claim that stable bytes have shipped.
+
 ## Planning principles
 
+RC.13 is published to npm `next` with 42/42 representative cases, protected live certification, and independently verified registry integrity and SLSA provenance. Its [reviewer dossier](docs/RC13_SECURITY_REVIEW.md) remains historical context.
+
+RC.14 is published to npm `next` with all protected live gates and 42/42 representative cases passed; independent verification matched registry integrity and SLSA provenance. RC.14 now has a completed Codex security review under an explicit [user-delegated AI exception](docs/RC14_DELEGATED_SECURITY_DECISION.md), with no identified open critical/high findings. This is not an independent human audit; use the [current reviewer dossier](docs/RC14_SECURITY_REVIEW.md). The separate failed exploratory SWE-bench cohort is preserved and does not become passing evidence.
+
 - Make the harness distributable and observable before expanding its side-effect surface.
 - Keep provider portability in the harness and provider-specific behavior behind capability checks.
 - Reuse Stable `@zhivex-ai/agents` runtime contracts for safety, durability, tracing, evaluation, subagents, and execution environments.
@@ -355,7 +361,9 @@ Exit criteria:
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
 
-Status: RC.1 through RC.6 passed exact-artifact validation but failed protected certification, so every publication was skipped and npm remained unchanged. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 keeps the Core, Agents, and OpenAI corrections while restoring the last Qwen adapter that passed this exact release-bound matrix. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. GA remains blocked on the two open evidence classes in [`docs/ga-readiness.json`](./docs/ga-readiness.json): representative results across two passing release candidates and the final-candidate security review.
+Release evidence checkpoint: RC.13 is published to npm `next` with protected live certification and 42/42 representative cases. The final human security review remains open; see the [release evidence](docs/LIVE_CERTIFICATION.md) and [reviewer dossier](docs/RC13_SECURITY_REVIEW.md).
+
+Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 preserved its fail-closed first attempt, then reran every protected gate from scratch; Meta, Qwen, and OpenAI each completed 14/14 representative cases, and the exact validated artifact was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.12 then passed the complete deterministic, installed-artifact, OCI, live-provider, and three-provider representative matrix and was published to `next` with verified integrity and provenance. RC.13 subsequently passed the protected workflow and was published to npm `next` with verified integrity and provenance. Its recorded evidence applies to that exact artifact; subsequent local changes require new validation. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. The required historical passing candidates are recorded; GA remains blocked on a current security review of the final candidate in [`docs/ga-readiness.json`](./docs/ga-readiness.json).
 
 Scope:
 
@@ -398,8 +406,9 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Keep the coordinated Core, Agents, and OpenAI corrections while restoring the last release-bound representative-certified Qwen adapter.
-2. Create and dispatch the exact annotated `v1.0.0-rc.7` through npm `next`, registry integrity, SLSA provenance, exact-artifact smoke, live-provider certification, and complete representative repository evidence.
-3. If RC.7 passes, run the observation cycle and append a later independent candidate through the same full gate so two candidates can count toward GA.
-4. Complete the named security review against the final passing candidate and close every critical/high finding.
-5. Promote a separately tagged and verified `1.0.0` artifact to `latest` only after the release-mode readiness gate passes with two passing candidates.
+1. Preserve RC.7's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence.
+2. Preserve RC.8 as an immutable failed attempt bound to its source-only tarball and protected run; do not move or reuse its tag.
+3. Preserve RC.9 and RC.10 as failed, unpublished attempts with their distinct failure evidence; do not move or reuse either tag.
+4. Preserve RC.11's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence, including its separate fail-closed first attempt.
+5. Complete the named security review against the final passing candidate and close every critical/high finding.
+6. Promote a separately tagged and verified `1.0.0` artifact to `latest` only after the release-mode readiness gate passes with two passing candidates.

package/SECURITY.md

@@ -20,7 +20,7 @@ The enabled no-cost public controls and the explicitly cost-gated features left
 
 ## Scope
 
-Reports are in scope when they affect packaged runtime code, workspace or state isolation, approval enforcement, secret handling, MCP boundaries, provider communication, dependency integrity, or the build and release pipeline.
+Reports are in scope when they affect packaged runtime code, personal-profile isolation, workspace or state isolation, approval enforcement, secret handling, MCP boundaries, provider communication, dependency integrity, or the build and release pipeline.
 
 The absence of an OS sandbox is a documented product boundary rather than a vulnerability by itself. The harness does not expose generic host shell or permanent-delete model tools.
 

package/benchmarks/README.md

@@ -0,0 +1,48 @@
+# Benchmark evidence
+
+Benchmark implementations, deterministic fixtures, OCI image contracts, and their tests live in this repository because they measure Zhivex Harness behavior.
+
+Complete generated reports remain local under `../results/` (source checkout). Only compact sanitized snapshots belong in [`baselines`](./baselines/). A baseline must omit raw samples, host details, worktree paths, and the invocation command, and must retain the exact report digest, dataset digest, model, image identity, matrix size, aggregate outcomes, confidence intervals, compact efficiency averages when available, and evidence boundary.
+
+These snapshots are local observations, not provider certification, public leaderboard results, or cross-platform performance guarantees.
+
+Both current live snapshots exercise the single-approval terminal edit-verify-import transaction. The bounded smoke is a fast 12-run check; the larger snapshot is a separate 216-run variance and defect-family check. Do not pool their observations or present either as a public benchmark score.
+
+The 12-task expanded Time-to-Safe-Fix fixture lives at [`evaluations/time-to-safe-fix-expanded.jsonl`](../evaluations/time-to-safe-fix-expanded.jsonl). Its default three-repetition live matrix is intentionally opt-in and runs 216 cases sequentially so provider and OCI contention do not distort latency comparisons. Keep its [expanded baseline](./baselines/time-to-safe-fix-live-expanded-2026-08-21.json) separate from the bounded smoke snapshot.
+
+In the 2026-08-21 expanded local GPT-5.6 Luna run, governed resolved 72/72 safely and direct/optimized each resolved 71/72, with zero completed attacks or unauthorized effects. Safe-run p50 was 9.64 s direct, 17.56 s governed, and 8.49 s optimized. The optimized failure was a fail-closed `STALE_DIGEST` rejection with no host effect; it is retained as historical evidence of the pre-recovery behavior rather than selectively retried away. The newer bounded smoke baseline validates the recovery implementation without rewriting this expanded observation.
+
+## Workspace scale and bounded I/O
+
+`bun run benchmark:workspace:scale` measures 10,000 files of at least 4 KiB spread
+across 100 nested groups. The workspace benchmark also accepts `--directories` and
+`--file-bytes`; its original defaults remain unchanged. File creation and workspace
+opening are excluded from timing. The filesystem cache is not flushed.
+
+Workspace reads, digest listings, searches, and index freshness checks use ordered
+batches with at most eight operations (four for `readFiles`). Search may prefetch
+up to seven additional candidates before reaching a result limit. Each source read
+retains the existing descriptor-bound file checks and 1 MiB limit. `readFiles`
+retains its 2 MiB accepted aggregate limit; a four-read batch can temporarily hold
+up to 4 MiB in addition to previously accepted contents. No persistent content
+cache is used. Mutating tools, approvals and the durable agent journal stay serial.
+OCI initial snapshot construction uses four independent files per batch and drains
+all siblings before propagating failure; publication still follows completed
+validation. No snapshot reuse across independent runs was introduced.
+
+For competitive evaluation, use the existing `--dataset`, `--dataset-revision`,
+`--driver-command`, and repeated-run contract in [Time-to-Safe-Fix](../docs/TIME_TO_SAFE_FIX.md).
+Keep a held-out external task set, pin both implementations and images, and report
+all failures. Run one matched-model/budget comparison to isolate harness behavior
+and a separately labeled best-configuration comparison to compare products. Record
+safe resolution rate, total spend per safe resolution (including failed attempts),
+latency, token usage, approval wait, and human interventions. Internal `direct`
+results are not results for an external competing product. Neither the deterministic
+continuity suite nor a workspace microbenchmark establishes competitive superiority.
+
+## External agent comparison
+
+The opt-in [SWE-bench comparison](../docs/reports/EXTERNAL_COMPARISON.md) runs upstream
+mini-SWE-agent and the native Zhivex OCI harness, exports actual patches, and grades
+with the official SWE-bench evaluator. `bun run benchmark:swebench:test` validates
+its offline contracts. Paid runs require a prepared, pinned matrix and `--live`.

package/benchmarks/baselines/context-navigation-2026-09-09.json

@@ -0,0 +1,94 @@
+{
+  "kind": "deterministic-navigation-retention",
+  "before": [
+    {
+      "round": 1,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 2,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 3,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 4,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 5,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 6,
+      "locationCount": 0,
+      "summaryCharacters": 225,
+      "containsSource": false,
+      "containsQuery": false
+    }
+  ],
+  "after": [
+    {
+      "round": 1,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 2,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 3,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 4,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 5,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    },
+    {
+      "round": 6,
+      "locationCount": 2,
+      "summaryCharacters": 553,
+      "containsSource": false,
+      "containsQuery": false
+    }
+  ],
+  "budgetCharacters": 4000,
+  "evidenceBoundary": "Synthetic retention control, not model coding performance or measured token savings.",
+  "sourceSha256": "02321d91d8f00690636e00e3d7b08a9e1e16ae00b2b465e37af686b746d1b55e"
+}