@zhivex-ai/harness 1.0.0-rc.7 → 1.1.0-rc.2

package/CHANGELOG.md

@@ -4,6 +4,276 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.1.0-rc.2 - 2026-09-22
+
+Release candidate superseding the unpublished RC.1, targeting npm `next`.
+
+- Register the exact candidate's external model pins and reject missing pins before live certification.
+- Preserve historical 1.0 certification checks while allowing later candidates in the shared matrix.
+- Bound the governed benchmark's retained history to the latest correlated tool group so verbose Qwen turns can compact within the existing 12,000-token input ceiling. Approval, isolation and independent verification requirements remain unchanged.
+- Add deterministic coverage for the previous compaction failure and current-version model pin drift.
+
+Fresh protected certification is required for this candidate before publication.
+
+## 1.1.0-rc.1 - 2026-09-22
+
+Release candidate for the next compatible minor release, targeting the `next` channel.
+The latest stable release remains 1.0.0. Desktop has its own private alpha version.
+
+### Desktop preview
+
+- Add an experimental Electron client with durable conversations, project/worktree
+  navigation, model selection, native credential storage and governed approvals.
+- Add recoverable installation and verified update machinery. Production signing,
+  notarization and update trust configuration remain pending; automatic updates
+  remain disabled in the default alpha build.
+
+### Release validation and profile safety
+
+- Install the pinned Electron runtime explicitly before macOS native tests, including
+  the general validation job; keep other dependency lifecycle scripts disabled.
+- Bind default-profile confirmation to the displayed provider/model so a profile
+  changed while the prompt is open cannot redirect the current invocation.
+
+### Developer experience and documentation
+
+- Keep initial menu and model options visible on asynchronous terminals by preserving
+  readline prompt and menu write order; no extra arrow key is required to draw them.
+
+- Lead `zhx --help` with everyday actions; add command-specific help and `zhx help all` for the complete reference.
+- Show common slash actions first, retaining full-catalog search and `/help all`. Pending approval controls remain visible in the short help.
+- Shorten onboarding, separate user/integration/maintenance guides, and standardize maintained Desktop guides in English while quoting current UI labels.
+- Exclude maintainer-only documentation from npm using explicit guide entries and validate links inside the packed archive.
+
+Existing commands, aliases, machine output and persisted state remain compatible.
+These changes are assigned to 1.1.0-rc.1 and require fresh artifact-bound certification before publication.
+
+### Local service and replay
+
+- Add a private authenticated Unix transport and Node runtime owner with graceful drain and explicit dead-process recovery.
+- Persist redacted activity with stable event IDs, cursor replay, bounded retention and expired-cursor snapshots.
+- Coordinate approval revisions/expiry and active cancellation across clients; verify crash recovery and a single edit journal receipt against the installed artifact.
+
+### Shared client contract
+
+- Add an experimental versioned in-process adapter over existing sessions, runs, approvals and checkpoint cancellation. Strict command validation, connection-scoped idempotency and expected revisions are explicit.
+- Add a JSON Schema, integration documentation and an offline reference client tested against the installed package. No service listener, replay stream or multi-client coordination is introduced.
+
+### Daily CLI workflow
+
+- Add installed-package first-use coverage, recovery guidance and a runnable example.
+- Search project sessions and reconcile durable state and pending approvals before continuation.
+- Inspect attachment limits, retained skill receipts and context compaction; clarify exact approval scope and verification outcomes.
+- Persist per-provider/model usage across child calls and resumed runs. Optional dated pricing and per-run monetary limits block unknown or stale pricing and unknown usage; displayed costs remain estimates.
+- Prepare a frozen two-repository evaluation cohort and installed-artifact pilot driver. Complete the authorized live baseline and pilot (HAR-HU-14, 20): both artifacts scored 6/10; release recommendation remains HOLD.
+
+### Console input and streaming
+
+- Insert bracketed clipboard content as bounded, editable literal text; prevent
+  pasted commands and approval answers from executing accidentally.
+- Suppress input echo while a run is active, preserve drafts across terminal resize,
+  and deliver partial streamed lines during provider pauses and on error cleanup.
+- Extend the offline Node PTY demonstration with clipboard safety, cursor editing,
+  resize, provider failure and history recovery. JSON/JSONL and persisted state
+  contracts are unchanged.
+
+### Migration from 1.0.0
+
+- Existing CLI commands, JSON/JSONL output, public stable APIs and state format 1
+  remain compatible. Back up durable state before testing a prerelease.
+- Local service and shared client APIs remain experimental. Desktop remains a
+  separately versioned private alpha, outside the stable CLI/library guarantee.
+- Use the source development workflow until this candidate is published to npm
+  `next`; npm `latest` continues to install 1.0.0.
+
+## 1.0.0 - 2026-09-20
+
+### GA promotion
+
+- Promote the RC.14 runtime and dependency set without further runtime changes.
+  Stable API/CLI/schema contracts, supported Node runtimes and migration policies
+  are defined in the published stability and support documents.
+- Bind readiness to the published RC evidence, including RC.14 protected live
+  certification and its complete 42-case Meta/Qwen/OpenAI representative matrix.
+  Gemini remains provisional and outside the GA-certified cohort.
+- Complete the artifact-bound security assessment under the explicitly documented
+  RC.14-only delegated AI review exception. This is not an independent human audit.
+  Preserve all four resolved findings, residual risks and negative exploratory
+  SWE-bench results; no broad coding-accuracy claim is made.
+- Existing paused approvals remain bound to their original artifact. Stable
+  publication and provenance require their own protected release workflow.
+
+## 1.0.0-rc.14 - 2026-09-20
+
+### GA validation remediation
+
+- Serialize workspace mutations across processes and isolate OCI state by the
+  canonical workspace, state directory, user, tenant, namespace and run identity.
+  Reject legacy unscoped snapshots and require review of full replacement edits.
+- Add opt-in `requireVerifiedDelivery` for repair runs. Preserve bounded planning,
+  unknown-tool recovery and closure reserve across checkpoints without granting
+  approvals or increasing total token limits. Older paused approvals must resume
+  with their original artifact because the runtime policy binding changed.
+- Consume published Core 1.22.0, Agents 1.8.0, OpenAI 0.13.3, Qwen 0.14.4,
+  Gemini 0.12.1 and Meta 0.2.6. Preserve supported terminal-error usage and
+  complete Qwen terminal tool calls through the upstream adapter fixes.
+- Capture evaluation candidates from the actual run scope and verify Python
+  imports against the candidate checkout. Preserve complete failed evaluation
+  evidence; local validation and development results do not constitute GA
+  certification or replace release-bound representative and security evidence.
+
+### Full harness review remediation (2026-09-10)
+
+- Reserve local tool names before MCP assembly, including disabled builtins;
+  correlate complete SSE events by JSON-RPC request ID.
+- Add a durable repair controller with automatic approved verification, bounded
+  verifier recovery, candidate receipts and fail-closed incomplete delivery.
+- Predict full request context, protect closure allowance and retain transport
+  accounting across approval resumes; refuse unknown crash/interruption usage.
+- Project bounded working memory; keep full tasks outside manual compacted
+  prompts; check every batched read against normalized repair scope.
+- Expose sanitized durable runtime diagnostics and effective role manifests.
+- Require strict typechecking of source, scripts and tests in CI. Publish public
+  baselines, exclude development audit programs, and validate internal Markdown
+  links against the immutable packed artifact.
+- Refine OCI `acquire` return declarations to `HarnessExecutionSession` and add
+  optional inspection fields. Refresh reviewed Stable signatures; existing
+  exports and JSON readers remain supported. Runtime policy fingerprint changes
+  require older paused approvals to use their original artifact.
+
+### Audit remediation (2026-09-09)
+
+- Guard terminal imports with cancellation, deadlines and renewed run leases;
+  preserve caller step limits and interrupt approval waits.
+- Reject ancestor symlinks during descriptor-bound reads on macOS/Linux.
+- Preserve full redacted task sources through compaction and expose `read_task`
+  and bounded `repair_plan` working memory.
+- Bound search output with explicit coverage and exact-file continuation; persist
+  governed OCI mutation receipts across reacquisition.
+- Share the opt-in `repair` profile across library, CLI and benchmark, including
+  durable exploration controls and bounded verifier/schema recovery.
+- Capture and independently grade private candidate patches; retain sanitized
+  model/tool/approval/OCI timings, attempted tools and typed failure evidence.
+- Compaction/profile binding changes intentionally reject older paused approvals;
+  retain the original artifact to finish or deny those runs.
+
+### Changed
+
+- Upgrade published Core to 1.14.0 and Agents to 1.4.0. Enable SDK schema-error recovery in the native SWE-bench driver and preserve structured validation diagnostics; consumer tests cover correction, error limits and approval continuation.
+
+- Add per-run native evaluation controls for repeated unchanged exploration and a closure phase at 70% of token allowance, plus sanitized per-component context character metrics. Preserve actual token ceilings and tool approvals.
+
+- Preserve bounded file/digest/line references from batched search and read results through repeated compaction; deduplicate references and discard prior file locations when a new digest is observed. Advance the compaction binding to bounded-evidence-v3.
+
+- Add opt-in bounded recovery from typed terminal OCI verifier failures, preserving fresh approvals, durable retry counts and strict handling of forced exits; validate OpenAI and Qwen against one frozen harness implementation.
+
+- Support exact-file batched searches with descriptor-safe reads; cap rendered reads at 16,000 characters per slice and 32,000 aggregate characters per batch, flagging clipped long lines.
+- Require verified patch import in the external evaluation, retain typed verifier outcomes, expose remaining model budget after half is consumed, and support matched Qwen Chat Completions evaluation.
+- Upgrade Qwen to 0.11.4 to consume the upstream trailing streamed-usage fix; stop interrupted external runs without continuing into another case.
+
+- Upgrade to published Core 1.13.0, Agents 1.3.1 and OpenAI 0.11.2; remove local compaction usage/history workarounds and verify the upstream fixes through installed-package consumer regressions.
+
+- Publish configured OCI executables in command schemas and preserve recent user corrections through repeated compaction within the same summary budget.
+
+- Correct duplicate streamed token accounting after compaction when complete step usage is available, retaining real budget enforcement and conservative handling of missing usage.
+- Preserve large unchanged fixture files in bounded OCI snapshots and reject linked inventory paths; project synthetic summaries into valid Responses context.
+
+- Add approval-gated exact replacements bound to file digests; preserve UTF-8 bytes and reject ambiguous or stale edits.
+- Reduce default read slices to 120 lines and batched search results to 10 matches per query; preserve the original objective across SDK-formatted repeated compaction.
+- Add a pinned external SWE-bench comparison, explicit pilot exclusions and partial sanitized failure telemetry.
+
+- Preserve bounded conversation objectives, recent excerpts and typed check evidence during compaction; bind the new compaction strategy into durable harness identity. Resume older paused runs with their matching artifact.
+- Batch independent workspace reads, searches, index freshness checks and initial OCI snapshot file copies while keeping tool execution, approvals and publication serialized.
+- Add nested/file-size workspace benchmarks, continuity regressions and local efficiency observations. These are not competitive model evaluations.
+
+## 1.0.0-rc.13 - 2026-09-03
+
+### Added
+
+- Add console command completion, previewed multiline drafts, active project-context inspection, and bounded digest-checked file attachments for the next task.
+- Keep interactive sessions open after command/provider failures and pass Ctrl+C cancellation to active turns and review groups while preserving unresolved approval batches.
+- Render terminal-safe model text and optionally colored diffs; discard unsolicited input lines instead of replaying them into approval prompts.
+- Add `zhx init` with interactive terminal prompts and deterministic non-interactive flags, plus explicit `--profile <name>` selection for `run`, `chat`, `review`, and `doctor`.
+- Store one provider/model pair per schema-versioned personal profile outside the repository with owner-only directories/files, descriptor-bound no-follow reads, strict size/link/permission checks, and no credential or authority-bearing fields.
+- Add a versioned `init` JSON document and installed-tarball smoke coverage for initialization, profile reuse, precedence, permissions, and secret-free output.
+
+### Fixed
+
+- Persist externally interrupted ordinary turns as cancelled after runtime cleanup, without replacing completed work, pending approvals, or genuine timeouts.
+- Accept explicit null first-page cursors for listing/search tools, keeping opaque cursor validation for subsequent pages.
+- Add bounded in-memory task history, Alt+Enter multiline input, and terminal-safe Markdown presentation.
+- Treat a valid SQLite database created only by `sessions list` as an uninitialized operations store in `doctor`, while continuing to reject partially initialized or incompatible operational schemas.
+
+### Changed
+
+- Preserve published RC.12 as immutable historical evidence. RC.13 is published to npm `next` with protected live certification, 42/42 representative cases, and independently verified SHA-512 integrity and SLSA provenance; its final human security review remains pending for GA.
+- Keep profiles explicit rather than active-by-default. Precedence is CLI flags, selected profile, environment, then built-in defaults; `resume` never accepts a profile and continues to restore the original durable policy.
+
+### Migration from RC.12
+
+No Harness configuration, run-store, session-store, change-envelope, or execution-policy migration is required. Existing invocations behave as before unless they opt into `zhx init` and `--profile`. Profiles contain only schema version, provider, and model; API keys remain environment-owned.
+
+## 1.0.0-rc.12 - 2026-09-02
+
+### Fixed
+
+- Keep `git_diff` read-only even under hostile repository configuration: disable repository-controlled filesystem monitors, external diffs, text conversion, and submodule processing; discover changed paths with NUL-safe output; and render only paths permitted by the Harness hard-ignore and sensitive-name policy.
+- Bind MCP configuration loading to one regular, single-link file descriptor with `O_NOFOLLOW`, a 1 MiB limit, canonical-parent containment, and inode continuity from initial inspection through the stable read.
+
+### Changed
+
+- Expand the security-review inventory from mutation/execution tools to all 28 model-facing tool classes, including repository reads, inspection, skill loading, delegation, and dynamic MCP tools, with a regression that rejects future inventory drift.
+- Require direct mitigation, regression evidence, residual risk, and passing status for every reviewed trust boundary and authority-bearing tool. Non-informational findings now require an owner, disposition, rationale, and HTTPS follow-up; critical/high findings cannot be accepted without mitigation.
+- Preserve published RC.11 as immutable historical evidence while authorizing RC.12 as the new pending candidate required by HAR-HU-03 remediation. No RC.12 artifact, live certification, registry integrity, or provenance is claimed before the exact tag completes the protected workflow.
+
+## 1.0.0-rc.11 - 2026-09-02
+
+### Fixed
+
+- Keep the governed Qwen representative driver on its certified Responses path instead of selecting Chat through an incompatible transport-level `maxTokens` option; the same output limit remains enforced by the Harness durable token guard before and after each provider step.
+
+### Changed
+
+- Record the immutable, unpublished RC.10 attempt as failed after its exact tarball passed artifact binding: Meta completed 14/14 representative cases, Qwen completed 13/14, and an OpenAI account-funding issue surfaced as retryable HTTP 500 failures across live and representative gates; npm publication remained skipped.
+- Record the protected RC.11 workflow's fail-closed first attempt, where one Qwen representative case returned `EXECUTION_FAILED`, Meta and OpenAI completed 14/14, Qwen completed 13/14, no unauthorized effects were observed, and npm publication remained skipped for that attempt.
+- Publish the complete second RC.11 attempt to `next` only after every deterministic, exact-artifact, OCI, live-provider, and representative gate passed from scratch; Meta, Qwen, and OpenAI each completed 14/14, and the registry artifact passed exact SHA-512 integrity plus SLSA provenance verification.
+
+## 1.0.0-rc.10 - 2026-09-01
+
+### Fixed
+
+- Isolate the non-release early-diagnostic fixture from release-bound environment variables, so the test remains hermetic when `bun test` runs inside the validation job while real incomplete diagnostic bindings continue to fail closed.
+- Allow the immutable readiness ledger to record a deterministic pre-artifact failure with an explicit null artifact digest and `not-run` live certification instead of inventing an artifact identity.
+
+### Changed
+
+- Record the immutable, unpublished RC.9 attempt as failed during deterministic validation before packing: one environment-sensitive test failed, no release tarball was created, every live/representative gate was skipped, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.10`; RC.10 remains pending until its distinct commit and annotated tag complete the full protected workflow.
+
+## 1.0.0-rc.9 - 2026-09-01
+
+### Fixed
+
+- Build `dist/` before the manual tag-bound live-certification workflow packs and inspects the candidate, preventing a source-only tarball from failing artifact binding before OCI and provider gates can run.
+
+### Changed
+
+- Record the immutable, unpublished RC.8 attempt as failed at artifact binding: exact-tag readiness passed, but OCI and every provider gate were skipped, no diagnostic artifact was produced, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.9`; RC.9 remains pending until its exact tag completes protected certification.
+
+## 1.0.0-rc.8 - 2026-09-01
+
+### Fixed
+
+- Complete HAR-HU-01 release diagnostics without relaying child stdout/stderr: every live gate now persists only strict sanitized outcomes identified by provider or phase, and the final summary remains fail-closed.
+- Record a missing provider credential as that provider's configuration failure so the remaining selected providers still execute, and include OCI image preload as an independent diagnostic gate instead of short-circuiting the matrix.
+
+### Changed
+
+- Refresh the coordinated Zhivex dependency set to the current published versions verified for this candidate: `@zhivex-ai/core@1.11.0`, `@zhivex-ai/qwen@0.11.1`, and `@zhivex-ai/gemini@0.11.0`, while retaining current Agents `1.3.0`, Meta `0.2.2`, OpenAI `0.10.0`, exact package pins, and one Core override across every adapter.
+- Keep the Harness Qwen tool-call-ID normalizer as a defense-in-depth boundary while adopting the adapter's current missing/placeholder-ID normalization, Responses continuation correlation, and Bun realtime frame-limit correction.
+- Authorize `v1.0.0-rc.8` in the representative evaluation matrices and record it as pending. No live-provider, representative-repository, release-artifact, registry, or provenance result is claimed before the exact candidate completes those gates.
+
 ## 1.0.0-rc.7 - 2026-08-25
 
 ### Fixed
@@ -446,3 +716,19 @@ No configuration, SQLite, approval, or execution-policy migration is required. E
 ### Added
 
 - Initial provider-portable coding harness MVP for Meta, Qwen, and OpenAI.
+
+### Experimental local service CLI
+
+- Added opt-in `--service` for run/resume/chat and session list/inspect/rename,
+  with durable event replay and existing versioned JSON/JSONL documents.
+- Persisted the shared CLI result projection and explicitly bound service run
+  admission to host scope. Added CLI/second-client crash recovery in installed smoke.
+
+### Experimental desktop chat
+
+- Added redacted per-run chat activity with durable prompts, bounded tool snapshots
+  and actual check exit codes. Session reads remain available during execution.
+- Preserved CLI JSONL compatibility; desktop strips rich engine/CLI/approval payloads,
+  deduplicates replay and reconciles lost responses before allowing another send.
+- Verified packaged macOS chat with duplicate submission, failed check, expired
+  snapshot, transport interruption, renderer reload and split-secret fixtures.