@zhivex-ai/harness 1.1.0-rc.3 → 1.2.0-rc.5

package/CHANGELOG.md

@@ -4,10 +4,201 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.2.0-rc.5 - 2026-09-26
+
+- Adapt the assistant loop to explanation, investigation, design and implementation without imposing a repair ceremony on read-only work. Remove the `strict`/`repair` runtime profile choice; callers requiring verified completion use `requireVerifiedDelivery` or `--require-verified-delivery` directly. This is an intentional pre-promotion API/CLI break; saved connection profiles and subagent roles remain independent.
+- Unify bounded tool-error, invalid-argument and unknown-tool recovery across CLI, SDK and delegated runs, independently of the repair controller. Explicit fail-fast tool options remain available.
+- Return malformed application-owned delegation arguments through bounded SDK validation feedback without launching a child. Preserve hidden-tool rejection and exact task-ID authorization.
+- Preserve conversational decisions and bounded, redacted local error observations through repeated deterministic and model-assisted compaction. Context is working memory; approvals and verification remain tool-owned.
+- Prioritize recent user corrections over the historical objective and assistant recollections during compaction; retain more distinct user steering within the same summary budget.
+- Use the remaining repair output budget instead of an implicit 2,048-token per-response cap. Preserve explicit caps and provider transport compatibility. Finish after relevant checks and change review without requiring duplicate audits.
+- Refresh discovered directory guidance after normal edits instead of aborting the conversation; retain path, link, encoding and size protections.
+- Return the matching persisted context/accounting checkpoint in all runs, and detect repeated tool cycles even when the model changes its progress narration.
+- Invalidate failed or superseded model edit references and explain how to recover them before another approval. Keep partially failed changes pending verification and preserve closure capacity after rejected plans or out-of-scope reads.
+- Remove lifetime cutoffs for operator requests and discovered instruction counts; paginate task history and preserve repeated latest requests such as A → B → A. New user requests reset loop history while approval resumes retain it.
+- Share a finite 50-step default across API and chat, and accept explicit larger step/tool-call limits without the former arbitrary ceilings.
+- Preserve the newest correction before the historical objective under tight summary budgets, including corrections after a previous summary emptied the objective. Authenticate builtin output before semantic export; restored summaries retain user objectives and steering without exporting unproven tool diagnostics or excerpts.
+- Prepare fresh exact-artifact certification for RC5. RC4 passed base live certification but failed its representative matrix and was not published; its tag and evidence remain unchanged.
+
+## 1.2.0-rc.4 - 2026-09-26
+
+- Identify the precise live-execution assertion in sanitized release diagnostics: approved tool/arguments, import reference, run status, completion marker, approval/tool sequence, tool success, host content, environment binding or durable journal.
+- Preserve a failed run's structured cause instead of reducing it to an opaque status assertion. Existing assertions, cohort, budgets and all exact-artifact release gates remain enforced.
+- Preserve unpublished RC3 and its failed Qwen execution evidence. One local reproduction on the same RC3 tarball passed; it does not establish the CI failure's cause or certify RC4.
+
+## 1.2.0-rc.3 - 2026-09-25
+
+- Model-facing reviewed edits and OCI imports no longer require copying file digests or patch IDs. The runtime binds successful prior reads/inspections before requesting approval; persisted approvals and programmatic tool contracts retain their exact references.
+- Preserve rejection of stale files and changed OCI snapshots, including after restart. Missing reference evidence requires another read/inspection; explicit legacy references are never silently replaced.
+- Return sanitized argument-validation receipts in CLI and representative runs within existing step/error budgets. Distinguish provider syntax failures and patch inspections in release diagnostics without retaining provider payloads or adding retries.
+- Prepare the unchanged Meta/Qwen/OpenAI cohort and 42-case release gate for the exact RC3 artifact. RC2 failed representative validation and was not published.
+
+## 1.2.0-rc.2 - 2026-09-25
+
+- Speed up standalone CLI help/version loading, bounded workspace and OCI inventory reads, scoped-context validation and chat persistence reuse; enable bounded independent CLI reads with mutation barriers.
+
+- Recover one terminal OCI patch-ID mismatch against an unchanged inspected snapshot through model feedback and a fresh approval; preserve the limit across resume.
+- Run release live provider gates against the validated tarball and require packaged Desktop restart, effect-recovery, cancellation and worktree smokes in CI.
+- Let Desktop offer stay/cancel before draining IPC blocked on an active run; retain draining before host shutdown.
+
+- Preserve OCI inspection references across approval restart and emit sanitized diagnostics distinguishing submitted patch-ID mismatch, snapshot drift, unavailable review evidence and execution-binding changes; retain exact-byte import rejection.
+
+## 1.2.0-rc.1 - 2026-09-25
+
+- Prepare the next-channel candidate with Meta `muse-spark-1.3`, Qwen `qwen3.8-flash` and OpenAI `gpt-6-luna` across live and representative certification. Fresh exact-artifact certification and publication remain pending.
+- Remove archived candidate notes and exploratory design assets from the working tree; preserve links to their Git history.
+
+- Integrate the coordinated stable SDK batch (Core 1.24 / Agents 1.10): SDK-owned auxiliary compaction reservations and durable receipts, catalog recommendation contracts, and opt-in MCP HTTP/OAuth transport. Preserve the existing MCP protocol by default.
+
+- Add opt-in model-assisted compaction with explicit provider/model selection, shared token budgets, and durable usage accounting; retain deterministic compaction by default.
+- Enrich the model catalog with sourced context/output limits, pricing evidence, and conservative compaction recommendations available through `/compaction`.
+- Load scoped repository instructions after authorized reads, detect repeated unproductive cycles, and execute approved independent local reads concurrently with mutation barriers.
+- Add experimental declarative tool policies, allowlisted MCP resources, an ACP text-session stdio adapter (`zhx-acp`), and reviewable workspace checkpoint restore APIs with crash recovery and portable backups.
+
+- Normalize fragmented Qwen reasoning losslessly in saved histories and new streams so repeated event envelopes do not exhaust compaction limits.
+
+
+- Prevent long `runHarness` streams from exhausting the SDK replay history; retain a bounded tail with full live delivery and observe completion rejections immediately.
+
+
+- Keep compact chat progress visible during model waits and retain grouped summaries of completed tools.
+
+
+- Local chat now defaults to 50 steps with `/limits` controls, exposes persisted step exhaustion, and uses compact approval cards with keyboard choices and stable activity rows.
+
+
+- Interactive Qwen service/region credentials, explicit endpoint conflict handling, optional `/connection` probe, and session-scoped `/approvals` menu.
+
+
+- Add local ask/auto/restricted approval modes and approval-gated, bounded dependency metadata/type reads with task-scoped consent.
+- Let local CLI runs recover from tool execution failures within existing error budgets and explain protected-path failures in terminal diagnostics.
+
+- Default new local interactive sessions to continued execution without cumulative token ceilings; preserve explicit limits, saved policies and bounded automation/SDK/service defaults.
+- Add `--token-budget` and `--context-tokens`, and distinguish retained context from cumulative usage and remaining budget in console diagnostics.
+
+- Check estimated request input against remaining cumulative input and total tokens before contacting the provider.
+- Update single-agent compaction thresholds with consumption from the current invocation; strict runs switch to an evidence-based final answer near their token budget.
+- Preserve reported usage in failed checkpoints when an over-budget response is rejected before its tools execute.
+
+## 1.1.4 - 2026-09-24
+
+- Preserve provider-independent rejection reasons in sanitized diagnostics and Actions summaries, with bounded response inspection and separate transport/stream failures.
+- Distinguish cleanup completion, result flushing and pending process exit; retain a completed provider failure when the supervisor later times out.
+- Preserve all five bounded entries in a completed driver failure after a supervisor timeout, including a provider diagnostic at the end of the chain.
+
+## 1.1.3 - 2026-09-24
+
+- Add bounded model/HTTP-attempt, tool and OCI timing spans, phase history, timeout budgets and per-case Actions evidence links.
+- Preserve bounded benchmark stage/event checkpoints across driver timeouts and display them in release summaries; reserve cleanup time within the existing deadline without accepting incomplete certification.
+
+## 1.1.2 - 2026-09-24
+
+- Update Qwen to 0.15.2 for the current QwenCloud Token Plan endpoint and supported Max/Flash models; document explicit credential and endpoint pairing.
+- Keep successful tool activity out of the interactive transcript, retain transient TTY status and `/verbose`, and preserve Markdown formatting across streaming pauses.
+- Repair safe owner-controlled SQLite lock permissions on macOS and exclude newly created local state from ordinary Git adds without deleting existing sessions.
+- Show bounded Meta HTTP failure reasons and suppress duplicate terminal errors. The reported live HTTP 400 remains unconfirmed; no blanket retry is added.
+
+## 1.1.1 - 2026-09-23
+
+- Update the RC.10 SDK batch to its stable releases: Agents 1.9.0, Core 1.23.0, Gemini 0.12.2, Meta 0.2.7, OpenAI 0.13.5 and Qwen 0.15.1. Preserve approvals and exactly-once host effects across resume; the updated artifact still requires release certification.
+- Include bounded approval-denial evidence in benchmark and release diagnostics: tool, rejection rule, approval round and preceding compactions, without raw arguments or model text. Distinguish lexical command matches from direct protected-test edits.
+- Publish directly to `latest` after fresh exact-artifact certification. Preserve the failed `v1.1.0` tag and its evidence.
+- Archive superseded audit reports and intermediate diagnostic plans in Git history.
+
+## 1.1.0 - 2026-09-23
+
+Compatible minor release of the Node CLI and TypeScript library. The separate
+Desktop application remains private alpha; Gemini remains provisional.
+
+- Simplify first-use provider/model selection, credential setup, command help and recovery. Add UTF-8 task input, atomic profile updates and a shared searchable model catalog.
+- Improve conversation activity, context estimates and compaction while preserving working plans. Add explicit unlimited cumulative-token mode without disabling per-request limits, accounting or other execution controls.
+- Add authenticated local service transport, durable redacted event replay and application-owned read delegation with file scope and acceptance checks.
+- Integrate the SDK prerelease batch certified by RC.10, including redaction, failed-child accounting and OpenAI function receipt fixes. Preserve approvals and exactly-once host effects across resume.
+- Use Muse Spark 1.3, Qwen 3.8 Max and GPT-6 Luna for new selections and release certification. Add bounded Meta receipt-continuation recovery; preserve saved model selections and historical certification mappings.
+- Preserve Stable 1.x contracts and state format 1. Existing installations need no state migration; review new default models when creating profiles.
+
+RC.10 passed the full artifact, live and representative gates. Publication of this
+stable artifact requires its own protected certification and provenance verification.
+
+## 1.1.0-rc.10 - 2026-09-23
+
+- Restore `qwen3.8-max` as the default for new CLI/Desktop selections and RC.10 certification. Keep saved models and historical release mappings unchanged.
+- Remove transient provider/SDK investigation reports and their local trial evidence; retain them in Git history.
+
+- Recover once when Meta Responses rejects a function receipt continuation because its response ID is unavailable. Replay the identical request after a bounded delay, preserve cancellation, and exclude hosted tools and unrelated HTTP errors. Host tools are not executed again.
+- Bind the new Meta transport policy to durable run identity. Use Qwen 3.8 Max, OpenAI Luna 6 and Muse Spark 1.3 release models; full release certification remains required.
+
+## 1.1.0-rc.9 - 2026-09-23
+
+- Upgrade Core to 1.23.0-next.2 and Agents to 1.9.0-next.2. All eight consumer redaction cases pass, including later rejection and file-store reopen. Qwen Flash orchestration remains intermittent, so RC certification is still blocked.
+
+- Default new Meta selections to Muse Spark 1.3 and use Responses for built-in Meta agent tool loops. Bind the transport migration to durable run identity; preserve saved model IDs and historical evidence. Certification remains pending.
+
+- Add application-owned read delegation contracts: models select task IDs while Harness preserves task text, enforces file scope and validates acceptance. Keep durable SDK execution and budgets; expose finite error classifications without logging task content.
+- Allow trusted strict-mode applications to select a fingerprint-bound tool catalog and render only relevant tool instructions. Use scoped contracts/catalogs in live certification without weakening effect, approval, journal or marker checks.
+- Integrate the published SDK next batch with failed-child linkage/accounting and OpenAI function receipt fixes. Update native-tool fixtures to the consistent metadata contract.
+- Publication remains blocked: governed Flash orchestration passed three local executions, but the scoped base campaign failed one of three cases on exact approval arguments before mutation. These are local validation results, not a new RC certification.
+
+## 1.1.0-rc.8 - 2026-09-22
+
+- Preserve OpenAI function tool receipts through approval resume using SDK result envelopes. Prevent function names such as `apply_patch` from being mistaken for native Responses tools and losing their output. Keep release assertions and fail-fast gates unchanged.
+
+## 1.1.0-rc.7 - 2026-09-22
+
+- Select `gpt-6-luna` as the OpenAI default for new CLI/Desktop choices and pin it in RC7 release certification. Preserve explicitly saved models and historical certification mappings.
+- Identify failed base live-smoke checkpoints with allowlisted labels and assertion kinds, without retaining raw assertion values or model responses.
+
+## 1.1.0-rc.6 - 2026-09-22
+
+- Stop release gates and remaining providers after a confirmed failure while retaining exhaustive manual diagnostics.
+- Preserve completed certification cases across report failures and record bounded, sanitized error structure and finalization phases.
+
+## 1.1.0-rc.5 - 2026-09-22
+
+Unpublished candidate targeting npm `next`, superseding the tagged but unpublished RC.4.
+
+- Use `qwen3.8-flash` as the default Qwen model in CLI/Desktop and the new release certification matrix. Keep Max selectable and preserve explicitly saved model choices and historical certification pins. Flash requires fresh release-bound certification.
+
+## 1.1.0-rc.4 - 2026-09-22
+
+- Align the SDK batch with the latest stable packages verified on 2026-09-22:
+  Agents 1.8.0, Core 1.22.0, Gemini 0.12.1, Meta 0.2.6, OpenAI 0.13.4 and
+  Qwen 0.15.0. Keep the compatible TypeScript 6.0.3 compiler API for architecture
+  and Stable signature checks while building with TypeScript 7.0.2.
+
+- Use searchable provider/model selection during first use, detect a lone environment
+  provider, recover failed keychain setup with explicit temporary use or retry, and
+  show one ready screen with credential source and approval policy.
+- Make `doctor` follow conversation defaults and inspect the selected environment
+  or keychain credential without contacting the provider. Human diagnostics focus
+  on the selected provider; JSON retains the full provider inventory. One-shot
+  execution continues to require explicit profiles and environment credentials.
+
+- Retain recent conversation groups by estimated tokens, adapt repair compaction
+  to remaining input allowance, and preserve structured working plans across
+  repeated summaries. Keep SDK approval/checkpoint ownership and explicit overrides.
+- Unify context estimates, reuse transport measurements and cache tool-schema
+  serialization. Default discovery to ten search matches and path-only listings;
+  callers can explicitly request larger results and digests.
+
+- Add `--no-token-budget` / `unlimitedTokens: true` to disable cumulative token
+  budgets for main runs and subagents while preserving usage accounting,
+  compaction, per-request limits, and non-token execution controls.
+
+Unpublished release candidate targeting npm `next`, following published RC.3.
+Fresh protected certification is required before publication. Stable `latest`
+remains 1.0.0.
+
+- Make appended command help independent of task/configuration validation, group options with examples, and accept `--name=value` for value options.
+- Add explicit UTF-8 task input through `zhx run -` and `zhx review -`, bounded to 1 MiB and retaining approval requirements.
+- Add atomic personal profile updates with `zhx init --update`, reopen provider/model selection after declining the default profile, and give actionable usage/configuration recovery messages.
+- Share the curated model catalog across CLI and Desktop, with primary/other groups, explicit lifecycle and validation metadata, custom model IDs, and optional HTTPS catalog distribution with cached fallback.
+- Improve the separate Desktop alpha with rendered Markdown, file diffs, conversation navigation and local preferences, accessible panels and controlled external links. Desktop retains its independent private alpha version.
+
 ## 1.1.0-rc.3 - 2026-09-22
 
-Release candidate targeting npm `next`; fresh protected certification is required
-before publication. Stable `latest` remains 1.0.0.
+Published release candidate on npm `next`. The changes below describe RC.3;
+subsequent work belongs to RC.4. Stable `latest` remains 1.0.0.
 
 - Group interactive tool activity into a bounded live line and summaries between assistant messages. Preserve individual failures, check receipts and approval requests; `/verbose` restores event detail.
 - Identify token-budget and step-limit failures without mislabeling them as provider stream failures or exposing arbitrary provider error payloads.
@@ -744,3 +935,9 @@ No configuration, SQLite, approval, or execution-policy migration is required. E
   deduplicates replay and reconciles lost responses before allowing another send.
 - Verified packaged macOS chat with duplicate submission, failed check, expired
   snapshot, transport interruption, renderer reload and split-secret fixtures.
+
+- Local CLI continuity: align interactive tool/error/time limits with 50-step
+  turns; add `/continue` with retained results, exact session approvals for checks
+  and bounded dependency reads, a repeated-tool-failure circuit breaker and two
+  transport retries. Explicit policies, saved run receipts and automation defaults
+  remain authoritative.

package/README.md

@@ -6,15 +6,25 @@ Zhivex Harness is a local terminal assistant and TypeScript library. It supports
 OpenAI, Qwen and Meta, with provisional Gemini support. Conversations and pending
 approvals survive restarts.
 
-This development branch prepares `1.1.0-rc.3` (unpublished), with console, local
-service and Desktop preview improvements. The commands below install stable 1.0.0.
+Use it to understand a repository, discuss a design, investigate a failure or
+implement a change. Conversation context retains decisions, hypotheses and bounded
+diagnostic excerpts across compaction. Edits and command execution keep their
+own permission checks; a conversational summary never grants approval.
+
+Version `1.2.0-rc.5` is prepared as an unpublished release candidate for npm `next`,
+with console, local service and governed delegation improvements. Certification
+and publication remain pending. The
+[repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
+preserves historical stable evidence. The installation commands below target
+1.2.0-rc.5 once published; stable users can install `@zhivex-ai/harness@latest`.
+Desktop retains its separate private alpha status.
 
 ## Quick start
 
 Requires Node.js 22.13.0 or newer, Git and a provider API key.
 
 ```sh
-npm install -g @zhivex-ai/harness@1.0.0
+npm install -g @zhivex-ai/harness@1.2.0-rc.5
 cd /path/to/your/project
 zhx
 ```
@@ -69,8 +79,8 @@ Gemini remains provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
 
 [Browse documentation](docs/README.md).
 
-Version `1.0.0` is the current public npm release. Source checkout changes can be
+Version `1.1.1` is the current public npm release. Source checkout changes can be
 newer than the published package. Consult the [changelog](CHANGELOG.md) and
 [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-for release identity; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
+for the recorded 1.0.0 release; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
 records validation scope and limitations.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `1.0.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Security fixes are provided for the latest published `1.1.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,8 +1,8 @@
 # Support
 
-Zhivex Harness `1.0.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
+Zhivex Harness `1.1.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record preserves the verified 1.0.0 release; check npm for the current published version.
 
-The 1.0 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix.json) and its [human-readable view](./docs/SUPPORT_MATRIX.md). Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
+The 1.1 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix-1.1.json) and its [human-readable view](./docs/SUPPORT_MATRIX_1_1.md). The [1.0 matrix](./docs/SUPPORT_MATRIX.md) remains historical. Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
 
 ## Supported baseline
 
@@ -13,7 +13,7 @@ The 1.0 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `1.0.x` patch receives routine fixes. The exact `v1.0.0` tag passed protected release-bound base, orchestration, routing and model-directed execution for Meta, Qwen and OpenAI on 2026-09-20; the complete representative matrix passed on its authorized second attempt. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published `1.1.x` patch receives routine fixes. The exact `v1.1.1` tag passed the protected artifact, live-provider and representative release jobs. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/benchmarks/README.md

@@ -46,3 +46,20 @@ The opt-in [SWE-bench comparison](https://github.com/Zhivex/zhivex-harness/blob/
 mini-SWE-agent and the native Zhivex OCI harness, exports actual patches, and grades
 with the official SWE-bench evaluator. `bun run benchmark:swebench:test` validates
 its offline contracts. Paid runs require a prepared, pinned matrix and `--live`.
+
+## Bounded read and startup optimizations
+
+CLI runs, resumes and conversations now enable at most four independent trusted
+local read tools; mutation barriers and approval requirements remain in force.
+Workspace indexing traverses at most eight directories at once and coalesces
+only overlapping freshness checks. Later calls still validate directories and
+ignore-file contents; there is no TTL or persistent content cache.
+
+OCI inventory reserves each four-file batch against the aggregate workspace byte
+limit before reading contents. Descriptor-bound reads remain capped at each
+reserved size and fail if file identity or timestamps changed. Scoped instruction
+validation reads at most four files concurrently and preserves durable digest checks.
+
+The packaged CLI uses a separate lightweight help/version entrypoint and lazy
+runtime chunks. Package smoke coverage must exercise the installed CLI and aliases
+so missing chunks cannot pass as a working source checkout.