@zhivex-ai/harness 1.2.0 → 1.3.0-rc.7

package/CHANGELOG.md

@@ -4,6 +4,70 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.3.0-rc.7 - 2026-10-01
+
+- Pin Qwen contract certification to zero sampling temperature in approval and conversation continuity smokes, preserving all approval, compaction, effect and context assertions. Application model defaults remain unchanged.
+- Distinguish approval resume status, compaction and private continuation failures; retain sanitized run counters and typed provider causes without publishing model output or messages.
+- Prepare RC7 with exact Code/Desktop pins and historical representative mappings preserved. Prior failed RC6 evidence remains historical; RC7 requires its own exact-artifact and protected release gates.
+
+## 1.3.0-rc.6 - 2026-09-30
+
+- Make protected OCI execution certification use a host-owned Node fixture while retaining exact command, patch, approval and journal checks.
+- Align manual certification with all six protected provider routes and preserve typed, sanitized continuity failures in the aggregate release diagnostics.
+- Admit future canonical release tags through the reviewed Vertex WIF identity condition, retaining repository, owner, environment, event and workflow bindings.
+- Prepare RC6 metadata, representative model mapping and exact Harness pins for Code and Desktop. Publication requires new release-bound artifact, live and representative evidence.
+
+## 1.3.0-rc.5 - 2026-09-30
+
+- Use the explicit Anthropic default endpoint when `ANTHROPIC_BASE_URL` is empty or whitespace-only, including empty optional workflow secrets. Preserve host environment isolation and rejection of unsafe custom endpoints.
+
+- Restore Qwen `qwen3.8-flash` and Meta `muse-spark-1.3-contributor` for protected certification, representative evidence and task acceptance. Preserve historical model mappings and CLI/Desktop/registry defaults; retain Gemini API 3.6 Flash and Vertex 3.7 Flash.
+- Prepare RC5 metadata and exact Harness pins for Code and Desktop, with regressions against certification model drift. Paid live certification and publication require separate approval; this preparation does not certify the new artifact.
+
+## 1.3.0-rc.4 - 2026-09-29
+
+- Add experimental trusted tool policies, explicit review receipts, policy inspection, durable task acceptance with exact-byte OCI delivery, structured delegation validation, and sanitized portable governance reports.
+- Add reviewed CLI/Desktop checkpoint restoration and bounded capture/retention.
+- Prepare Code 0.1.0-rc.2 with an exact RC4 dependency; require all six provider routes, approval compaction, structured delegation, continuity and four mixed-provider edges in protected certification. Include consumer documentation and isolate Desktop candidate provisioning from public registry availability.
+
+- Reduce repeated request context with concise host instructions, progressive tool schemas and recoverable excerpts of durable tool evidence. Preserve host policy, approval and explicit catalogs; add bounded numeric request measurements and a same-budget Sonnet 5.5 follow-up pilot.
+
+- Add experimental host-only `/mcp/stdio/v1`: explicit OCI admission, private snapshots, bounded stdio lifecycle, durable tool approvals, scoped resource recovery and host-authorized reconciliation. Verify a real MCP server from an installed candidate on Node 22/24 and Bun; workspace JSON still cannot enable stdio.
+
+- Expand independent Harness/Code acceptance to both installation orders across local/global managers, historical session and approval boundaries, and Node/Bun runtime checks. Retain exact candidate identity through a read-only acceptance registry and preserve failed default-registry attempts separately.
+
+- Migrate Desktop to an installed Harness tarball through declared package exports, including the versioned host provider contract. Verify artifact identity during build/package, remove source rewriting, and validate packaged conversation, approval, restart and persisted diff behavior.
+
+- Move Desktop whole-database snapshot/validation logic into Harness persistence and add the narrow, versioned `/desktop/v1/state` host contract. Keep raw SQL and `SqliteDatabase` private; preserve recovery errors, permissions and cooperative lease checks.
+
+- Add the explicit beta `/models` package entrypoint for browser-safe catalog data, schemas and display helpers, with clean-consumer Node/type/browser verification.
+
+- Add provisional Vertex through Google Cloud ADC with refresh, explicit project/location, shared CLI/Desktop selection and sanitized diagnostics. Route changes invalidate durable approvals. Keep renderer catalog metadata separate from host authentication and transport dependencies.
+
+- Classify provider HTTP 402 as `payment_required` without leaking response data; add Gemini creation/update, nullable-digest, signed-continuation and durable approval regressions. Preserve the earlier Gemini 3.7 HTTP 402 reproduction; subsequent Gemini API 3.6 Flash candidate gates passed. Certification remains bound to each model and artifact.
+
+- Add provisional Anthropic direct API support via SDK 0.12.4, shared CLI/Desktop models, secret-store credentials and presence-only diagnostics. Preserve existing default transport fingerprints; signed provider data, tool IDs and usage remain intact.
+- Add a versioned common task acceptance suite with seven fixtures, protected independent checks, durable approval/restart/cancellation, explicit model/route/artifact/budgets and append-only attempt evidence. Failed first attempts remain failed when a later retry recovers. No live certification or publication is implied.
+
+## 1.3.0-rc.3 - 2026-09-28
+
+- Release Meta stream deadlines after HTTP setup errors, stream completion, cancellation and early iterator closure; retain the original provider error and natural process exit.
+- Certify valid approval recovery using persisted pre-approval validation receipts without accepting additional executions, new errors or mismatched approved calls.
+- Bound Desktop smoke renderer diagnostics and retain phase timing without extending the watchdog or weakening lease/approval checks.
+- Pin the independent Code RC to Harness RC3. Local corrected-artifact acceptance reached 41/42: OpenAI and Qwen 14/14, Meta 13/14 with one HTTP 504. The operator authorized proceeding with RC preparation despite this provider failure; protected certification remains separate and is not recorded as passed.
+
+## 1.3.0-rc.2 - 2026-09-28
+
+- Reject a mismatched `apply_patch` proposal digest during input validation, before requesting operator approval. Invalid calls remain non-mutating and can be corrected by the model; valid calls still require the original approval.
+- Preserve the exact provider certification assertions after the failed RC1 attempt; no historical tag or artifact is changed.
+- Prepare the independent Code RC with an exact Harness RC2 dependency and protected artifact/provenance publication workflow.
+
+## 1.3.0-rc.1 - 2026-09-28
+
+- Add explicit terminal-independent Harness engine, protocol, client, local-service and ACP entrypoints while preserving historical root exports and stable signatures.
+- Extract the Code terminal product into its own unpublished package with the distinct `zhivex-code` binary; Harness 1.x keeps its existing binaries and state contracts.
+- Add transitive architecture checks and installed candidate acceptance for engine approvals/recovery and Code execution/cancellation across npm, pnpm, Yarn and Bun. The new APIs target the future Harness 1.3 line; RC1 targets npm `next` and does not claim completion of the provider roadmap.
+
 ## 1.2.0 - 2026-09-27
 
 - Promote the code validated in 1.2.0-rc.13 to the stable release line, targeting npm `latest` through the protected GitHub Actions workflow.

package/README.md

@@ -3,7 +3,7 @@
 **Work on your code with an agent. Review consequential actions before approving them.**
 
 Zhivex Harness is a local terminal assistant and TypeScript library. It supports
-OpenAI, Qwen and Meta, with provisional Gemini support. Conversations and pending
+OpenAI, Qwen and Meta, with provisional Gemini, Anthropic and Vertex support. Conversations and pending
 approvals survive restarts.
 
 Use it to understand a repository, discuss a design, investigate a failure or
@@ -11,12 +11,11 @@ implement a change. Conversation context retains decisions, hypotheses and bound
 diagnostic excerpts across compaction. Edits and command execution keep their
 own permission checks; a conversational summary never grants approval.
 
-Version `1.2.0` is prepared for stable publication to npm `latest`, based on
-published RC13 and its successful protected release workflow. It includes incremental
-durable history and bounded active checkpoints for long conversations. Stable
-publication remains pending; the installation commands below target 1.2.0 once
-published. The [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-preserves historical stable evidence.
+Version `1.3.0-rc.7` prepares the terminal-independent engine API and the local
+Code package for candidate validation on npm `next`. Publication remains pending
+the protected release workflow. RC4 includes Anthropic, Gemini/Vertex, Desktop package migration, isolated MCP/ACP,
+checkpoints and experimental governance controls. Code publication is independent.
+Stable `1.2.0` remains available under npm `latest`.
 Desktop retains its separate private alpha status.
 
 ## Quick start
@@ -24,7 +23,7 @@ Desktop retains its separate private alpha status.
 Requires Node.js 22.13.0 or newer, Git and a provider API key.
 
 ```sh
-npm install -g @zhivex-ai/harness@1.2.0
+npm install -g @zhivex-ai/harness@1.3.0-rc.7
 cd /path/to/your/project
 zhx
 ```
@@ -68,7 +67,7 @@ The default runtime has no OS isolation and exposes no shell-class tools. Runnin
 commands in isolation requires an explicitly configured Docker or Podman environment;
 see [Execution environments](docs/EXECUTION_ENVIRONMENTS.md).
 
-Gemini remains provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
+Gemini, [Anthropic](docs/ANTHROPIC.md) and [Vertex](docs/VERTEX.md) remain provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
 [security policy](SECURITY.md) for supported configurations and reporting concerns.
 
 ## Documentation
@@ -79,7 +78,7 @@ Gemini remains provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
 
 [Browse documentation](docs/README.md).
 
-Version `1.1.1` is the current public npm release. Source checkout changes can be
+Version `1.2.0` is the current stable public npm release. Source checkout changes can be
 newer than the published package. Consult the [changelog](CHANGELOG.md) and
 [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
 for the recorded 1.0.0 release; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)