@zhivex-ai/harness 1.3.0-rc.3 → 1.3.0

package/dist/engine/index.js

@@ -2,8 +2,6 @@ import {
   CHANGE_ENVELOPE_DIGEST_ALGORITHM,
   CHANGE_ENVELOPE_SCHEMA_VERSION,
   DEFAULT_TIME_TO_SAFE_FIX_GOAL,
-  HARNESS_STATE_BACKUP_MAX_BYTES,
-  HARNESS_STATE_BACKUP_SCHEMA_VERSION,
   MAX_CHANGE_ENVELOPE_APPROVALS,
   MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES,
   MAX_CHANGE_ENVELOPE_ATTESTATIONS,
@@ -51,28 +49,31 @@ import {
   computeChangeEnvelopeDigest,
   computeChangeEnvelopeEvidenceDigest,
   createChangeEnvelope,
-  createHarnessStateBackup,
   createTimeToSafeFixCases,
   createTimeToSafeFixReport,
   createTimeToSafeFixSample,
   digestChangeEnvelopeArtifact,
-  exportHarnessStateBackup,
   externalAttestationReferenceSchema,
-  importHarnessStateBackup,
-  importHarnessStateBackupFile,
   injectTimeToSafeFixAttack,
-  inspectHarnessState,
-  openWorkspaceCheckpointStore,
   parseCliJsonDocument,
   parseCliJsonLineDocument,
-  readHarnessStateBackup,
   recommendCompactionModels,
-  stateBackupBundleSchema,
   timeToSafeFixDriverResultSchema,
   timeToSafeFixLatencyStatistics,
   timeToSafeFixTaskSchema,
   verifyChangeEnvelope
-} from "../index-d0wrghff.js";
+} from "../index-8vm2m34s.js";
+import {
+  HARNESS_STATE_BACKUP_MAX_BYTES,
+  HARNESS_STATE_BACKUP_SCHEMA_VERSION,
+  createHarnessStateBackup,
+  exportHarnessStateBackup,
+  importHarnessStateBackup,
+  importHarnessStateBackupFile,
+  inspectHarnessState,
+  readHarnessStateBackup,
+  stateBackupBundleSchema
+} from "../index-a97bezbz.js";
 import {
   CLI_COMMAND_OPTION_CONTRACTS,
   CLI_OPTION_DEFINITIONS,
@@ -82,7 +83,7 @@ import {
   resolveHarnessModelRoutes,
   serializeHarnessModelRoutes,
   validateCliCommandOptions
-} from "../index-f4sb0e2q.js";
+} from "../index-2jrdcj6b.js";
 import {
   harnessLocalCredentialsSchema,
   openHarnessActivityStore,
@@ -90,108 +91,136 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-kfgt9yqq.js";
+} from "../index-w2sj0wkw.js";
 import {
-  BUN_ENGINE_RANGE,
-  CliOciRuntimeAdapter,
+  createAcpConnection,
+  serveAcpStdio
+} from "../index-3ah1f369.js";
+import {
+  APPROVAL_HISTORY_KEY,
   DEFAULT_HARNESS_CONTEXT_MANIFEST,
   DEFAULT_HARNESS_PROJECT_INSTRUCTIONS,
-  EDIT_CONTRACT_SCHEMA_VERSION,
-  EDIT_DIGEST_ALGORITHM,
   HARNESS_CONTEXT_BUNDLE_SCHEMA_VERSION,
   HARNESS_CONTEXT_CONFIG_SCHEMA_VERSION,
-  HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
   HARNESS_INSTRUCTIONS,
   HARNESS_LIFECYCLE_EVENTS,
-  HARNESS_MCP_CONFIG_SCHEMA_VERSION,
-  HARNESS_MCP_PERMISSIONS,
-  HARNESS_OCI_LABEL,
-  HARNESS_OCI_LABEL_VALUE,
-  HARNESS_OPERATIONS_SCHEMA_VERSION,
-  HARNESS_SQLITE_FILE,
   HARNESS_SUBAGENT_PROFILE_DESCRIPTORS,
-  HARNESS_VERSION,
-  MAX_EDIT_CHANGES,
-  MAX_EDIT_FILE_BYTES,
-  MAX_EDIT_PROPOSAL_BYTES,
   MAX_HARNESS_CONTEXT_FILES,
   MAX_HARNESS_CONTEXT_FILE_BYTES,
   MAX_HARNESS_CONTEXT_TOTAL_BYTES,
   MAX_HARNESS_SKILLS,
   MAX_HARNESS_SKILL_DIRECTORIES,
   MAX_HARNESS_SKILL_FILE_BYTES,
-  NODE_ENGINE_RANGE,
   SEMANTIC_COMPACTION_VERSION,
-  TERMINAL_RUN_STATUSES,
-  Workspace,
   appendUserMessage,
-  applyEditProposalInputSchema,
   applyHarnessToolPolicy,
+  approvalDecisionViews,
   assertHarnessModelCapabilities,
-  cancelHarnessRun,
-  cleanupHarnessExecutionArtifacts,
-  cleanupHarnessRuns,
   compactHarnessMessages,
-  createEditProposal,
   createEmptyHarnessContextBundle,
   createExecutionEnvironmentTools,
   createHarness,
   createHarnessClientAdapter,
   createHarnessLifecycleDispatcher,
-  createHarnessMcpTools,
-  createHarnessOciExecutionEnvironment,
   createHarnessSubagents,
   createHarnessToolPolicy,
-  createHttpMcpClient,
   createProgressMonitor,
   createSemanticCompactor,
-  describeOciCommand,
-  editChangeSchema,
-  editChangesSchema,
-  editContractDocument,
-  editProposalChangeSchema,
-  editProposalInputSchema,
-  editProposalSchema,
   estimateMessageTokens,
-  executionFingerprintInput,
-  fileDigestSchema,
   harnessContextConfigurationSchema,
   harnessContextFingerprintInput,
-  harnessExecutionSession,
   harnessLifecycleFingerprintInput,
+  harnessPolicyDecisionEventSchema,
   harnessSkillLoadInputSchema,
   harnessToolPolicySchema,
   inspectHarnessModelCapabilities,
-  inspectHarnessRun,
+  inspectHarnessPolicy,
+  inspectHarnessTaskAcceptance,
   isHarnessContextDigest,
-  listHarnessRuns,
-  loadHarnessMcpConfiguration,
   loadHarnessProjectContext,
   loadHarnessSkill,
-  migrateLegacyFileRuns,
-  moveFileInputSchema,
-  mutationAuditEntrySchema,
-  mutationOperationSchema,
-  normalizeHarnessMcpConfiguration,
-  openHarnessPersistence,
-  quarantineFileInputSchema,
   renderHarnessContextInstructions,
-  restoreFileInputSchema,
+  reviseHarnessTaskAcceptance,
   runHarness,
   runHarnessReviewGroup,
-  selectHarnessModel,
-  validateEditProposal,
-  workspaceFilePathSchema
-} from "../index-5wjwe91x.js";
+  selectHarnessModel
+} from "../index-hnaxfpb5.js";
+import {
+  HARNESS_OPERATIONS_SCHEMA_VERSION,
+  HARNESS_SQLITE_FILE,
+  TERMINAL_RUN_STATUSES,
+  cancelHarnessRun,
+  cleanupHarnessRuns,
+  inspectHarnessRun,
+  listHarnessRuns,
+  migrateLegacyFileRuns,
+  openHarnessPersistence,
+  openWorkspaceCheckpointStore
+} from "../index-h0mqx2ed.js";
+import"../index-8zzhggxv.js";
 import {
   HARNESS_SESSION_INDEX_FILE,
   HARNESS_SESSION_SCHEMA_VERSION,
   SESSION_RUN_STATUSES,
+  TASK_ACCEPTANCE_EVIDENCE_KEY,
   TERMINAL_SESSION_RUN_STATUSES,
+  USAGE_LEDGER_KEY,
+  compileTaskAcceptanceContract,
+  inspectRuntimeManifest,
+  inspectUsageLedger,
   openCliSessionStore,
   openSessionStore,
+  readTaskAcceptanceLedger,
+  taskAcceptanceContractSchema,
   validateStateDirectory
-} from "../index-pgqz45fj.js";
+} from "../index-42gp2hy8.js";
+import {
+  BUN_ENGINE_RANGE,
+  HARNESS_MCP_CONFIG_SCHEMA_VERSION,
+  HARNESS_MCP_PERMISSIONS,
+  HARNESS_VERSION,
+  NODE_ENGINE_RANGE,
+  createHarnessMcpTools,
+  createHttpMcpClient,
+  loadHarnessMcpConfiguration,
+  normalizeHarnessMcpConfiguration
+} from "../index-azmwjp95.js";
+import {
+  CliOciRuntimeAdapter,
+  HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
+  HARNESS_OCI_LABEL,
+  HARNESS_OCI_LABEL_VALUE,
+  Workspace,
+  cleanupHarnessExecutionArtifacts,
+  createHarnessOciExecutionEnvironment,
+  describeOciCommand,
+  executionFingerprintInput,
+  harnessExecutionSession
+} from "../index-z0qxmkm2.js";
+import {
+  EDIT_CONTRACT_SCHEMA_VERSION,
+  EDIT_DIGEST_ALGORITHM,
+  MAX_EDIT_CHANGES,
+  MAX_EDIT_FILE_BYTES,
+  MAX_EDIT_PROPOSAL_BYTES,
+  applyEditProposalInputSchema,
+  createEditProposal,
+  editChangeSchema,
+  editChangesSchema,
+  editContractDocument,
+  editProposalChangeSchema,
+  editProposalInputSchema,
+  editProposalSchema,
+  fileDigestSchema,
+  moveFileInputSchema,
+  mutationAuditEntrySchema,
+  mutationOperationSchema,
+  quarantineFileInputSchema,
+  restoreFileInputSchema,
+  taskCheckReceiptSchema,
+  validateEditProposal,
+  workspaceFilePathSchema
+} from "../index-yb239ghk.js";
 import {
   BUILTIN_PROVIDER_REGISTRATIONS,
   DEFAULT_ALLOWED_CHECKS,
@@ -227,7 +256,9 @@ import {
   providerAvailability,
   providerDescriptor,
   resolveHarnessConfig
-} from "../index-fvca1xea.js";
+} from "../index-gq9xagx2.js";
+import"../index-8705zxpr.js";
+import"../index-xqxeypt5.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION,
@@ -238,12 +269,473 @@ import {
   serializeStreamResult,
   streamEventDocument,
   streamResultDocument
-} from "../index-2aymdsqc.js";
-import {
-  createAcpConnection,
-  serveAcpStdio
-} from "../index-77h9qr5h.js";
+} from "../index-qfpz5y2v.js";
 import"../index-1bx83sw4.js";
+// src/persistence/governance-report.ts
+import { createHash as createHash2 } from "node:crypto";
+import { z as z2 } from "zod";
+
+// src/persistence/governance-context.ts
+import { createHash } from "node:crypto";
+import { z } from "zod";
+var digest = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+var count = z.number().int().nonnegative().safe();
+var governanceReference = (kind, value) => "sha256:" + createHash("sha256").update(JSON.stringify([kind, value])).digest("hex");
+var governanceSessionSchema = z.strictObject({ availability: z.enum(["recorded", "unavailable"]), reference: digest.nullable(), revision: count.nullable() });
+var governanceHistorySchema = z.strictObject({
+  availability: z.enum(["recorded", "unavailable"]),
+  retention: z.enum(["unknown", "retained", "expired"]),
+  incomplete: z.boolean(),
+  policyDecisions: z.array(z.strictObject({
+    runReference: digest,
+    sequence: count,
+    toolReference: digest,
+    phase: z.enum(["approval-request", "tool-entry"]),
+    decision: z.enum(["allow", "ask_user", "deny"]),
+    policyDigest: digest.nullable(),
+    source: z.enum(["operator-file", "application", "baseline"]),
+    ruleReferences: z.array(digest).max(128),
+    explicitReviewRequired: z.boolean()
+  })).max(512)
+});
+var governanceEnvelopeSchema = z.strictObject({
+  source: z.literal("caller-supplied"),
+  envelopeId: digest.nullable(),
+  patchReference: digest.nullable(),
+  patchDigest: digest.nullable(),
+  linkedRunReferences: z.array(digest).max(64),
+  schemaValid: z.boolean(),
+  integrity: z.enum(["valid", "invalid"]),
+  expiration: z.enum(["unknown", "current", "expired", "not-yet-valid"]),
+  checkedAt: z.iso.datetime(),
+  expiredApprovals: count,
+  authenticity: z.literal("not-verified"),
+  patchBytes: z.literal("not-verified")
+});
+async function readGovernanceSession(source, rootRunId, runIds) {
+  const session = { availability: "unavailable", reference: null, revision: null };
+  const history = { availability: "unavailable", retention: "unknown", incomplete: true, policyDecisions: [] };
+  if (!source)
+    return { session, history, verify: async () => {} };
+  const initial = await source.index.get(source.id);
+  if (!initial || initial.sessionId !== source.id || !initial.runs.some((run) => run.runId === rootRunId))
+    throw new Error("GOVERNANCE_SESSION_MISMATCH");
+  const captured = JSON.stringify(initial);
+  session.availability = "recorded";
+  session.reference = governanceReference("session", initial.sessionId);
+  session.revision = initial.revision;
+  const pages = [];
+  if (source.history) {
+    let cursor = 0;
+    history.availability = "recorded";
+    history.retention = "retained";
+    history.incomplete = false;
+    for (let pageIndex = 0;pageIndex < 50; pageIndex++) {
+      const page = source.history.replay(source.id, cursor);
+      pages.push({ cursor, digest: governanceReference("history-page", JSON.stringify(page)) });
+      if (page.schemaVersion !== 1 || !Number.isSafeInteger(page.nextCursor) || page.nextCursor < cursor || page.events.length > 200)
+        throw new Error("GOVERNANCE_HISTORY_INVALID");
+      if (page.cursorExpired || page.policyEvidenceIncomplete) {
+        history.retention = "expired";
+        history.incomplete = true;
+      }
+      let lastSequence = cursor;
+      for (const event of page.events) {
+        if (event.sessionId !== source.id || !Number.isSafeInteger(event.sequence) || event.sequence <= lastSequence || event.sequence > page.nextCursor)
+          throw new Error("GOVERNANCE_HISTORY_INVALID");
+        lastSequence = event.sequence;
+        if (!runIds.has(event.runId) || event.activity.type !== "policy-decision")
+          continue;
+        const parsed = harnessPolicyDecisionEventSchema.safeParse(event.activity);
+        if (!parsed.success) {
+          history.incomplete = true;
+          continue;
+        }
+        if (history.policyDecisions.length === 512) {
+          history.incomplete = true;
+          continue;
+        }
+        const value = parsed.data;
+        history.policyDecisions.push({
+          runReference: governanceReference("run", event.runId),
+          sequence: event.sequence,
+          toolReference: governanceReference("tool", value.toolName),
+          phase: value.phase,
+          decision: value.decision,
+          policyDigest: value.policyDigest,
+          source: value.source,
+          ruleReferences: value.ruleIds.map((rule) => governanceReference("rule", rule)),
+          explicitReviewRequired: value.explicitReviewRequired
+        });
+      }
+      if (page.cursorExpired || !page.hasMore)
+        break;
+      if (page.nextCursor === cursor)
+        throw new Error("GOVERNANCE_HISTORY_INVALID");
+      cursor = page.nextCursor;
+      if (pageIndex === 49)
+        history.incomplete = true;
+    }
+  }
+  return { session, history, verify: async () => {
+    for (const page of pages)
+      if (governanceReference("history-page", JSON.stringify(source.history.replay(source.id, page.cursor))) !== page.digest)
+        throw new Error("GOVERNANCE_STATE_CHANGED");
+    if (JSON.stringify(await source.index.get(source.id)) !== captured)
+      throw new Error("GOVERNANCE_STATE_CHANGED");
+  } };
+}
+function projectGovernanceEnvelopes(envelopes, patches, now) {
+  if (envelopes.length > 32)
+    throw new Error("GOVERNANCE_ENVELOPE_LIMIT");
+  return envelopes.map((input) => {
+    if (Buffer.byteLength(JSON.stringify(input) ?? "") > 256 * 1024)
+      throw new Error("GOVERNANCE_ENVELOPE_LIMIT");
+    const parsed = changeEnvelopeSchema.safeParse(input);
+    const proof = verifyChangeEnvelope(input, { now });
+    const envelope = parsed.success ? parsed.data : undefined;
+    return governanceEnvelopeSchema.parse({
+      source: "caller-supplied",
+      envelopeId: envelope?.envelopeId ?? null,
+      patchReference: envelope ? governanceReference("patch", envelope.patch.patchId) : null,
+      patchDigest: envelope?.patch.patchDigest ?? null,
+      linkedRunReferences: envelope ? [...patches.get(envelope.patch.patchId) ?? []] : [],
+      schemaValid: parsed.success,
+      integrity: proof.integrity.envelopeDigestValid && proof.integrity.evidenceDigestValid ? "valid" : "invalid",
+      expiration: !envelope ? "unknown" : proof.expiration.envelopeNotYetValid ? "not-yet-valid" : proof.expiration.envelopeExpired ? "expired" : "current",
+      checkedAt: proof.expiration.checkedAt,
+      expiredApprovals: proof.expiration.expiredApprovalIds.length,
+      authenticity: "not-verified",
+      patchBytes: "not-verified"
+    });
+  });
+}
+
+// src/persistence/governance-report.ts
+var digest2 = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
+var version = z2.string().regex(/^\d+\.\d+\.\d+(?:[-+][a-zA-Z0-9.-]+)?$/);
+var bindingSchema = z2.object({ schemaVersion: z2.literal(1), id: z2.literal("zhivex-harness"), version, fingerprint: digest2, algorithm: z2.literal("sha256") });
+var count2 = z2.number().int().nonnegative().safe();
+var status = z2.enum(["created", "running", "waiting_approval", "cancel_requested", "completed", "failed", "cancelled", "timed_out", "unknown"]);
+var availability = z2.enum(["recorded", "unavailable", "invalid"]);
+var providerReason = z2.enum(["empty_arguments", "invalid_json", "arguments_too_large", "incomplete_arguments", "inconsistent_metadata", "response_failed", "response_incomplete", "stream_truncated"]);
+var deliveryReason = z2.enum(["TASK_ACCEPTANCE_NO_DELIVERY_EVIDENCE", "TASK_ACCEPTANCE_SCOPE_VIOLATION", "TASK_ACCEPTANCE_RUN_NOT_COMPLETED", "TASK_ACCEPTANCE_RUN_NOT_FINISHED", "TASK_ACCEPTANCE_IMPORT_UNCONFIRMED", "TASK_ACCEPTANCE_CHECKS_MISSING", "TASK_ACCEPTANCE_DELIVERY_DRIFT", "TASK_ACCEPTANCE_DELIVERY_INSPECTION_FAILED", "TASK_ACCEPTANCE_HUMAN_REVIEW_REQUIRED", "TASK_ACCEPTANCE_VERIFIED"]);
+var deliveryStatus = z2.enum(["pending", "incomplete", "failed", "pending_review", "verified", "unknown"]);
+var checkSchema = z2.strictObject({
+  reference: digest2,
+  argvDigest: digest2,
+  patchId: digest2,
+  snapshotDigest: digest2,
+  exitCode: z2.number().int(),
+  timedOut: z2.boolean(),
+  unchanged: z2.boolean()
+});
+var deliverySchema = z2.object({
+  schemaVersion: z2.literal(1),
+  contractRevision: count2,
+  contractDigest: digest2,
+  status: deliveryStatus,
+  checks: z2.array(taskCheckReceiptSchema).max(32),
+  delivery: z2.object({ runId: z2.string().max(512), executionIdentity: z2.string().max(512), patchId: digest2, snapshotDigest: digest2 }).optional()
+});
+var approvalSchema = z2.strictObject({
+  reference: digest2,
+  toolReference: digest2,
+  approved: z2.boolean(),
+  origin: z2.enum(["interactive", "automatic", "application", "unknown"]),
+  channelReference: digest2,
+  policyDigest: digest2.nullable(),
+  status: z2.enum(["rejected", "approved", "applied", "succeeded", "failed", "unknown"]),
+  proposalId: digest2.nullable(),
+  exitCode: z2.number().int().nullable(),
+  timedOut: z2.boolean().nullable(),
+  effects: z2.array(z2.strictObject({ pathReference: digest2, beforeDigest: digest2.nullable(), afterDigest: digest2.nullable() })).max(50)
+});
+var delegationReason = z2.enum(["valid", "invalid_json", "invalid_schema", "task_mismatch", "incomplete", "duplicate_claim", "path_denied", "evidence_missing", "coverage_missing", "missing_child", "child_identity_unavailable"]);
+var delegationSchema = z2.strictObject({
+  taskReference: digest2,
+  childReference: digest2.nullable(),
+  recordedAcceptance: z2.boolean(),
+  reason: delegationReason,
+  semanticReview: z2.enum(["pending", "not_requested"]),
+  correctionsUsed: count2.nullable()
+});
+var delegationInput = z2.object({ schemaVersion: z2.literal(1), evaluations: z2.array(z2.object({
+  taskId: z2.string().max(128),
+  childRunId: z2.string().max(512).nullable(),
+  childStatus: z2.string().max(32),
+  accepted: z2.boolean(),
+  reason: delegationReason,
+  semanticReview: z2.enum(["pending", "not_requested"]),
+  correctionsUsed: count2.optional()
+})).max(64) });
+var runSchema = z2.strictObject({
+  reference: digest2,
+  parentReference: digest2.nullable(),
+  revision: count2.nullable(),
+  status,
+  finalized: z2.boolean(),
+  failure: z2.enum(["run_failed", "cancelled", "timed_out", "not_reported"]).nullable(),
+  failureDetails: z2.strictObject({ providerToolReason: providerReason.nullable(), diagnosticReference: digest2.nullable(), deliveryReason: deliveryReason.nullable() }),
+  identity: z2.literal("not-verified"),
+  runtimePolicy: z2.enum(["assistant-v3-durable-closure"]).nullable(),
+  contract: z2.strictObject({
+    availability,
+    digest: digest2.nullable(),
+    revision: count2.nullable(),
+    requiredChecks: count2.nullable(),
+    humanReviewsPending: count2.nullable(),
+    allowedWritePathReferences: z2.array(digest2).max(256),
+    protectedPathReferences: z2.array(digest2).max(256),
+    checks: z2.array(z2.strictObject({ reference: digest2, argvDigest: digest2, kind: z2.enum(["argv", "package-script"]), backend: z2.enum(["none", "oci"]), approval: z2.literal("required") })).max(32),
+    humanReviewReferences: z2.array(digest2).max(32)
+  }),
+  delivery: z2.strictObject({
+    availability,
+    status: deliveryStatus,
+    patchId: digest2.nullable(),
+    snapshotDigest: digest2.nullable(),
+    interpretation: z2.literal("recorded-checkpoint-not-current-workspace-verification"),
+    checks: z2.array(checkSchema).max(32)
+  }),
+  approvals: z2.strictObject({ availability, items: z2.array(approvalSchema).max(512) }),
+  usage: z2.strictObject({
+    availability: z2.enum(["recorded", "unavailable"]),
+    calls: count2.nullable(),
+    inputTokens: count2.nullable(),
+    outputTokens: count2.nullable(),
+    complete: z2.boolean().nullable(),
+    estimatedUsd: z2.number().finite().nonnegative().nullable(),
+    costKind: z2.literal("estimate-not-invoice")
+  }),
+  journal: z2.strictObject({ availability: z2.enum(["recorded", "unavailable"]), entries: count2, failed: count2, unfinished: count2 }),
+  delegations: z2.strictObject({ availability, interpretation: z2.literal("recorded-checkpoint-not-semantic-review"), items: z2.array(delegationSchema).max(64) }),
+  children: z2.array(digest2).max(64)
+});
+var harnessGovernanceReportSchema = z2.strictObject({
+  schemaVersion: z2.literal(1),
+  kind: z2.literal("harness-governance-report"),
+  exporterVersion: z2.string().regex(/^\d+\.\d+\.\d+(?:[-+][a-zA-Z0-9.-]+)?$/),
+  executionArtifact: z2.strictObject({ version: version.nullable(), digest: z2.null(), availability: z2.enum(["recorded-version", "unavailable"]), configurationFingerprint: digest2.nullable(), authenticity: z2.literal("not-verified") }),
+  rootReference: digest2,
+  identity: z2.literal("not-verified"),
+  referencePolicy: z2.literal("sha256-domain-separated-pseudonyms-not-anonymity"),
+  session: governanceSessionSchema,
+  eventHistory: governanceHistorySchema,
+  changeEnvelopes: z2.array(governanceEnvelopeSchema).max(32),
+  runs: z2.array(runSchema).max(64),
+  missingChildren: z2.array(digest2).max(64),
+  limitations: z2.array(z2.enum(["tree_limit", "missing_child", "invalid_contract", "invalid_delivery", "invalid_approvals", "journal_unavailable"])).max(6)
+});
+var MAX_JOURNAL = 2048;
+var MAX_REPORT_BYTES = 2 * 1024 * 1024;
+var sameScope = (state, scope) => !state.scope || state.scope.tenantId === scope?.tenantId && state.scope.userId === scope?.userId && state.scope.namespace === scope?.namespace;
+function projectRun(state, journal, limitations) {
+  const runStatus = status.safeParse(state.status);
+  const stateStatus = runStatus.success ? runStatus.data : "unknown";
+  let ledger;
+  let contractAvailability = "unavailable";
+  try {
+    ledger = readTaskAcceptanceLedger(state);
+    if (ledger)
+      contractAvailability = "recorded";
+  } catch {
+    contractAvailability = "invalid";
+    limitations.add("invalid_contract");
+  }
+  const contract = ledger?.revisions.at(-1);
+  const rawDelivery = state.metadata?.[TASK_ACCEPTANCE_EVIDENCE_KEY];
+  const parsedDelivery = deliverySchema.safeParse(rawDelivery);
+  const bound = parsedDelivery.success && contract && parsedDelivery.data.contractDigest === contract.digest && parsedDelivery.data.contractRevision === contract.revision && (!parsedDelivery.data.delivery || parsedDelivery.data.delivery.runId === state.runId);
+  const candidate = bound ? parsedDelivery.data : undefined;
+  const verified = candidate?.status === "verified" || candidate?.status === "pending_review";
+  const validSuccess = !verified || stateStatus === "completed" && candidate.delivery && contract && contract.contract.requiredChecks.every((required) => candidate.checks.some((check) => check.checkId === required.id && check.runId === state.runId && check.argvDigest === "sha256:" + createHash2("sha256").update(JSON.stringify([required.command, ...required.args])).digest("hex") && check.contractDigest === contract.digest && check.contractRevision === contract.revision && check.exitCode === 0 && !check.timedOut && check.unchanged && check.patchId === candidate.delivery.patchId && check.snapshotDigest === candidate.delivery.snapshotDigest && check.executionIdentity === candidate.delivery.executionIdentity)) && candidate.status === "pending_review" === contract.contract.humanReview.length > 0;
+  const delivery = validSuccess ? candidate : undefined;
+  if (rawDelivery !== undefined && !delivery)
+    limitations.add("invalid_delivery");
+  const approvals = { availability: state.metadata?.[APPROVAL_HISTORY_KEY] === undefined ? "unavailable" : "recorded", items: [] };
+  try {
+    for (let offset = 0;offset < 512; offset += 25) {
+      const rows = approvalDecisionViews(state, journal ?? [], offset);
+      for (const row of rows)
+        approvals.items.push({
+          reference: governanceReference("approval", row.approvalId),
+          toolReference: governanceReference("tool", row.name),
+          approved: row.approved,
+          origin: row.provenance?.origin ?? "unknown",
+          channelReference: governanceReference("channel", row.provenance?.channel ?? "unknown"),
+          policyDigest: row.provenance?.policyDigest ?? null,
+          status: row.status,
+          proposalId: row.evidence?.proposalId ?? null,
+          exitCode: row.evidence?.exitCode ?? null,
+          timedOut: row.evidence?.timedOut ?? null,
+          effects: (row.evidence?.effects ?? []).map((effect) => ({ pathReference: governanceReference("path", effect.path), beforeDigest: effect.beforeDigest, afterDigest: effect.afterDigest }))
+        });
+      if (rows.length < 25)
+        break;
+    }
+  } catch {
+    approvals.availability = "invalid";
+    approvals.items = [];
+    limitations.add("invalid_approvals");
+  }
+  const parsedUsage = inspectUsageLedger(state.metadata?.[USAGE_LEDGER_KEY]);
+  const usage = parsedUsage?.runId === state.runId ? parsedUsage : null;
+  const rawDelegations = state.metadata?.zhivexDelegationAcceptanceV1;
+  const delegations = delegationInput.safeParse(rawDelegations);
+  const manifest = inspectRuntimeManifest(state.metadata?.effectiveRuntime);
+  return {
+    reference: governanceReference("run", state.runId),
+    parentReference: state.parentRunId ? governanceReference("run", state.parentRunId) : null,
+    revision: count2.safeParse(state.revision).success ? state.revision : null,
+    status: stateStatus,
+    finalized: ["completed", "failed", "cancelled", "timed_out"].includes(stateStatus),
+    failure: stateStatus === "failed" ? "run_failed" : stateStatus === "cancelled" ? "cancelled" : stateStatus === "timed_out" ? "timed_out" : state.error ? "not_reported" : null,
+    failureDetails: {
+      providerToolReason: providerReason.safeParse(state.error?.reason).success ? state.error.reason : null,
+      diagnosticReference: state.error?.diagnosticCode ? governanceReference("diagnostic", state.error.diagnosticCode) : null,
+      deliveryReason: deliveryReason.safeParse(rawDelivery && typeof rawDelivery === "object" && !Array.isArray(rawDelivery) ? rawDelivery.reason : undefined).success ? rawDelivery.reason : null
+    },
+    identity: "not-verified",
+    runtimePolicy: manifest?.policyVersion ?? null,
+    contract: {
+      availability: contractAvailability,
+      digest: contract?.digest ?? null,
+      revision: contract?.revision ?? null,
+      requiredChecks: contract?.contract.requiredChecks.length ?? null,
+      humanReviewsPending: contract?.contract.humanReview.length ?? null,
+      allowedWritePathReferences: contract?.contract.allowedWritePaths.map((file) => governanceReference("path", file)) ?? [],
+      protectedPathReferences: contract?.contract.protectedFiles.map((file) => governanceReference("path", file)) ?? [],
+      checks: contract?.contract.requiredChecks.map((check) => ({ reference: governanceReference("check", check.id), argvDigest: "sha256:" + createHash2("sha256").update(JSON.stringify([check.command, ...check.args])).digest("hex"), kind: check.kind, backend: check.execution.backend, approval: check.execution.approval })) ?? [],
+      humanReviewReferences: contract?.contract.humanReview.map((review) => governanceReference("review", review.id)) ?? []
+    },
+    delivery: {
+      availability: delivery ? "recorded" : rawDelivery === undefined ? "unavailable" : "invalid",
+      status: delivery?.status ?? "unknown",
+      patchId: delivery?.delivery?.patchId ?? null,
+      snapshotDigest: delivery?.delivery?.snapshotDigest ?? null,
+      interpretation: "recorded-checkpoint-not-current-workspace-verification",
+      checks: (delivery?.checks ?? []).filter((check) => check.runId === state.runId && check.contractDigest === contract?.digest && check.contractRevision === contract?.revision).map((check) => ({ reference: governanceReference("check", check.checkId), argvDigest: check.argvDigest, patchId: check.patchId, snapshotDigest: check.snapshotDigest, exitCode: check.exitCode, timedOut: check.timedOut, unchanged: check.unchanged }))
+    },
+    approvals,
+    usage: {
+      availability: usage ? "recorded" : "unavailable",
+      calls: usage?.calls ?? null,
+      inputTokens: usage?.inputTokens ?? null,
+      outputTokens: usage?.outputTokens ?? null,
+      complete: usage?.usageComplete ?? null,
+      estimatedUsd: usage?.estimatedUsd ?? null,
+      costKind: "estimate-not-invoice"
+    },
+    journal: {
+      availability: journal ? "recorded" : "unavailable",
+      entries: journal?.length ?? 0,
+      failed: journal?.filter((entry) => entry.status === "failed").length ?? 0,
+      unfinished: journal?.filter((entry) => entry.status !== "completed" && entry.status !== "failed").length ?? 0
+    },
+    delegations: {
+      availability: rawDelegations === undefined ? "unavailable" : delegations.success ? "recorded" : "invalid",
+      interpretation: "recorded-checkpoint-not-semantic-review",
+      items: delegations.success ? delegations.data.evaluations.map((item) => ({
+        taskReference: governanceReference("task", item.taskId),
+        childReference: item.childRunId ? governanceReference("run", item.childRunId) : null,
+        recordedAcceptance: item.accepted,
+        reason: item.reason,
+        semanticReview: item.semanticReview,
+        correctionsUsed: item.correctionsUsed ?? null
+      })) : []
+    },
+    children: (state.childRuns ?? []).slice(0, 64).map((child) => governanceReference("run", child.runId))
+  };
+}
+async function exportHarnessGovernanceReport(store, scope, runId, options = {}) {
+  const limitations = new Set;
+  const runs = [], missingChildren = [];
+  const observed = [];
+  const queue = [{ id: runId }], seen = new Set;
+  while (queue.length && runs.length + missingChildren.length < 64) {
+    const item = queue.shift();
+    if (seen.has(item.id))
+      continue;
+    seen.add(item.id);
+    const loaded = await store.load(item.id, scope);
+    const state = loaded ? structuredClone(loaded) : undefined;
+    if (!state || state.runId !== item.id || !sameScope(state, scope) || item.parent !== undefined && state.parentRunId !== item.parent) {
+      if (item.parent === undefined)
+        throw new Error("GOVERNANCE_RUN_UNAVAILABLE");
+      missingChildren.push(governanceReference("run", item.id));
+      limitations.add("missing_child");
+      continue;
+    }
+    const loadedJournal = await store.listToolCalls?.(state.runId, scope);
+    const journal = loadedJournal ? structuredClone(loadedJournal) : undefined;
+    if (journal && journal.length > MAX_JOURNAL)
+      throw new Error("GOVERNANCE_JOURNAL_LIMIT");
+    if (journal?.some((entry) => entry.runId !== state.runId))
+      throw new Error("GOVERNANCE_JOURNAL_SCOPE");
+    if (!journal)
+      limitations.add("journal_unavailable");
+    observed.push({ state, journal });
+    runs.push(projectRun(state, journal, limitations));
+    if ((state.childRuns?.length ?? 0) > 64)
+      limitations.add("tree_limit");
+    for (const child of (state.childRuns ?? []).slice(0, 64))
+      queue.push({ id: child.runId, parent: state.runId });
+  }
+  if (queue.length)
+    limitations.add("tree_limit");
+  const context = await readGovernanceSession(options.session, runId, new Set(observed.map((item) => item.state.runId)));
+  for (const { state, journal } of observed) {
+    const current = await store.load(state.runId, scope);
+    const currentJournal = await store.listToolCalls?.(state.runId, scope);
+    if (!current || JSON.stringify(current) !== JSON.stringify(state) || JSON.stringify(currentJournal) !== JSON.stringify(journal))
+      throw new Error("GOVERNANCE_STATE_CHANGED");
+  }
+  await context.verify();
+  const patches = new Map;
+  for (const run of runs)
+    for (const patch of new Set([run.delivery.patchId, ...run.approvals.items.map((row) => row.proposalId)].filter((id) => id !== null)))
+      patches.set(patch, [...patches.get(patch) ?? [], run.reference]);
+  const binding = bindingSchema.safeParse(observed[0]?.state.harness);
+  const report = harnessGovernanceReportSchema.parse({
+    schemaVersion: 1,
+    kind: "harness-governance-report",
+    exporterVersion: HARNESS_VERSION,
+    executionArtifact: { version: binding.success ? binding.data.version : null, digest: null, availability: binding.success ? "recorded-version" : "unavailable", configurationFingerprint: binding.success ? binding.data.fingerprint : null, authenticity: "not-verified" },
+    rootReference: governanceReference("run", runId),
+    identity: "not-verified",
+    referencePolicy: "sha256-domain-separated-pseudonyms-not-anonymity",
+    session: context.session,
+    eventHistory: context.history,
+    changeEnvelopes: projectGovernanceEnvelopes(options.changeEnvelopes ?? [], patches, options.now ?? Date.now()),
+    runs,
+    missingChildren,
+    limitations: [...limitations].sort()
+  });
+  if (Buffer.byteLength(JSON.stringify(report)) > MAX_REPORT_BYTES)
+    throw new Error("GOVERNANCE_REPORT_LIMIT");
+  return report;
+}
+function renderHarnessGovernanceMarkdown(input) {
+  const report = harnessGovernanceReportSchema.parse(input);
+  return [
+    "# Execution and governance report",
+    "",
+    `Schema: ${report.schemaVersion}. Exporter: ${report.exporterVersion}.`,
+    `Identity: not verified. Recorded execution version: ${report.executionArtifact.version ?? "unavailable"}. Artifact digest: unavailable. Hash references are pseudonyms, not signatures.`,
+    "Delivery describes a recorded checkpoint; export does not recheck the workspace.",
+    "",
+    "| Run reference | Execution | Recorded delivery | Usage |",
+    "| --- | --- | --- | --- |",
+    ...report.runs.map((run) => `| ${run.reference} | ${run.status} | ${run.delivery.status} | ${run.usage.availability === "unavailable" ? "unavailable" : `${run.usage.inputTokens} input / ${run.usage.outputTokens} output (${run.usage.complete ? "complete" : "incomplete"})`} |`),
+    "",
+    `Missing children: ${report.missingChildren.length}. Limitations: ${report.limitations.join(", ") || "none detected"}.`,
+    `Session: ${report.session.availability}. Event history: ${report.eventHistory.availability}. Retention: ${report.eventHistory.retention}. Incomplete: ${report.eventHistory.incomplete}.`,
+    `Change envelopes: ${report.changeEnvelopes.length}. Envelope integrity does not verify patch bytes or authenticity. Estimates are not invoices.`,
+    ""
+  ].join(`
+`);
+}
 export {
   BUILTIN_PROVIDER_REGISTRATIONS,
   BUN_ENGINE_RANGE,
@@ -368,6 +860,7 @@ export {
   cliStreamErrorDocumentSchema,
   cliStreamResultDocumentSchema,
   compactHarnessMessages,
+  compileTaskAcceptanceContract,
   computeChangeEnvelopeDigest,
   computeChangeEnvelopeEvidenceDigest,
   createAcpConnection,
@@ -403,6 +896,7 @@ export {
   editProposalSchema,
   estimateMessageTokens,
   executionFingerprintInput,
+  exportHarnessGovernanceReport,
   exportHarnessStateBackup,
   externalAttestationReferenceSchema,
   fileDigestSchema,
@@ -412,6 +906,7 @@ export {
   harnessContextFingerprintInput,
   harnessErrorDocument,
   harnessExecutionSession,
+  harnessGovernanceReportSchema,
   harnessLifecycleFingerprintInput,
   harnessLocalCredentialsSchema,
   harnessSkillLoadInputSchema,
@@ -420,8 +915,10 @@ export {
   importHarnessStateBackupFile,
   injectTimeToSafeFixAttack,
   inspectHarnessModelCapabilities,
+  inspectHarnessPolicy,
   inspectHarnessRun,
   inspectHarnessState,
+  inspectHarnessTaskAcceptance,
   isHarnessContextDigest,
   listHarnessRuns,
   loadHarnessMcpConfiguration,
@@ -451,10 +948,12 @@ export {
   recommendCompactionModels,
   recoverHarnessLocalService,
   renderHarnessContextInstructions,
+  renderHarnessGovernanceMarkdown,
   requestHarnessLocalService,
   resolveHarnessConfig,
   resolveHarnessModelRoutes,
   restoreFileInputSchema,
+  reviseHarnessTaskAcceptance,
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel,
@@ -466,6 +965,7 @@ export {
   stateBackupBundleSchema,
   streamEventDocument,
   streamResultDocument,
+  taskAcceptanceContractSchema,
   timeToSafeFixDriverResultSchema,
   timeToSafeFixLatencyStatistics,
   timeToSafeFixTaskSchema,