@zhivex-ai/harness 1.3.0-rc.7 → 1.3.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.3.0 - 2026-10-02
+
+- Prepare Harness 1.3.0 and the independent Code CLI 0.1.0 for protected publication to npm `latest`; Code pins exactly Harness 1.3.0 and must publish after its verified engine dependency.
+- Preserve the RC7 runtime and Code RC2 provider/terminal fixes; no new product features or changes to historical Harness binaries, state contracts or stable API signatures.
+- Validate Code stable/latest and RC/next channels, canonical versions, exact engine pins, channel ordering and immutable artifact recovery. Preserve annotated-tag, exact main CI/CodeQL, installed acceptance, integrity and provenance gates.
+- Keep beta and experimental API tiers, provisional Anthropic/Gemini/Vertex support and private Desktop alpha unchanged. RC7's six-provider live gates and Meta/Qwen/OpenAI 42-case representative evidence remain bound to RC7; stable artifacts require new protected evidence.
+- Refresh the recorded verified latest publication to Harness 1.2.0 without fabricating an uncreated GitHub Release, and align active release/installation documentation without claiming that the prepared stable versions are already published.
+
 ## 1.3.0-rc.7 - 2026-10-01
 
 - Pin Qwen contract certification to zero sampling temperature in approval and conversation continuity smokes, preserving all approval, compaction, effect and context assertions. Application model defaults remain unchanged.

package/README.md

@@ -11,19 +11,21 @@ implement a change. Conversation context retains decisions, hypotheses and bound
 diagnostic excerpts across compaction. Edits and command execution keep their
 own permission checks; a conversational summary never grants approval.
 
-Version `1.3.0-rc.7` prepares the terminal-independent engine API and the local
-Code package for candidate validation on npm `next`. Publication remains pending
-the protected release workflow. RC4 includes Anthropic, Gemini/Vertex, Desktop package migration, isolated MCP/ACP,
-checkpoints and experimental governance controls. Code publication is independent.
-Stable `1.2.0` remains available under npm `latest`.
-Desktop retains its separate private alpha status.
+Version `1.3.0` is prepared for npm `latest`, with terminal-independent engine
+entrypoints and the separately released Code CLI `0.1.0`. Publication remains
+pending the protected workflow. Harness `1.2.0` is currently published on `latest`;
+Harness RC7 and Code RC2 are published on `next`. Stable package numbering does
+not change API stability tiers: beta and experimental APIs retain their policies,
+Gemini/Anthropic/Vertex remain provisional, and Desktop remains a private alpha.
 
 ## Quick start
 
 Requires Node.js 22.13.0 or newer, Git and a provider API key.
 
+After protected publication of 1.3.0:
+
 ```sh
-npm install -g @zhivex-ai/harness@1.3.0-rc.7
+npm install -g @zhivex-ai/harness@1.3.0
 cd /path/to/your/project
 zhx
 ```
@@ -81,5 +83,5 @@ Gemini, [Anthropic](docs/ANTHROPIC.md) and [Vertex](docs/VERTEX.md) remain provi
 Version `1.2.0` is the current stable public npm release. Source checkout changes can be
 newer than the published package. Consult the [changelog](CHANGELOG.md) and
 [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-for the recorded 1.0.0 release; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
+for the verified 1.2.0 publication; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
 records validation scope and limitations.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `1.1.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Security fixes are provided for the latest published stable Harness minor (currently `1.2.x`; `1.3.x` after verified publication) and the latest stable Code `0.1.x` patch after its publication. RCs on `next` are validation candidates; older minors and private checkpoints are not supported release channels. Desktop remains a separate private alpha. Beta and experimental features retain their documented limitations. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `1.1.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record preserves the verified 1.0.0 release; check npm for the current published version.
+Zhivex Harness `1.2.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record records the verified 1.2.0 publication. Harness 1.3.0 and Code 0.1.0 are prepared for latest but remain pending their protected workflows.
 
 The 1.1 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix-1.1.json) and its [human-readable view](./docs/SUPPORT_MATRIX_1_1.md). The [1.0 matrix](./docs/SUPPORT_MATRIX.md) remains historical. Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
 
@@ -13,11 +13,11 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `1.1.x` patch receives routine fixes. The exact `v1.1.1` tag passed the protected artifact, live-provider and representative release jobs. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.2.0` tag passed the protected artifact, live-provider and representative release jobs. After verified publication, 1.3.x and Code 0.1.x become the supported stable lines. Gemini, Anthropic and Vertex remain provisional despite RC7 live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 
-Follow the [stable installation commands](./README.md#installation) or [isolated Bun example](./examples/README.md). Run `zhx --version`, `zhx --help`, and `zhx doctor` before reporting an installation issue. Doctor is local: a missing provider credential produces a diagnostic failure until that credential is configured. Include the version, OS, Node/Bun versions and sanitized diagnostics in a report; never include keys or your `.env` file.
+Follow the [stable installation commands](./README.md#quick-start) or [isolated Bun example](./examples/README.md). Run `zhx --version`, `zhx --help`, and `zhx doctor` before reporting an installation issue. Doctor is local: a missing provider credential produces a diagnostic failure until that credential is configured. Include the version, OS, Node/Bun versions and sanitized diagnostics in a report; never include keys or your `.env` file.
 
 ## Support channels
 
@@ -25,4 +25,4 @@ Use [GitHub Issues](https://github.com/Zhivex/zhivex-harness/issues) for reprodu
 
 ## Explicit limits
 
-The harness does not promise arbitrary shell access, `stdio` MCP, permanent deletion, Windows support, a managed sandbox, a desktop UI, or exact feature parity between upstream providers. Tools run with the permissions of the local harness process unless an application supplies a stronger execution environment.
+The harness does not promise arbitrary shell access, general-purpose `stdio` MCP interoperability, permanent deletion, Windows support, a managed sandbox, a stable desktop UI, or exact feature parity between upstream providers. Tools run with the permissions of the local harness process unless an application supplies a stronger execution environment.

package/dist/acp-cli.js

@@ -12,13 +12,13 @@ import {
 import {
   createHarness,
   createHarnessClientAdapter
-} from "./index-jgrx804e.js";
+} from "./index-hnaxfpb5.js";
 import"./index-h0mqx2ed.js";
 import"./index-8zzhggxv.js";
 import {
   usagePricingSchema
 } from "./index-42gp2hy8.js";
-import"./index-t60rva31.js";
+import"./index-azmwjp95.js";
 import"./index-z0qxmkm2.js";
 import {
   FileChangedWhileReadingError,

package/dist/{cli-entry-ae7x44d4.js → cli-entry-1gfg3brj.js}

@@ -3,7 +3,7 @@ import {
   HARNESS_VERSION,
   resolveHelpTopic,
   validateCliCommandOptions
-} from "./cli-entry-ev76ezcd.js";
+} from "./cli-entry-bx3vjw7h.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,

package/dist/{cli-entry-ev76ezcd.js → cli-entry-bx3vjw7h.js}

@@ -402,7 +402,7 @@ Use zhx help all for the full reference and exit codes.`;
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.3.0-rc.7",
+  version: "1.3.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",

package/dist/{cli-t7hrhayq.js → cli-etsmtst3.js}

@@ -120,14 +120,14 @@ import {
   withTemporaryHarnessProfiles,
   workspaceCheckpointSchema,
   workspaceRestoreOperationSchema
-} from "./cli-entry-ae7x44d4.js";
+} from "./cli-entry-1gfg3brj.js";
 import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   formatCliHelp,
   shortCliHelp
-} from "./cli-entry-ev76ezcd.js";
+} from "./cli-entry-bx3vjw7h.js";
 import {
   DEFAULT_HARNESS_MAX_STEPS,
   DEFAULT_PROVIDER_REGISTRY,
@@ -4360,7 +4360,7 @@ var main = async (argv = process.argv.slice(2)) => {
     parsedOptions = { ...parsedOptions, prompt: await readStdinTask() };
   }
   if (parsedOptions.serviceFile) {
-    const { runServiceCli } = await import("./service-client-cli-kns4mf57.js");
+    const { runServiceCli } = await import("./service-client-cli-3365rfav.js");
     await runServiceCli(parsedOptions, annotateCliStreamError);
     return;
   }

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   HARNESS_VERSION,
   shortCliHelp
-} from "./cli-entry-ev76ezcd.js";
+} from "./cli-entry-bx3vjw7h.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -16,6 +16,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-t7hrhayq.js");
+  const { runCli } = await import("./cli-etsmtst3.js");
   await runCli(argv);
 }

package/dist/engine/acp.js

@@ -2,7 +2,7 @@ import {
   discardMcpWorkspaceSnapshot,
   launchDockerMcpGroup,
   prepareMcpWorkspaceSnapshot
-} from "../index-z4e8d0ph.js";
+} from "../index-6m08wvab.js";
 import {
   createAcpConnection,
   issueAcpMcpSessionProvider,
@@ -11,11 +11,11 @@ import {
 import {
   createHarness,
   createHarnessClientAdapter
-} from "../index-jgrx804e.js";
+} from "../index-hnaxfpb5.js";
 import"../index-h0mqx2ed.js";
 import"../index-8zzhggxv.js";
 import"../index-42gp2hy8.js";
-import"../index-t60rva31.js";
+import"../index-azmwjp95.js";
 import"../index-z0qxmkm2.js";
 import"../index-yb239ghk.js";
 import"../index-gq9xagx2.js";

package/dist/engine/client.js

@@ -2,11 +2,11 @@ import {
   createHarnessClientAdapter,
   runResultDocument,
   terminalContinuationMessages
-} from "../index-jgrx804e.js";
+} from "../index-hnaxfpb5.js";
 import"../index-h0mqx2ed.js";
 import"../index-8zzhggxv.js";
 import"../index-42gp2hy8.js";
-import"../index-t60rva31.js";
+import"../index-azmwjp95.js";
 import"../index-z0qxmkm2.js";
 import"../index-yb239ghk.js";
 import"../index-gq9xagx2.js";

package/dist/engine/index.js

@@ -91,7 +91,7 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-2gz7jv7g.js";
+} from "../index-w2sj0wkw.js";
 import {
   createAcpConnection,
   serveAcpStdio
@@ -144,7 +144,7 @@ import {
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel
-} from "../index-jgrx804e.js";
+} from "../index-hnaxfpb5.js";
 import {
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_SQLITE_FILE,
@@ -184,7 +184,7 @@ import {
   createHttpMcpClient,
   loadHarnessMcpConfiguration,
   normalizeHarnessMcpConfiguration
-} from "../index-t60rva31.js";
+} from "../index-azmwjp95.js";
 import {
   CliOciRuntimeAdapter,
   HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,

package/dist/engine/mcp-stdio-v1.js

@@ -8,8 +8,8 @@ import {
   mcpResourcePlanSchema,
   prepareMcpWorkspaceSnapshot,
   recoverDockerMcpResources
-} from "../index-z4e8d0ph.js";
-import"../index-t60rva31.js";
+} from "../index-6m08wvab.js";
+import"../index-azmwjp95.js";
 import"../index-z0qxmkm2.js";
 import"../index-yb239ghk.js";
 import"../index-gq9xagx2.js";

package/dist/engine/service.js

@@ -5,12 +5,12 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-2gz7jv7g.js";
-import"../index-jgrx804e.js";
+} from "../index-w2sj0wkw.js";
+import"../index-hnaxfpb5.js";
 import"../index-h0mqx2ed.js";
 import"../index-8zzhggxv.js";
 import"../index-42gp2hy8.js";
-import"../index-t60rva31.js";
+import"../index-azmwjp95.js";
 import"../index-z0qxmkm2.js";
 import"../index-yb239ghk.js";
 import"../index-gq9xagx2.js";

package/dist/hostile-repository-demo.js

@@ -12120,7 +12120,7 @@ import { z as z30 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.3.0-rc.7",
+  version: "1.3.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",

package/dist/{index-z4e8d0ph.js → index-6m08wvab.js}

@@ -3,7 +3,7 @@ import {
   combineMcpHostSessions,
   createHarnessMcpTools,
   issueMcpHostSession
-} from "./index-t60rva31.js";
+} from "./index-azmwjp95.js";
 import {
   collectSnapshotInventory,
   readSnapshotFile

package/dist/{index-t60rva31.js → index-azmwjp95.js}

@@ -11,7 +11,7 @@ import {
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.3.0-rc.7",
+  version: "1.3.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",

package/dist/{index-jgrx804e.js → index-hnaxfpb5.js}

@@ -59,7 +59,7 @@ import {
   mcpConfigurationFingerprintInput,
   normalizeHarnessMcpConfiguration,
   resolveMcpHostSession
-} from "./index-t60rva31.js";
+} from "./index-azmwjp95.js";
 import {
   EnvironmentPatchDriftError,
   Workspace,

package/dist/{index-2gz7jv7g.js → index-w2sj0wkw.js}

@@ -1,7 +1,7 @@
 import {
   createHarnessClientAdapter,
   harnessPolicyDecisionEventSchema
-} from "./index-jgrx804e.js";
+} from "./index-hnaxfpb5.js";
 import {
   openCliSessionStore
 } from "./index-42gp2hy8.js";

package/dist/index.js

@@ -100,7 +100,7 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "./index-2gz7jv7g.js";
+} from "./index-w2sj0wkw.js";
 import {
   createAcpConnection,
   serveAcpStdio
@@ -147,7 +147,7 @@ import {
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel
-} from "./index-jgrx804e.js";
+} from "./index-hnaxfpb5.js";
 import {
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_SQLITE_FILE,
@@ -180,7 +180,7 @@ import {
   createHttpMcpClient,
   loadHarnessMcpConfiguration,
   normalizeHarnessMcpConfiguration
-} from "./index-t60rva31.js";
+} from "./index-azmwjp95.js";
 import {
   CliOciRuntimeAdapter,
   HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,

package/dist/service-cli.js

@@ -2,14 +2,14 @@
 import {
   recoverHarnessLocalService,
   startHarnessLocalService
-} from "./index-2gz7jv7g.js";
+} from "./index-w2sj0wkw.js";
 import {
   createHarness
-} from "./index-jgrx804e.js";
+} from "./index-hnaxfpb5.js";
 import"./index-h0mqx2ed.js";
 import"./index-8zzhggxv.js";
 import"./index-42gp2hy8.js";
-import"./index-t60rva31.js";
+import"./index-azmwjp95.js";
 import"./index-z0qxmkm2.js";
 import"./index-yb239ghk.js";
 import"./index-gq9xagx2.js";

package/dist/{service-client-cli-kns4mf57.js → service-client-cli-3365rfav.js}

@@ -14,10 +14,10 @@ import {
   printPolicyInspection,
   sanitizeTerminalText,
   serializeStreamResult
-} from "./cli-entry-ae7x44d4.js";
+} from "./cli-entry-1gfg3brj.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-ev76ezcd.js";
+} from "./cli-entry-bx3vjw7h.js";
 import {
   HARNESS_ERROR_CODES,
   HARNESS_ERROR_SCHEMA_VERSION,

package/dist/verify-historical-migrations.js

@@ -12556,7 +12556,7 @@ import { z as z32 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.3.0-rc.7",
+  version: "1.3.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",

package/dist/zhx.js

@@ -2,7 +2,7 @@
 import {
   HARNESS_VERSION,
   shortCliHelp
-} from "./cli-entry-ev76ezcd.js";
+} from "./cli-entry-bx3vjw7h.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -16,6 +16,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-t7hrhayq.js");
+  const { runCli } = await import("./cli-etsmtst3.js");
   await runCli(argv);
 }

package/docs/CODE_RELEASE.md

@@ -1,10 +1,14 @@
 # Code release procedure
 
-Code is released independently of Harness. The initial candidate is
-`@zhivex-ai/code@0.1.0-rc.2`, with the sole binary `zhivex-code`, npm tag `next`,
-and the exact dependency `@zhivex-ai/harness@1.3.0-rc.7`. Harness must first be
-published and verified through its protected release workflow. This document
-records preparation, not successful publication.
+Code is released independently of Harness. The prepared stable release is
+`@zhivex-ai/code@0.1.0`, with the sole binary `zhivex-code`, npm tag `latest`,
+and the exact dependency `@zhivex-ai/harness@1.3.0`. Harness must first be
+published and verified through its protected release workflow. Code RC2 is
+already published on `next` and RC1 is still on `latest`; trusted
+publishing succeeded in [run 36902929707](https://github.com/Zhivex/zhivex-harness/actions/runs/36902929707).
+The stable release uses that existing OIDC path; no new credentials or publisher
+configuration are part of preparation. This document records preparation, not
+successful stable publication.
 
 ## Release preparation
 
@@ -12,19 +16,23 @@ records preparation, not successful publication.
 2. Wait for the latest `ci.yml` and `codeql.yml` **push runs on main** to succeed
    for the exact commit. Keep the Code manifest, version and engine pin unchanged
    after selecting that commit.
-3. From a clean checkout of that main commit, create an annotated
-   `code-v0.1.0-rc.2` tag and push it. Never move or overwrite release tags.
+3. Wait for Harness `1.3.0` publication and successful registry/provenance
+   verification as ordered in [the Harness release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md).
+   From a clean checkout of that main commit, create an annotated
+   `code-v0.1.0` tag and push it. Never move or overwrite release tags.
 4. Dispatch `release-code.yml` **at that tag**, with input `tag` matching it and
-   `mode=bootstrap`. Dispatching main while supplying a different tag is rejected.
+   `channel=latest`, `mode=oidc`, and `confirm_publication=true`. Dispatching
+   main while supplying a different tag is rejected.
 
 ```sh
-gh workflow run release-code.yml --ref code-v0.1.0-rc.2 \
-  -f tag=code-v0.1.0-rc.2 -f mode=bootstrap -f confirm_publication=false
+gh workflow run release-code.yml --ref code-v0.1.0 \
+  -f tag=code-v0.1.0 -f channel=latest -f mode=oidc -f confirm_publication=true
 ```
 
 The workflow validates tag identity, main ancestry, exact CI/CodeQL, Code source
 and package boundaries. It downloads the pinned Harness version from npm and
-verifies its integrity; missing publication or provenance stops the release.
+verifies its integrity and SLSA artifact/workflow/tag/source binding; missing
+publication or provenance stops the release.
 It builds Code once, inspects package contents, installs it against the actual
 registry dependency without overrides, and tests the retained Code and Harness
 artifacts with npm, pnpm, Yarn and Bun. The paired matrix uses explicit engine
@@ -36,13 +44,18 @@ inside the GitHub-hosted build job. It retains `code.tgz`, `code.sigstore.json`,
 `SHA512SUMS`, and installed acceptance in `code-release-<full-source-sha>`.
 Bootstrap mode **does not publish**. No npm token is copied into GitHub.
 
-## First publication
+## Historical first publication / future package bootstrap
 
 npm requires the package to exist before configuring its trusted publisher;
 staged publishing also requires an existing package. An authenticated scope
 owner performs the first publication using the successful workflow's retained
 artifact and provenance bundle. Do not rebuild the tarball locally.
 
+These bootstrap commands apply only if authenticated first publication is
+explicitly authorized for a new package. They are unnecessary for the existing
+Code package. Set `RELEASE_CHANNEL` from `bun run scripts/code-release.ts channel`
+and keep it consistent with the artifact.
+
 Download the artifact from the exact successful run, then verify it in a clean
 checkout of its annotated Code tag. `CODE_EXPECTED_SHA` must be that tag's full
 commit SHA. Install npm 11.6.1 into an isolated tools directory and set
@@ -51,12 +64,12 @@ commit SHA. Install npm 11.6.1 into an isolated tools directory and set
 ```sh
 (cd release-code-artifacts && shasum -a 512 -c SHA512SUMS)
 bun run scripts/code-release.ts inspect release-code-artifacts/code.tgz
-CODE_EXPECTED_SHA="$(git rev-list -n 1 code-v0.1.0-rc.2)" \
+CODE_EXPECTED_SHA="$(git rev-list -n 1 code-v0.1.0)" \
   node scripts/code-bootstrap-provenance.cjs verify \
   release-code-artifacts/code.tgz release-code-artifacts/code.sigstore.json
 node "$CODE_PROVENANCE_NPM_ROOT/bin/npm-cli.js" publish \
   ./release-code-artifacts/code.tgz --ignore-scripts --access public \
-  --tag next --provenance-file ./release-code-artifacts/code.sigstore.json
+  --tag "$RELEASE_CHANNEL" --provenance-file ./release-code-artifacts/code.sigstore.json
 bun run scripts/code-release.ts verify release-code-artifacts/code.tgz
 ```
 
@@ -74,16 +87,20 @@ repository `zhivex-harness`, workflow filename `release-code.yml`, and environme
 `npm`. Enable the allowed action `npm publish`; the OIDC job uses direct
 publishing after GitHub approval, not `npm stage publish`. Preserve the GitHub
 environment's required human approval. Then prepare a
-new Code RC/version and annotated tag through the same PR and main CI process.
-Dispatch its tag with `mode=oidc` and `confirm_publication=true`.
+new Code stable or RC version and annotated tag through the same PR and main CI process.
+Dispatch its tag with the matching channel, `mode=oidc` and
+`confirm_publication=true`. Stable versions require `latest` and a stable exact
+Harness dependency; canonical RC versions require `next`. Version/channel drift
+fails before engine downloads. An RC may pin a stable engine. Stable publication
+does not upgrade beta/experimental APIs, provisional providers or Desktop alpha.
 
 All Code tags share one workflow concurrency group. Before publishing, the
-registry gate also rejects moving `next` back to an older RC, including when
+registry gate rejects moving the selected channel back to an older release, including when
 GitHub schedules queued workflows out of order.
 
 The publish job downloads the validated artifact without rebuilding it,
 rechecks identity and digest after protected approval, and uses npm OIDC plus
-provenance. It verifies registry tarball bytes, the `next` distribution tag and
+provenance. It verifies registry tarball bytes, the selected `latest`/`next` distribution tag and
 SLSA source/workflow identity. A successful dispatch or tag is not publication;
 only successful registry verification confirms the release. When a run has
 already published, rerun only the failed publish job to retain original bytes.

package/docs/ENGINE_API.md

@@ -1,8 +1,8 @@
 # Engine API and Code integration
 
 This checkout adds terminal-independent package entrypoints for
-Harness 1.3.0-rc.7. They are not present in the previously published Harness 1.2.0.
-Publication is pending the protected workflow; use the documented
+Harness 1.3.0 (prepared for `latest`). They are not present in the previously published Harness 1.2.0.
+Stable publication is pending the protected workflow; use the documented
 local candidate smoke to validate these bytes. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.
 
@@ -32,9 +32,9 @@ prompt for credentials. Hosts explicitly construct and close the runtime, supply
 credentials/model instances, resolve approvals and choose their storage policy.
 Importing the engine does not itself execute a task or grant permissions.
 
-The `/models` subpath is an **unpublished addition after RC3**, introduced for
-HAR-HU-39. It is present in local candidate tarballs from this checkout, not the
-previously deployed RC3 bytes. Its six runtime exports and two types are listed
+The beta `/models` subpath was introduced after RC3 for HAR-HU-39 and is
+published in RC7. Stable 1.3.0 retains its beta tier; previous RC3 bytes do not
+contain it. Its six runtime exports and two types are listed
 in `contracts/engine-api.json`. It performs no file access, credential resolution,
 provider requests or process startup. Remote catalog loading remains host-owned.
 Installed-package smoke compiles the public subpath for a browser and checks its
@@ -68,8 +68,8 @@ switching presentation does not migrate state or authorize new effects.
 ## Terminal product
 
 `packages/code` is the independently built terminal product. Its current version
-is `0.1.0-rc.2`, prepared for independent publication to `next` with the exact
-engine dependency `@zhivex-ai/harness@1.3.0-rc.7`. Publication remains gated by
+is `0.1.0`, prepared for independent publication to `latest` with the exact
+engine dependency `@zhivex-ai/harness@1.3.0`. Publication remains gated by
 reviewed main, CI and registry evidence in the [Code release procedure](CODE_RELEASE.md).
 Code imports declared package APIs, never Harness source paths. Its build leaves
 Harness external.
@@ -111,10 +111,11 @@ verifies that engine and state entrypoints in one installation share ownership.
 Compatibility with older clients that do not participate in this locking
 protocol is not implied.
 
-The new subpaths are unpublished local additions after the deployed RC3.
+The new subpaths were introduced after RC3 and are published in RC7. Stable
+1.3.0 retains their declared tiers.
 Desktop migration and packaged acceptance are documented in
 the repository-only report `docs/reports/HAR_HU_39_2026-09-29.md`. Its dependency is pinned to the
-candidate version and checked for required contracts/artifact identity; this does
+exact prepared engine version and checked for required contracts/artifact identity; this does
 not claim compatibility with the earlier published RC3 bytes or a broader range.
 
 ```sh

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets the prepared `1.3.0-rc.7` candidate. Installation commands become available after protected publication to npm `next`; stable users can keep npm `latest`.
+This guide targets the prepared stable `1.3.0` release. These exact-version commands become available after protected publication to npm `latest`; currently latest resolves to 1.2.0.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.3.0-rc.7
+npm install -g @zhivex-ai/harness@1.3.0
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.3.0-rc.7
+bun add --global @zhivex-ai/harness@1.3.0
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.3.0-rc.7 --version
-bunx @zhivex-ai/harness@1.3.0-rc.7 --help
-bunx @zhivex-ai/harness@1.3.0-rc.7 doctor
+bunx @zhivex-ai/harness@1.3.0 --version
+bunx @zhivex-ai/harness@1.3.0 --help
+bunx @zhivex-ai/harness@1.3.0 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/STABILITY.md

@@ -4,7 +4,7 @@ The additive [engine entrypoints](ENGINE_API.md) are enumerated in
 [`../contracts/engine-api.json`](../contracts/engine-api.json). Aliases preserve
 their existing root tiers; newly exposed helpers have explicit tiers. The root
 compatibility surface remains unchanged. These entrypoints are source changes
-for the planned 1.3 line, not APIs available in the registry 1.2.0 package.
+for the prepared 1.3.0 release and are available in the published RC7; they are absent from registry 1.2.0. Stable package numbering does not upgrade any export tier.
 
 [`../contracts/public-api.json`](../contracts/public-api.json) is the machine-checked 1.0 baseline for the package root, binaries, CLI commands/subcommands, exit codes, and document schemas. Every runtime and type export is present in the snapshot and belongs to exactly one explicit tier. Exports listed as stable form the intended 1.x compatibility surface; Time-to-Safe-Fix exports are experimental; the explicitly listed beta exports may evolve under the policy below.
 

package/evaluations/representative-assembly-matrix.json

@@ -52,7 +52,8 @@
     "v1.3.0-rc.4",
     "v1.3.0-rc.5",
     "v1.3.0-rc.6",
-    "v1.3.0-rc.7"
+    "v1.3.0-rc.7",
+    "v1.3.0"
   ],
   "expectedModels": [
     {
@@ -462,6 +463,14 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.3.0",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/examples/README.md

@@ -2,19 +2,19 @@
 
 ## Isolated Bun installation
 
-Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected 1.2.0 publication, this installs the stable artifact in a temporary consumer, without building the source checkout or changing global tools:
+Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected 1.3.0 publication, this installs the stable artifact in a temporary consumer, without building the source checkout or changing global tools:
 
 ```bash
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.3.0-rc.7
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.3.0
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json
 ```
 
-Version must print `1.2.0`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
+Version must print `1.3.0`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
 
 To continue in your actual project, use the [global installation and credential setup](../README.md#installation), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.3.0-rc.7",
+  "version": "1.3.0",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",