@zhivex-ai/harness 1.4.0-rc.6 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.4.1 - 2026-10-14
+
+- Classify Vertex and Google transient failures as retryable `PROVIDER_UNAVAILABLE` instead of a generic `EXECUTION_FAILED`. The covered cases are HTTP 409 ABORTED, 429 RESOURCE_EXHAUSTED, 500/502/503/504, UNAVAILABLE, DEADLINE_EXCEEDED, and stream resets. Sanitized diagnostics keep the HTTP status and the closed provider status category, and still omit provider messages, resource names, and credentials.
+- Retry that class, and an empty model turn with no text and no tool call, up to three times with jittered backoff in the Vertex driver. The live continuity and approval-compaction gates use the same classification and do not accept a phase that fails its assertions.
+- Keep the package version at `1.4.0`. This note does not tag, publish, or dispatch a release.
+
+## 1.4.0 - 2026-10-09
+
+- Prepare stable Harness 1.4.0 and Code 0.3.0 for npm `latest`, with the exact Code engine pin, private Desktop binding and an additive representative mapping for `v1.4.0` using the unchanged Meta, Qwen and OpenAI models. Retain the SDK pins already on main (Core 1.31.0, Agents 1.11.0 and the existing provider packages). Published `latest` stays Harness 1.3.0 and Code 0.2.0. Published `next` is Harness 1.4.0-rc.8 and Code 0.3.0-rc.8. `release-status.json` keeps the verified 1.3.0 record until this stable publication has its own registry evidence.
+- Engine runtime source under `src/` is identical to annotated `v1.4.0-rc.8` and `code-v0.3.0-rc.8` (`5bba06c86fc82b34b67cec607053948f8e00d0d1`). Root `scripts/`, root `tests/` and `evaluations/` were also unchanged before this preparation's representative-mapping row. Code (`packages/code`), web (`packages/web`) and desktop (`desktop`) are not identical to that tag.
+- Carry the reviewed product changes on main after that tag: the same Code review screen for shell `--continue` and `/pending` ([PR201](https://github.com/Zhivex/zhivex-harness/pull/201)); removal of the desktop fixture waiting button ([PR203](https://github.com/Zhivex/zhivex-harness/pull/203)); B-lite review scope on web and desktop ([PR211](https://github.com/Zhivex/zhivex-harness/pull/211)); the Code status line, one-line summary and 48×24 first-welcome logo ([PR210](https://github.com/Zhivex/zhivex-harness/pull/210)); and the public README ([PR200](https://github.com/Zhivex/zhivex-harness/pull/200)). Packaged Harness docs `README.md` and `docs/CLI.md` differ from the rc.8 tag. `docs/CLI_UX.md` and `docs/images/approval-survives-restart.gif` also differ and are outside the Harness `files` list.
+- Require fresh exact-source/artifact validation and separate explicit approval before any paid campaign, annotated tag or publication. Provider/API tiers remain unchanged. This preparation creates no tags and dispatches no release.
+
+## 1.4.0-rc.8 - 2026-10-08
+
+- Prepare matched Harness 1.4.0-rc.8 and Code 0.3.0-rc.8 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models. Retain the SDK pins already on main (Core 1.31.0, Agents 1.11.0 and the existing provider packages). Stable `latest` stays Harness 1.3.0 and Code 0.2.0.
+- Refuse a second `delegate_*` call for a task that was already accepted in the same model response. The duplicate stays non-executable and the next turn tells the coordinator to use the completed result instead of retrying. A later model step can still recover from an invalid call that did not execute. Paused runs bound to the previous delegation fingerprint must be completed with the artifact that created them.
+- Document that Qwen live certification accepts `DASHSCOPE_API_KEY` alone. `QWEN_API_KEY`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, and `QWEN_REGION` remain optional overrides.
+- Preserve annotated `v1.4.0-rc.7` at `1f986a0b044fa2827166fc934c712684971127b5`. It was tagged but not published because live certification failed on Qwen in the bounded reviewer orchestration gate. No Code RC.7 tag was created. Published npm `next` remains Harness 1.4.0-rc.6 and Code 0.3.0-rc.6. That evidence does not certify RC.8.
+- Require fresh exact-source/artifact validation and separate explicit approval before any paid campaign, annotated tag or publication. Provider/API tiers remain unchanged.
+
+## 1.4.0-rc.7 - 2026-10-08
+
+- Prepare matched Harness 1.4.0-rc.7 and Code 0.3.0-rc.7 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models. Retain the SDK pins already on main (Core 1.31.0, Agents 1.11.0 and the existing provider packages). Stable `latest` stays Harness 1.3.0 and Code 0.2.0.
+- Include reviewed main since published 1.4.0-rc.6: optional Web task/project limits and immediate composer consumption (PR189); sanitized Qwen SSE transport/parser diagnostics in CLI JSON/JSONL and failed client runs, including message-only installed SDK compatibility, while provider payloads, parser causes and arbitrary exception text stay excluded (PR188); experimental guided Code task budget authority across turns, correction and restart (PR187); private Desktop Electron 44.5.1 (PR180); persisted task cancellation that fences late admissions (PR190, HAR-HU-71); and host-only task continuity over existing SQLite task, contract, journal and budget records (PR191, HAR-HU-72).
+- Keep one native SQLite writer and the SDK token coordinator. Reserve before primary and compaction dispatch, fence tools and checkpoints against the task lease, retain uncertain consumption and unknown exposure, and require explicit known-outcome continuation after cancellation. Preserve contract revisions, refuse stale approvals and missing or uncertain effect evidence, and revalidate receipts before Code keep. No automatic effect replay or new public web task projection.
+- Show authoritative task limits, confirmed/reserved/unknown usage, fresh checks and human decisions in Code; retain drafts when admission fails before a run checkpoint. Ordinary non-task retry and no-cap chat stay unchanged, and unlimited hosts still require explicit task token limits. Index transport usage by scope/run without changing pruning, redaction or mandatory persistence errors. Preserve explicit monetary output caps above 2,048.
+- Add numeric monotonic phase telemetry and a frozen synthetic offline evaluation scaffold. These fixtures validate runtime behavior, not real-task or model quality; real holdout selection, human review and any paid campaign remain pending. Logical JSON backups omit transport monetary tables and cannot restore task spending authority; incomplete restores fail closed.
+- Preserve published Harness `v1.4.0-rc.6` and Code `code-v0.3.0-rc.6` at `0adf4e2e96380864ef4c697ea94df64ad7c18eec`, the held RC.5 campaign, and the RC.4 failure history and SDK store migration requirements. Their evidence does not certify RC.7.
+- Require fresh exact-source/artifact validation and separate explicit approval before any paid campaign, annotated tag or publication. Provider/API tiers remain unchanged.
+
 ## 1.4.0-rc.6 - 2026-10-05
 
 - Prepare matched Harness 1.4.0-rc.6 and Code 0.3.0-rc.6 for npm `next`, with the exact Code engine pin, private Desktop binding and an additive representative mapping using unchanged models and SDK pins.

package/README.md

@@ -1,109 +1,162 @@
-# Zhivex Harness
+# Zhivex Code
 
-**Work on your code with an agent. Review consequential actions before approving them.**
+[![npm @zhivex-ai/code](https://img.shields.io/npm/v/@zhivex-ai/code?label=npm%20%40zhivex-ai%2Fcode)](https://www.npmjs.com/package/@zhivex-ai/code)
+[![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/github/license/Zhivex/zhivex-harness)](LICENSE)
 
-Zhivex Harness is a local terminal assistant and TypeScript library. It supports
-OpenAI, Qwen and Meta, with provisional Gemini, Anthropic and Vertex support. Conversations and pending
-approvals survive restarts.
+An open-source coding agent for your terminal. It asks before it edits or runs a check, and a pending approval is still there after you quit.
 
-Use it to understand a repository, discuss a design, investigate a failure or
-implement a change. Conversation context retains decisions, hypotheses and bounded
-diagnostic excerpts across compaction. Edits and command execution keep their
-own permission checks; a conversational summary never grants approval.
+**Zhivex Code** ([`@zhivex-ai/code`](https://www.npmjs.com/package/@zhivex-ai/code)) is the product you install and run. **Zhivex Harness** ([`@zhivex-ai/harness`](https://www.npmjs.com/package/@zhivex-ai/harness)) is the engine underneath: a governed, provider-portable TypeScript runtime with durable approvals and isolated execution. MIT licensed.
 
-For the developer-facing terminal product, install
-`npm install -g @zhivex-ai/code@0.2.0` and run `zhivex-code` in your project.
-See [Code installation and first use](https://github.com/Zhivex/zhivex-harness/blob/main/packages/code/README.md). Harness remains
-the reusable engine and its compatibility CLI. The `/task` delivery workflow in
-this checkout is an unreleased experimental Code addition, not a published feature.
+## Approval survives a restart
 
-Version `1.3.0` is the current public npm release on `latest`, with terminal-independent engine
-entrypoints and the separately published Code CLI `0.2.0` on `latest`. Harness publication passed registry integrity and provenance verification. Harness `1.4.0-rc.1` and
-Code `0.3.0-rc.1` are published on `next`. The RC.6 versions prepared in this
-checkout remain unpublished. Stable package numbering does
-not change API stability tiers: beta and experimental APIs retain their policies,
-Gemini/Anthropic/Vertex remain provisional, and Desktop remains a private alpha.
+<!-- Recorded with zhivex-code. Scene: ask for a change, review the diff, leave the approval pending, quit,
+     then run `zhivex-code --continue` and show the same approval.
+     Inside the session, `/continue` starts a new run from an interrupted task;
+     the reopen step in this GIF is the `--continue` flag.
+     The file is docs/images/approval-survives-restart.gif. Do not add it to either package `files` list.
+     npm shows the absolute raw URL below. That URL resolves from main. -->
 
-## Quick start
+![Approval survives a restart](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/docs/images/approval-survives-restart.gif)
+
+## Why it works this way
+
+- **You approve the exact change.** Edits and checks wait for an explicit decision bound to that diff. A conversational summary leaves the change unapproved. If the file changed on your side, import fails closed.
+- **The pending decision survives a restart.** Conversations and approvals are stored in SQLite. Quit the terminal, or reboot, and the same approval is waiting.
+- **Your keys, your provider.** OpenAI, Qwen, and Meta pass the release gate. Gemini, Anthropic, and Vertex are provisional. The same CLI talks to each of them.
 
-Requires Node.js 22.13.0 or newer, Git and a provider API key.
+## Quick start
 
-Install the stable npm release (`latest`, currently `1.3.0`):
+You need Node.js 22.13 or newer, Git, and a provider API key. Linux and macOS are supported. Windows is unsupported.
 
 ```sh
-npm install -g @zhivex-ai/harness@latest
+npm install -g @zhivex-ai/code
 cd /path/to/your/project
-zhx
+zhivex-code
 ```
 
-On first use, choose a provider and model, then enter your API key in the hidden
-prompt. Save it in the system keychain (macOS/Linux) or use it only for the current
-CLI session. Existing environment keys take precedence. See [First use](docs/FIRST_USE.md)
-and [Credentials](docs/CREDENTIALS.md) for setup and automation.
+On first launch, choose a provider and model. If no key is already available, enter one in the hidden prompt and save it in the system keychain, or keep it for this session only. An existing environment variable takes precedence. The same prompts are documented for the engine command `zhx` in [First use](docs/FIRST_USE.md) and [Credentials](docs/CREDENTIALS.md).
 
 Try: “Explain this repository and suggest a small improvement.”
 
-Type `/` for common actions. `/model` changes the model, `/sessions` finds previous
-conversations, and `/diff` shows changes. Review requested actions before approving
-them. Ctrl+C stops active work; it does not undo completed changes.
+Type `/` for common actions. `/model` changes the model, `/sessions` finds earlier conversations, and `/diff` shows workspace changes. Review each requested action before you approve it. Ctrl+C stops the active run. It leaves completed work in place.
+
+| Command | Purpose |
+| --- | --- |
+| `zhivex-code` | Open the conversation |
+| `zhivex-code --continue` | Reopen the latest conversation. A pending approval opens the review screen |
+| `zhivex-code run "task"` | Run one task for a script |
+| `zhivex-code doctor` | Check local configuration |
+| `zhivex-code --help` | Short guide |
+| `zhivex-code help all` | Full command reference |
+
+`zhivex-code <command> --help` shows one command. Inside the session, `/help` lists everyday actions and `/help all` lists the rest.
+
+### Command names
+
+Each package owns its own commands. Installing both leaves each command in place. Nothing here adds or renames a command.
+
+| Package | Commands |
+| --- | --- |
+| `@zhivex-ai/code` | `zhivex-code` |
+| `@zhivex-ai/harness` | `zhx` and `zhivex-harness` (the same engine CLI), plus `zhx-acp` for the experimental editor protocol |
 
-## Release candidates
+`zhx chat` remains a supported way to open the engine console.
 
-This checkout prepares Harness `1.4.0-rc.6` and Code `0.3.0-rc.6` for `next`, with an exact engine pin. Project memory, compact terminal review and the local browser workspace ship together after protected validation. See the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). RC.6 publication is pending. It includes the reviewed bounded activity snapshot fix; RC.5 remains held and its source/tag cannot be reused for this fix. The failed RC.4 attempt and immutable source are preserved; npm `next` currently points to Harness `1.4.0-rc.1` and Code `0.3.0-rc.1`. These prerelease candidates are separate from the stable `latest` channel.
+### A pending approval is still there
 
-Use candidates only for prerelease validation. Check [npm versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions)
-and the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md)
-before installing a candidate; `next` can still point to an earlier RC.
+Two different actions share the word “continue”:
 
-After publication of this exact candidate:
+| Where | What you type | What happens |
+| --- | --- | --- |
+| Shell, after you quit | `zhivex-code --continue` | Reopens the latest conversation. A pending approval opens the review screen. |
+| Inside the session | `/continue` | Starts a new run from an interrupted task and keeps the earlier results. |
+
+`/continue` is the in-session command. The shell flag that reopens the latest conversation is `--continue`, on `zhivex-code` and on `zhx`. On `zhivex-code`, that screen is `r` Reject, `a` Approve N file(s), `d` Details, and Esc to decide later. A check uses `Approve 1 command` instead of the file label. `/pending` opens the same screen. A new turn waits until you decide. On `zhx`, `--continue` reopens and prints the pending approval; `/pending`, then `/approve` or `/deny`, decides it. `/continue` inside that session starts a new run.
+
+### Try it with no API key
+
+The Code package includes an offline tutorial. It needs an interactive terminal. It makes no provider calls. Responses, token counts, and prices are synthetic.
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.0-rc.6
+node "$(npm root -g)/@zhivex-ai/code/examples/first-use.mjs"
 ```
 
-## A few commands are enough
+The script prints the guided sequence and a command to reopen the same temporary workspace.
 
-| Command | Purpose |
+### Credentials
+
+| Provider | What the CLI accepts |
 | --- | --- |
-| `zhx` | Open the conversation |
-| `zhx --continue` | Continue the latest conversation |
-| `zhx run "task"` | Run one task for automation |
-| `zhx doctor` | Diagnose local configuration |
-| `zhx --help` | Show the short guide |
+| OpenAI | `OPENAI_API_KEY` |
+| Qwen | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` |
+| Meta | `MODEL_API_KEY` |
+| Gemini (provisional) | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` |
+| Anthropic (provisional) | `ANTHROPIC_API_KEY` |
+| Vertex (provisional) | Application Default Credentials, plus `GOOGLE_CLOUD_PROJECT` and `VERTEX_LOCATION`. Code does not ask for a Vertex API key. |
 
-Use `zhx <command> --help` for command-specific options, or `zhx help all` for the
-complete reference. Existing `zhx chat` and `zhivex-harness` commands remain supported.
+Use `/credentials` later to replace or remove a saved key. `zhivex-code doctor` reports whether a credential is present. It does not call the provider.
 
-## CLI, library or Desktop?
+## What you can count on
 
-The npm package includes the CLI and TypeScript library. [Desktop](https://github.com/Zhivex/zhivex-harness/blob/main/desktop/README.md)
-is a separate Electron application, currently alpha for macOS Apple Silicon.
-It is not included in npm and has its own build and distribution process. Its local
-package is unsigned and unnotarized; automatic updates are disabled pending production trust setup and validation.
+| | |
+| --- | --- |
+| Approval | Explicit, bound to the exact diff. Per-file changed regions are shown when a preview is available. |
+| Durability | SQLite keeps the conversation and any pending approval across quit and reboot. |
+| Secrets | `.env`, private keys, Git internals, and dependency directories stay out of model exploration. |
+| Commands | The default runtime exposes no shell tools. Isolated commands need an explicitly configured Docker or Podman environment. |
+| Where it runs | On your machine. Linux and macOS. |
 
-## Permissions and limits
+From a source checkout, `bun run demo:hostile` runs a reproducible hostile-repository demo (a malicious README and a decoy `.env`, with network denied). See [Hostile repository demonstration](docs/HOSTILE_REPOSITORY_DEMO.md). That demo needs a local build, Docker or Podman, and a preloaded image.
 
-Edits and checks require approval by default. Files such as `.env`, private keys,
-Git internals and dependency directories are excluded from model exploration.
-The default runtime has no OS isolation and exposes no shell-class tools. Running
-commands in isolation requires an explicitly configured Docker or Podman environment;
-see [Execution environments](docs/EXECUTION_ENVIRONMENTS.md).
+## Providers and platforms
 
-Gemini, [Anthropic](docs/ANTHROPIC.md) and [Vertex](docs/VERTEX.md) remain provisional. See the [support matrix](docs/SUPPORT_MATRIX.md) and
-[security policy](SECURITY.md) for supported configurations and reporting concerns.
+Release-gated providers are OpenAI, Qwen, and Meta. **Gemini, Anthropic, and Vertex are provisional**: the integrations exist, and they do not yet have the same end-to-end release evidence. Details: [support matrix](docs/SUPPORT_MATRIX.md), [Anthropic](docs/ANTHROPIC.md), [Vertex](docs/VERTEX.md).
+
+| Area | Status |
+| --- | --- |
+| Operating systems | Linux and macOS. Windows is unsupported. |
+| Runtime | Node.js 22.13 or newer. Bun is contributor tooling. |
+| MCP | Bounded Streamable HTTP is supported. stdio is outside the default CLI. An experimental host-only path can launch stdio servers in Docker; see [Isolated MCP stdio](docs/MCP_STDIO.md). |
+| Editor protocol | `zhx-acp` is an experimental ACP subset: text sessions, one-time permissions, and cancellation. Output is buffered until the run finishes. ACP cannot load or resume a session. See [ACP](docs/ACP.md). |
+| Isolated commands | Docker on Linux is supported. Podman is provisional. See [Execution environments](docs/EXECUTION_ENVIRONMENTS.md). |
+| Desktop | Separate private alpha for macOS Apple Silicon. Unsigned, and not part of the npm package. See [Desktop](https://github.com/Zhivex/zhivex-harness/blob/main/desktop/README.md). |
+
+## Use the engine as a library
+
+Code is the terminal product and has no public library API. Harness is the embeddable runtime. Hosts construct it, supply credentials, and resolve approvals:
+
+```ts
+import { createHarness } from "@zhivex-ai/harness/engine";
+import { createHarnessClientAdapter } from "@zhivex-ai/harness/client";
+
+const harness = await createHarness({
+  workspace: "/absolute/path/to/project",
+  provider: "openai",
+  model: "your-supported-model"
+});
+const client = await createHarnessClientAdapter(harness);
+try {
+  // Dispatch with the client protocol. Approve each consequential action explicitly.
+} finally {
+  client.close();
+  await harness.close();
+}
+```
+
+Contracts, stability tiers, and the experimental ACP and MCP entry points are in the [engine API](docs/ENGINE_API.md).
 
 ## Documentation
 
-- **Users:** [First use](docs/FIRST_USE.md), [daily workflow](docs/CLI.md#interactive-daily-workflow), [usage reference](docs/USAGE.md).
-- **Integrators:** [CLI contracts](docs/CLI.md), [extensibility](docs/EXTENSIBILITY.md), [API stability](docs/STABILITY.md).
-- **Contributors:** [Development](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md) and [maintenance](https://github.com/Zhivex/zhivex-harness/blob/main/docs/MAINTENANCE.md).
+- **Using Code:** [Code package notes](https://github.com/Zhivex/zhivex-harness/blob/main/packages/code/README.md), [first use](docs/FIRST_USE.md), [daily workflow](docs/CLI.md#interactive-daily-workflow), [usage reference](docs/USAGE.md).
+- **Integrating Harness:** [engine API](docs/ENGINE_API.md), [CLI contracts](docs/CLI.md), [extensibility](docs/EXTENSIBILITY.md), [API stability](docs/STABILITY.md).
+- **Limits:** [support matrix](docs/SUPPORT_MATRIX.md), [security policy](SECURITY.md).
+- **Contributing:** [development](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md) and [maintenance](https://github.com/Zhivex/zhivex-harness/blob/main/docs/MAINTENANCE.md).
+
+[Browse the documentation index](docs/README.md).
 
-[Browse documentation](docs/README.md).
+## Releases
 
-Version `1.3.0` is the current public npm release. Source checkout changes can be
-newer than the published package. Consult the [changelog](CHANGELOG.md) and
-[repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json)
-for the verified 1.3.0 publication; [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md)
-records validation scope and limitations.
+Version `1.3.0` is the current public npm release. The paired Code package on npm `latest` is `0.2.0`. This checkout prepares Version `1.4.0` and Code `0.3.0` for `latest`. That publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
 
-Experimental next-version work includes [project memory](docs/PROJECT_MEMORY.md): explicit, reviewable notes scoped to one project, with bounded retrieval and deletion controls.
+Release channels, publication, and certification records are in the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). Releases are verified with npm provenance. Source in this checkout can be newer than the public package. See the [changelog](CHANGELOG.md) and the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json).

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `1.3.x` patch of Harness and the latest stable Code `0.1.x` patch. RCs on `next` are validation candidates; older minors and private checkpoints are not supported release channels. Desktop remains a separate private alpha. Beta and experimental features retain their documented limitations. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Security fixes are provided for the latest published `1.3.x` patch of Harness and the latest stable Code `0.2.x` patch. Harness `1.4.x` and Code `0.3.x` are supported only after verified publication. RCs on `next` are validation candidates; older minors and private checkpoints are not supported release channels. Desktop remains a separate private alpha. Beta and experimental features retain their documented limitations. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `1.3.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record records the verified 1.3.0 publication. Harness 1.3.0 and Code 0.1.0 are published and verified on latest through their protected workflows.
+Zhivex Harness `1.3.x` is the latest supported Node-first CLI and TypeScript library. Stable 1.x contracts follow [the stability policy](./docs/STABILITY.md); incompatible changes require a major release except documented urgent security corrections. Beta and experimental surfaces retain their declared policies. The mutable machine-readable `release-status.json` record records the verified 1.3.0 publication. Harness 1.4.0 and Code 0.3.0 are prepared for latest but remain pending their protected workflows. Harness 1.3.0 and Code 0.2.0 stay the published latest packages.
 
 The 1.1 support scope is tracked in the [machine-readable support matrix](./docs/support-matrix-1.1.json) and its [human-readable view](./docs/SUPPORT_MATRIX_1_1.md). The [1.0 matrix](./docs/SUPPORT_MATRIX.md) remains historical. Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) for the published 1.x line.
 
@@ -13,7 +13,7 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.1.x are the supported stable lines. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.3.x and Code 0.2.x are the supported stable lines until 1.4.0 and Code 0.3.0 complete verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/contracts/engine-api.json

@@ -2735,6 +2735,61 @@
           "name": "checkEvidence",
           "kind": "runtime",
           "tier": "experimental"
+        },
+        {
+          "name": "initializeHarnessTaskBudget",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectHarnessTaskBudget",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "requestHarnessTaskCancellation",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "persistHarnessTaskDraft",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "readHarnessTaskDraft",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "TASK_BUDGET_KEY",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectTaskBudgetSummary",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "inspectHarnessTaskContinuity",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "createTaskTelemetry",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "runHarnessTask",
+          "kind": "runtime",
+          "tier": "experimental"
+        },
+        {
+          "name": "HarnessTaskRunOptions",
+          "kind": "type",
+          "tier": "experimental"
         }
       ]
     },

package/contracts/stable-api-signatures.json

@@ -133,7 +133,7 @@
     },
     {
       "name": "cancelHarnessRun",
-      "sha256": "sha256:5663bdef782a4ab08542d5ac8117735d5d541d0a0eb166a011238d4aa0500250"
+      "sha256": "sha256:209632058366e3993cc22c7bdadde31dd00a3f533dcfb4d61c8f5124de9c3aed"
     },
     {
       "name": "canonicalizeChangeEnvelope",
@@ -141,15 +141,15 @@
     },
     {
       "name": "cleanupHarnessRuns",
-      "sha256": "sha256:644f0b3d18d18792b85a93bd68c99c25b45e401604234243e7d0d12dcf5787bd"
+      "sha256": "sha256:0d91a941627459e31098d8f7b0f5abbde1ec518705c61e8eb4cd54ac1a2da4f8"
     },
     {
       "name": "cliJsonDocumentSchema",
-      "sha256": "sha256:1306fb65c1a58f30836b348a0b0889c1f283e841d0ce745df68a9f73a3438daa"
+      "sha256": "sha256:7e7a254c88c40eb537981b8e28cc9abeb1196e75d8ee025c12551cb8cfeab580"
     },
     {
       "name": "cliJsonLineDocumentSchema",
-      "sha256": "sha256:dc9292d7dc52a6d1764260aafc9fdf253d7febdcd7c7a805d9497d89865029c3"
+      "sha256": "sha256:94a0815632f10a637cc889ed54ffb406b9253aab373fff3bb045be68aa071d91"
     },
     {
       "name": "computeChangeEnvelopeDigest",
@@ -165,7 +165,7 @@
     },
     {
       "name": "createHarness",
-      "sha256": "sha256:b237f9c2a28c01dbc7e929afd2195af7082bb5533020bf151eba16a5626eba61"
+      "sha256": "sha256:8b682f88b2c92a5581a68f92dbd886b5dc6c8b49b04ca8e1214bed164708b9ea"
     },
     {
       "name": "createHarnessMcpTools",
@@ -177,7 +177,7 @@
     },
     {
       "name": "createHarnessStateBackup",
-      "sha256": "sha256:996add7e76050ca1278a63ecdd1d6f1f7e38cef8d970e1a43e7e3daf9f35b5b2"
+      "sha256": "sha256:f1fa095f7b2db71d64f07ff23d8823fc1ba57729d3cfdb1188969c5ab2172332"
     },
     {
       "name": "createHttpMcpClient",
@@ -185,7 +185,7 @@
     },
     {
       "name": "createProviderModel",
-      "sha256": "sha256:130bd6241a98312fe78d0542b7bc689bd7de28c0ab7f7371992f1c4838b7b48e"
+      "sha256": "sha256:482f0414ff0315198c7b1deaabf024ffdbb64b6c06e5e7d7832652931ec540bb"
     },
     {
       "name": "digestChangeEnvelopeArtifact",
@@ -193,31 +193,31 @@
     },
     {
       "name": "exportHarnessStateBackup",
-      "sha256": "sha256:9dbe5ecb1f1c62fcf8be6aa4aabdbca6a63f221eb096b6cb6f04453023a599c8"
+      "sha256": "sha256:f6a581444669735dcc3998ec24b4e6f9f389d18f4680e9c956f6287738076a12"
     },
     {
       "name": "harnessErrorDocument",
-      "sha256": "sha256:f9679ae46816d693c77acc0ecb2c35e99ab5952950f415407a1c94270bacee12"
+      "sha256": "sha256:5340a9d49948981bbaa3223ec63249351dbc6271b4caf717e34b0fcc05c8f1fd"
     },
     {
       "name": "importHarnessStateBackup",
-      "sha256": "sha256:899573e66f17237c4d9716cbab94d02e8b1609f60ea46819846507be8a0aa3de"
+      "sha256": "sha256:1929d2a2ba7de06801dc7b6b961b74e92e7fb871ac4f01e0ba9d79d9dfb97d0f"
     },
     {
       "name": "importHarnessStateBackupFile",
-      "sha256": "sha256:179e581a9c5343a7950008b3f6b55992aff8787ac0c8a3f830b1777ce0cfe30f"
+      "sha256": "sha256:07b707e8e8495a87972a075894c4ecf59161be6ac2cdce8f9a66bf71d1b51d40"
     },
     {
       "name": "inspectHarnessRun",
-      "sha256": "sha256:ab8a33265539f15910e0e4724c391b4cc944655a26c3b1ec1bfff57f38ce5cdc"
+      "sha256": "sha256:68e13aabfcd8974e92cebb7b06afdb5643c76d86b3473c2afeb127245329d4e5"
     },
     {
       "name": "inspectHarnessState",
-      "sha256": "sha256:5bb5b62cb9eec966daa96e64b932223edb5c4f2a837b79066baecd4d8a3aee48"
+      "sha256": "sha256:529d9bf8c0528942793786c345030a98e88d219c34f41ea2c3e31724cca66837"
     },
     {
       "name": "listHarnessRuns",
-      "sha256": "sha256:eece516c36ab24eef95c47ce5e7051dc53149bc9856da8b70e0e891f4fba5f3a"
+      "sha256": "sha256:2085baf7b5c69e79939dd8d13d6dbccb8166d163659823d93bd2eb10d6080acc"
     },
     {
       "name": "loadHarnessMcpConfiguration",
@@ -225,7 +225,7 @@
     },
     {
       "name": "migrateHarnessConfigInput",
-      "sha256": "sha256:3757847c7e64d66acd2a25471e2ada13576189e80e7b2bbea2c5e5f9ce9e606e"
+      "sha256": "sha256:719fcc2bef2415d972f7f04f3970b9120e285a4b9abd5df0fd01727e05befa2f"
     },
     {
       "name": "normalizeHarnessError",
@@ -241,15 +241,15 @@
     },
     {
       "name": "openHarnessPersistence",
-      "sha256": "sha256:55c8d0459d62242830e694b4650cef9971957b07d866ee609ac4267b2fb59c36"
+      "sha256": "sha256:91a4d79eb2c7a4e82cb1aa6ad199492538bd2d9599bd320eb603765fb6fca934"
     },
     {
       "name": "parseCliJsonDocument",
-      "sha256": "sha256:e84e6cea6fc403ceab1ee4e557de16b67830018447f850407c3cb9bb08173ba2"
+      "sha256": "sha256:8d94b80ef3160b12119ce8b083937ef6beed2a1b068f46f94b5077e36d54a931"
     },
     {
       "name": "parseCliJsonLineDocument",
-      "sha256": "sha256:45980d82a95b8064d8b775b97ca949d80d18a53bce0a7c2b4068d71cc88731e2"
+      "sha256": "sha256:3f0c38ada9d89150fe2cedbb50380f8e170ad22dfb2d7a17690efc057be9bc3b"
     },
     {
       "name": "parseHarnessModelRoute",
@@ -269,11 +269,11 @@
     },
     {
       "name": "resolveHarnessConfig",
-      "sha256": "sha256:281376e0bee7c855bbd2edf72923def4defa3a2e648e69f4a53b74dcf6c2f744"
+      "sha256": "sha256:92dd51056d4745eea346f9163f29b9748ac6e1b9f9d0e28a3191111093703804"
     },
     {
       "name": "runHarness",
-      "sha256": "sha256:c5b58ddb5169da5b1a6c6cb0b4000c8e7bc48a07048530501d8e7407b5e28825"
+      "sha256": "sha256:aeed30705c782cb7af884a8d51abf9d47bf4a9b7010650c842209c5f608b6019"
     },
     {
       "name": "serializeStreamEvent",
@@ -319,11 +319,11 @@
     },
     {
       "name": "CliJsonDocument",
-      "sha256": "sha256:11d75d65f9565f16d06dcdd49521e56cc6d03e4600ccbd8c743bee593a01d892"
+      "sha256": "sha256:613a0da81316ffd657d18427c28804a8f7dc51017aec2e6893d7b2d64a5ff96e"
     },
     {
       "name": "CliJsonLineDocument",
-      "sha256": "sha256:5b9f7aee6a3cac014567452e1023fec83b9ae1499b52a3f68dab074b984c806a"
+      "sha256": "sha256:5dd40d8c335fd1e6e3414825e70fd4dd70117286e1bc0f5e96c53c45b6b6c91a"
     },
     {
       "name": "CliOptionDefinition",
@@ -339,7 +339,7 @@
     },
     {
       "name": "CliRunEventDocument",
-      "sha256": "sha256:626df354f498266b390947be13556fdca171efb11b7c480973d70398e08a11e9"
+      "sha256": "sha256:9ad681aea1b90debc0682dea6487f4098c50e5cd548e4694ae07db94b80279f0"
     },
     {
       "name": "CliRunInspectionDocument",
@@ -351,7 +351,7 @@
     },
     {
       "name": "CliRunResultDocument",
-      "sha256": "sha256:31efc5f7914df25f60ebec8408242b54bcae290d2bb0306869fc2fddcf357390"
+      "sha256": "sha256:1c14e0466d7e387aa80294d1271d9b2ff37fa4cbe41d9e1d7a1ad5faabe23318"
     },
     {
       "name": "CliSession",
@@ -367,7 +367,7 @@
     },
     {
       "name": "CliStreamErrorDocument",
-      "sha256": "sha256:5c6bd4cfde648e2987b541ec07e8b681c9694f22c3a6b29cac8b57b6a6e30653"
+      "sha256": "sha256:b9f92e4dc53013ec79690838dab8f5db19bdbba10a918549a914ddf41eb423b7"
     },
     {
       "name": "CliStreamResultDocument",
@@ -375,23 +375,23 @@
     },
     {
       "name": "CreateHarnessOptions",
-      "sha256": "sha256:596b95a410a0bd84feb53ae0188177c934b1f7432c155684f7d33e9d49fff898"
+      "sha256": "sha256:bf02d5a2b5cc10dfbc59a2dcceebe91d2a56add94f9912e8d73c61da4bb64a12"
     },
     {
       "name": "HarnessBudget",
-      "sha256": "sha256:86935e2a5d85184a15af839900cff28f8f46f58df68e62114327be88e287a249"
+      "sha256": "sha256:d5ab8916582847c82fb2c86eface15f44af12a710926aa5eca2c59eac97638c0"
     },
     {
       "name": "HarnessConfig",
-      "sha256": "sha256:2de5e71869d5a40fedb3b01ab1a7c766bc8a03b7806a597c328cca6053ceda93"
+      "sha256": "sha256:afd78cedcbe664b7decf1d11dd70a5bb7ad997ea090c9afaa894398f408cbd3d"
     },
     {
       "name": "HarnessConfigInput",
-      "sha256": "sha256:01093620aed18df40794324345600983230878d197c3a1cf2f01c17aae1c382e"
+      "sha256": "sha256:4679312a8a410043ee77890447460ac294b87dade7e2eb04e809295e3093b8c1"
     },
     {
       "name": "HarnessConfigMigrationResult",
-      "sha256": "sha256:b3b86d52652e9d24b7ab6013de95000976d6058fec5b41e0e604dd3ee31a9bd2"
+      "sha256": "sha256:4d9e7b61dd92f95be292571da2251ce8927c08fe488d7742d8c71cbc87e2eedb"
     },
     {
       "name": "HarnessContextBundle",
@@ -415,7 +415,7 @@
     },
     {
       "name": "HarnessErrorDocument",
-      "sha256": "sha256:255e3c8b57aa188ea21a548445577e71f7eb052984096452c9e402162d9e4ded"
+      "sha256": "sha256:1bd889952a59431c2439a14e23b7dc1fd03ce63a4da4cdfa208da25d6f4c1c77"
     },
     {
       "name": "HarnessExecutionBackend",
@@ -487,8 +487,8 @@
     },
     {
       "name": "ZhivexHarness",
-      "sha256": "sha256:76de0209fbf835d1427b6ab2764a919e8e814237a1be7b15c9bc0dc002f8fd6e"
+      "sha256": "sha256:4275565d750dbfd7d6dcaa7182f05d74136db32b057744446de24d6b69fe2061"
     }
   ],
-  "digest": "sha256:0c2cec6bd1dd8de467e8619c18b25e48d56416dec1866ff5a124798525b1a52b"
+  "digest": "sha256:e2ef392ba67e8a07f5d511c0274f8b4171888a1469205f541350fafb0b74f8cb"
 }