@zhivex-ai/harness 1.4.0-rc.8 → 1.4.0

package/dist/verify-historical-migrations.js

@@ -98,6 +98,8 @@ function providerDiagnostic(body, status) {
       reason = "permission";
     else if (["rate_limit_exceeded", "rate_limit_error", "RESOURCE_EXHAUSTED"].includes(code))
       reason = "rate_limit";
+    else if (["UNAVAILABLE", "DEADLINE_EXCEEDED", "ABORTED", "INTERNAL"].includes(code))
+      reason = "server_error";
     else if (["model_not_found", "model_not_available", "NOT_FOUND"].includes(code))
       reason = "model_unavailable";
     else if (["invalid_request_error", "INVALID_ARGUMENT"].includes(code) || status === 400 || status === 422)
@@ -108,6 +110,201 @@ function providerDiagnostic(body, status) {
   }
 }
 
+// src/runtime/provider-transient.ts
+var PROVIDER_STATUS_CATEGORIES = [
+  "ABORTED",
+  "RESOURCE_EXHAUSTED",
+  "UNAVAILABLE",
+  "DEADLINE_EXCEEDED",
+  "INTERNAL",
+  "STREAM_RESET"
+];
+var VERTEX_TRANSIENT_ATTEMPTS = 3;
+var TRANSIENT_HTTP = {
+  408: "DEADLINE_EXCEEDED",
+  409: "ABORTED",
+  425: "UNAVAILABLE",
+  429: "RESOURCE_EXHAUSTED",
+  500: "INTERNAL",
+  502: "UNAVAILABLE",
+  503: "UNAVAILABLE",
+  504: "DEADLINE_EXCEEDED"
+};
+var TRANSIENT_GRPC = {
+  4: "DEADLINE_EXCEEDED",
+  8: "RESOURCE_EXHAUSTED",
+  10: "ABORTED",
+  13: "INTERNAL",
+  14: "UNAVAILABLE"
+};
+var CATEGORY_HTTP = {
+  ABORTED: 409,
+  RESOURCE_EXHAUSTED: 429,
+  UNAVAILABLE: 503,
+  DEADLINE_EXCEEDED: 504,
+  INTERNAL: 500,
+  STREAM_RESET: undefined
+};
+var SYMBOLIC = new Set(["ABORTED", "RESOURCE_EXHAUSTED", "UNAVAILABLE", "DEADLINE_EXCEEDED", "INTERNAL"]);
+var STREAM_RESET_CODES = new Set(["ECONNRESET", "ECONNABORTED", "EPIPE", "ETIMEDOUT", "UND_ERR_SOCKET", "ERR_STREAM_PREMATURE_CLOSE"]);
+var HTTP_IN_MESSAGE = /(?:^|[^\d])(408|409|425|429|500|502|503|504)(?=$|[^\d])/;
+var STREAM_RESET_MESSAGE = /stream reset|RST_STREAM|ECONNRESET|socket hang up|ERR_STREAM_PREMATURE_CLOSE|UND_ERR_SOCKET/i;
+var isProviderStatus = (value) => typeof value === "string" && PROVIDER_STATUS_CATEGORIES.includes(value);
+var httpStatusValue = (value) => typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599 ? value : undefined;
+var definitiveClientStatus = (status) => status !== undefined && status >= 400 && status < 500 && TRANSIENT_HTTP[status] === undefined;
+function readProviderFailureRecord(record, depth = 0) {
+  let retryable = false;
+  let clientError = false;
+  let httpStatus;
+  let providerStatus;
+  const noteHttp = (status) => {
+    if (status === undefined)
+      return;
+    httpStatus ??= status;
+    const category = TRANSIENT_HTTP[status];
+    if (category) {
+      retryable = true;
+      providerStatus ??= category;
+    } else if (status >= 400 && status < 500)
+      clientError = true;
+  };
+  const noteCategory = (category) => {
+    if (!category || clientError)
+      return;
+    retryable = true;
+    providerStatus ??= category;
+    if (httpStatus === undefined)
+      httpStatus = CATEGORY_HTTP[category];
+  };
+  const absorb = (value) => {
+    if (depth >= 2 || !value || typeof value !== "object" || value === record)
+      return;
+    const signals = readProviderFailureRecord(value, depth + 1);
+    noteHttp(signals.httpStatus);
+    noteCategory(signals.providerStatus);
+  };
+  noteHttp(httpStatusValue(record.status) ?? httpStatusValue(record.statusCode) ?? httpStatusValue(record.httpStatusCode));
+  if (typeof record.status === "string" && /^\d{3}$/.test(record.status))
+    noteHttp(Number(record.status));
+  if (typeof record.code === "number" && record.code >= 100 && record.code <= 599)
+    noteHttp(record.code);
+  if (typeof record.code === "number" && record.code >= 0 && record.code <= 16)
+    noteCategory(TRANSIENT_GRPC[record.code]);
+  if (typeof record.code === "string") {
+    if (STREAM_RESET_CODES.has(record.code))
+      noteCategory("STREAM_RESET");
+    else if (SYMBOLIC.has(record.code))
+      noteCategory(record.code);
+  }
+  if (typeof record.status === "string" && SYMBOLIC.has(record.status))
+    noteCategory(record.status);
+  if (isProviderStatus(record.providerStatus))
+    noteCategory(record.providerStatus);
+  if (record.diagnosticCode === "VERTEX_STREAM_TOOL_TRUNCATED" || record.reason === "stream_truncated")
+    noteCategory("STREAM_RESET");
+  if (record.code === "PROVIDER_UNAVAILABLE" && record.retryable === true)
+    retryable = true;
+  const body = record.responseBody ?? record.body;
+  if (!clientError) {
+    if (typeof body === "string")
+      noteCategory(categoryFromBody(body));
+    else
+      absorb(body);
+    absorb(record.error);
+  }
+  if (!retryable && !clientError && typeof record.message === "string") {
+    const match = record.message.match(HTTP_IN_MESSAGE);
+    if (match?.[1])
+      noteHttp(Number(match[1]));
+    else if (STREAM_RESET_MESSAGE.test(record.message))
+      noteCategory("STREAM_RESET");
+  }
+  if (httpStatus !== undefined && definitiveClientStatus(httpStatus))
+    return { retryable: false, httpStatus };
+  return { retryable, ...httpStatus !== undefined ? { httpStatus } : {}, ...providerStatus ? { providerStatus } : {} };
+}
+function categoryFromBody(body) {
+  if (Buffer.byteLength(body) > 8192)
+    return;
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object")
+      return;
+    const detail = parsed.error;
+    const source = detail && typeof detail === "object" ? detail : parsed;
+    return readProviderFailureRecord(source).providerStatus;
+  } catch {
+    return;
+  }
+}
+function classifyProviderFailure(error) {
+  if (error && typeof error === "object") {
+    const top = readProviderFailureRecord(error);
+    if (top.httpStatus !== undefined && definitiveClientStatus(top.httpStatus))
+      return { retryable: false, httpStatus: top.httpStatus };
+  }
+  const seen = new Set;
+  let retryable = false;
+  let httpStatus;
+  let providerStatus;
+  const visit = (current, depth) => {
+    if (!current || typeof current !== "object" || depth > 5 || seen.has(current))
+      return;
+    seen.add(current);
+    const record = current;
+    const signals = readProviderFailureRecord(record);
+    httpStatus ??= signals.httpStatus;
+    providerStatus ??= signals.providerStatus;
+    if (httpStatus !== undefined && providerStatus === undefined)
+      providerStatus = TRANSIENT_HTTP[httpStatus];
+    if (record.retryable === false)
+      return;
+    if (signals.retryable)
+      retryable = true;
+    visit(record.cause, depth + 1);
+    if (record.error && typeof record.error === "object")
+      visit(record.error, depth + 1);
+    if (record.details && typeof record.details === "object")
+      visit(record.details, depth + 1);
+    if (Array.isArray(record.chain))
+      for (const entry of record.chain)
+        visit(entry, depth + 1);
+  };
+  visit(error, 0);
+  if (retryable && httpStatus === undefined && providerStatus)
+    httpStatus = CATEGORY_HTTP[providerStatus];
+  return { retryable, ...httpStatus !== undefined ? { httpStatus } : {}, ...providerStatus ? { providerStatus } : {} };
+}
+function isRetryableProviderFailure(error) {
+  return classifyProviderFailure(error).retryable;
+}
+function transientBackoffMs(attempt, baseMs = 250) {
+  const exponential = Math.min(baseMs * 2 ** Math.max(0, attempt), 1e4);
+  return exponential + Math.floor(Math.random() * exponential);
+}
+var thoughtOnlyText = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return false;
+    const record = parsed;
+    return record.thought === true && Object.keys(record).every((key) => key === "thought" || key === "thoughtSignature");
+  } catch {
+    return false;
+  }
+};
+function isEmptyModelTurn(result) {
+  if (result.finishReason === "content-filter" || result.finishReason === "error")
+    return false;
+  if ((result.images?.length ?? 0) > 0 || (result.audio?.length ?? 0) > 0)
+    return false;
+  const parts = result.messages?.flatMap((message) => message.parts ?? []) ?? [];
+  if (parts.some((part) => part.type === "tool-call" || part.type === "image" || part.type === "audio"))
+    return false;
+  const texts = [result.text ?? "", ...parts.filter((part) => part.type === "text").map((part) => part.text ?? "")];
+  return texts.every((text) => text.trim().length === 0 || thoughtOnlyText(text.trim()));
+}
+
 // src/providers/vertex-auth.ts
 var CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
 function vertexRoute(env) {
@@ -157,13 +354,31 @@ class VertexAuthenticationError extends Error {
     this.name = "VertexAuthenticationError";
   }
 }
-function createVertexModel(model, env, createAuth) {
+function createVertexModel(model, env, createAuth, retry) {
   const route = vertexRoute(env);
   const adapter = createVertex({
     ...route,
     getAccessToken: vertexTokenSource(env, route, createAuth)
   })(model);
-  return wrapLanguageModel2(adapter, [{
+  const attempts = retry?.attempts ?? VERTEX_TRANSIENT_ATTEMPTS;
+  const delayFor = (input) => retry?.delayMs ?? ((attempt) => input.retryBackoffMs === 0 ? 0 : transientBackoffMs(attempt, input.retryBackoffMs ?? 250));
+  const generate = async (input) => withVertexAttempts(input.abortSignal, vertexAttemptBudget(input, attempts), delayFor(input), async () => {
+    try {
+      return await adapter.generate({ ...input, maxRetries: 0 });
+    } catch (error) {
+      throw safeVertexError(error);
+    }
+  }, (result) => !isEmptyModelTurn(result));
+  const innerStream = adapter.stream?.bind(adapter);
+  const retrying = innerStream ? {
+    ...adapter,
+    generate,
+    async stream(input) {
+      const events = await withVertexAttempts(input.abortSignal, vertexAttemptBudget(input, attempts), delayFor(input), () => collectVertexStream(() => innerStream({ ...input, maxRetries: 0 })), (events2) => !isEmptyVertexStream(events2));
+      return replayVertexStream(events);
+    }
+  } : { ...adapter, generate };
+  return wrapLanguageModel2(retrying, [{
     name: "harness-vertex-sanitized-errors",
     async wrapGenerate(_context, next) {
       try {
@@ -189,19 +404,109 @@ function createVertexModel(model, env, createAuth) {
     }
   }]);
 }
+async function collectVertexStream(next) {
+  let stream;
+  try {
+    stream = await next();
+  } catch (error) {
+    throw safeVertexError(error);
+  }
+  const events = [];
+  try {
+    for await (const event of stream) {
+      if (event.type === "error")
+        throw safeVertexError(event.error);
+      events.push(event);
+    }
+  } catch (error) {
+    throw error instanceof Error && error.message.startsWith("Vertex request failed.") ? error : safeVertexError(error);
+  }
+  return events;
+}
+function isEmptyVertexStream(events) {
+  let text = "";
+  let finishReason;
+  let tools = false;
+  let media = false;
+  for (const event of events) {
+    if (event.type === "text-delta")
+      text += event.textDelta;
+    else if (event.type === "tool-call" || event.type === "tool-approval-request")
+      tools = true;
+    else if (event.type === "image-generation")
+      media = true;
+    else if (event.type === "finish")
+      finishReason = event.finishReason;
+  }
+  return isEmptyModelTurn({
+    text,
+    finishReason,
+    ...tools ? { messages: [{ parts: [{ type: "tool-call" }] }] } : {},
+    ...media ? { images: [{}] } : {}
+  });
+}
+function replayVertexStream(events) {
+  return async function* () {
+    yield* events;
+  }();
+}
+async function withVertexAttempts(abortSignal, attempts, delayMs, run, accept) {
+  let last;
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (abortSignal?.aborted)
+      throw new DOMException("Vertex request cancelled.", "AbortError");
+    try {
+      const value = await run();
+      if (accept(value) || attempt === attempts - 1)
+        return value;
+      last = value;
+    } catch (error) {
+      const safe = error instanceof Error && (error.name === "AbortError" || error.message.startsWith("Vertex request failed.")) ? error : safeVertexError(error);
+      if (safe.name === "AbortError" || abortSignal?.aborted || attempt === attempts - 1 || !isRetryableProviderFailure(safe))
+        throw safe;
+    }
+    await sleep(delayMs(attempt));
+  }
+  return last;
+}
+var sleep = (ms) => ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+function vertexAttemptBudget(input, fallback) {
+  const requested = [
+    typeof input.maxProviderRequests === "number" ? input.maxProviderRequests : undefined,
+    typeof input.maxRetries === "number" ? input.maxRetries + 1 : undefined
+  ].filter((value) => value !== undefined);
+  if (requested.length === 0)
+    return Math.max(1, fallback);
+  return Math.max(1, Math.min(...requested));
+}
 function safeVertexError(error) {
   if (error instanceof VertexAuthenticationError)
     return error;
   const record = error && typeof error === "object" ? error : {};
   if (record.name === "AbortError")
     return new DOMException("Vertex request cancelled.", "AbortError");
-  const status = typeof record.status === "number" && Number.isInteger(record.status) && record.status >= 100 && record.status <= 599 ? record.status : undefined;
+  const failure = classifyProviderFailure(error);
+  const body = providerBody(record.responseBody) ?? providerBody(record.body);
+  const preserved = providerDiagnosticSchema.safeParse(record.provider);
+  const provider = body !== undefined ? providerDiagnostic(body, failure.httpStatus) : preserved.success ? preserved.data : providerDiagnostic(undefined, failure.httpStatus);
   return Object.assign(new Error("Vertex request failed. Check the sanitized provider diagnosis."), {
-    ...status ? { status } : {},
-    provider: providerDiagnostic(record.responseBody ?? record.body, status),
-    retryable: record.retryable === true
+    ...failure.httpStatus !== undefined ? { status: failure.httpStatus } : {},
+    ...failure.providerStatus ? { providerStatus: failure.providerStatus } : {},
+    provider,
+    retryable: failure.retryable
   });
 }
+function providerBody(value) {
+  if (typeof value === "string")
+    return value;
+  if (!value || typeof value !== "object")
+    return;
+  try {
+    return JSON.stringify(value).slice(0, 8192);
+  } catch {
+    return;
+  }
+}
 
 // src/providers/qwen-hosted-policy.ts
 import { wrapLanguageModel as wrapLanguageModel3 } from "@zhivex-ai/core";
@@ -1923,13 +2228,6 @@ class HarnessExecutionError extends HarnessError {
     this.name = "HarnessExecutionError";
   }
 }
-var numericStatuses = (error) => {
-  if (!error || typeof error !== "object")
-    return;
-  const record = error;
-  const values = [record.status, record.statusCode].filter((value) => typeof value === "number" && Number.isSafeInteger(value));
-  return values.length > 0 ? values : undefined;
-};
 var normalizeHarnessError = (error) => {
   const diagnostic = providerStreamDiagnostic(error);
   if (diagnostic)
@@ -1937,9 +2235,16 @@ var normalizeHarnessError = (error) => {
   if (error instanceof HarnessError)
     return error;
   const message = error instanceof Error ? error.message : "Harness execution failed.";
-  const statuses = numericStatuses(error) ?? [];
-  if (statuses.some((status) => status === 429 || status >= 500 && status <= 599)) {
-    return new HarnessProviderError(message, { cause: error, retryable: true });
+  const failure = classifyProviderFailure(error);
+  if (failure.retryable) {
+    const record = error && typeof error === "object" ? error : {};
+    const body = typeof record.responseBody === "string" ? record.responseBody : typeof record.body === "string" ? record.body : undefined;
+    const providerError = new HarnessProviderError("Provider request failed.", { cause: error, retryable: true });
+    return Object.assign(providerError, {
+      ...failure.httpStatus !== undefined ? { status: failure.httpStatus } : {},
+      ...failure.providerStatus ? { providerStatus: failure.providerStatus } : {},
+      provider: providerDiagnostic(body, failure.httpStatus)
+    });
   }
   const name = error && typeof error === "object" && typeof error.name === "string" ? error.name : "";
   const code = error && typeof error === "object" && typeof error.code === "string" ? error.code : "";
@@ -14397,7 +14702,7 @@ import { z as z34 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.4.0-rc.8",
+  version: "1.4.0",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",

package/dist/zhx.js

@@ -2,7 +2,7 @@
 import {
   HARNESS_VERSION,
   shortCliHelp
-} from "./cli-entry-qav71mxw.js";
+} from "./cli-entry-w0hterjs.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -16,6 +16,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-3bzvq594.js");
+  const { runCli } = await import("./cli-2h37qyvg.js");
   await runCli(argv);
 }

package/docs/CLI.md

@@ -108,7 +108,7 @@ An empty draft shows a muted task hint. Shortcuts sit below the complete draft,
 adapt to terminal width, and give way to command and history searches. Sending or
 cancelling removes these editor hints before model output or approval questions.
 
-The console opens with the Zhivex logo and a compact welcome panel. Project/model context sits beside the logo when space permits. Before each task, the composer shows the model, approval mode, pending approval state and attachment count. Long labels are bounded to the terminal width; full configuration remains available through `/status`. Type `/` to open the command menu; keep typing to search names and descriptions, use Up/Down to select, Tab to insert, and Enter to submit. Escape dismisses the menu. Enter on a partial command inserts its selection; a separate Enter submits it, including approval commands. Only commands supported by the connected runtime appear. Narrow terminals use a compact logo; `NO_COLOR` disables logo color. The console completes slash-command prefixes with Tab. `/paste` captures a bounded
+The console opens with the Zhivex logo and a compact welcome panel. Project/model context sits beside the logo when space permits. Before each task, the composer shows the model, approval mode, pending approval state and attachment count. Long labels are bounded to the terminal width; full configuration remains available through `/status`. Type `/` to open the command menu; keep typing to search names and descriptions, use Up/Down to select, Tab to insert, and Enter to submit. Escape dismisses the menu. Enter on a partial command inserts its selection; a separate Enter submits it, including approval commands. Only commands supported by the connected runtime appear. Narrow terminals use a compact logo; `NO_COLOR` disables logo color. `zhivex-code` shows the logo only on the first welcome of a new session, when stderr is a terminal, `TERM` is not `dumb`, and the size is at least 48 columns by 24 rows; otherwise it shows `( Z )`, and a restored session shows no logo. The console completes slash-command prefixes with Tab. `/paste` captures a bounded
 multiline draft: finish with `.end` on a separate line, review the preview, then type
 `send` at the separate confirmation prompt. Slash commands inside the draft remain
 literal model input. Use this mode when the terminal does not support bracketed

package/docs/CODE_RELEASE.md

@@ -1,6 +1,43 @@
 # Code release procedure
 
-## Current RC preparation: 2026-10-08
+## Current stable preparation: 2026-10-09
+
+This checkout prepares Code `0.3.0`, pinned exactly to Harness `1.4.0`, for npm
+`latest`. Published Code `0.2.0` and Harness `1.3.0` on `latest` remain
+unchanged. Published npm `next` is Code `0.3.0-rc.8` and Harness `1.4.0-rc.8`.
+
+Annotated tags `v1.4.0-rc.8` and `code-v0.3.0-rc.8` both resolve to
+`5bba06c86fc82b34b67cec607053948f8e00d0d1`. Against that commit, engine runtime
+source under `src/` is identical. This Code package is not: main includes the
+shared review screen ([PR201](https://github.com/Zhivex/zhivex-harness/pull/201)),
+the status line, summary and 48×24 logo
+([PR210](https://github.com/Zhivex/zhivex-harness/pull/210)), and the public
+README ([PR200](https://github.com/Zhivex/zhivex-harness/pull/200)). Web
+([PR211](https://github.com/Zhivex/zhivex-harness/pull/211)) and desktop
+([PR203](https://github.com/Zhivex/zhivex-harness/pull/203),
+[PR211](https://github.com/Zhivex/zhivex-harness/pull/211)) are also not identical
+to that tag. The authoritative file-level comparison is in the
+[Harness release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md).
+
+The Code manifest dist-tag is `latest` because `0.3.0` is a stable version.
+Desktop stays private alpha with the same engine binding. SDK pins, approval and
+transport protections, and provider/API tiers stay as they are on main. The
+RC.8 preparation snapshot below remains historical; its evidence and approvals
+do not certify or authorize `0.3.0`.
+
+This preparation creates no tags, paid calls, campaign dispatch or publication.
+After review and user integration, require all four successful exact-main workflows
+(`ci.yml`, `codeql.yml`, `code-journey.yml`, `web.yml`) and direct-main CodeQL.
+New explicit campaign/publication authority is required before any Harness
+`v1.4.0` or Code `code-v0.3.0` tag/dispatch. Harness must first pass its
+unchanged protected exact-artifact, OCI, live and representative gates and actual
+registry integrity/provenance verification. Code's protected OIDC workflow then
+uses the matching reviewed SHA with `channel=latest`, `mode=oidc` and explicit
+confirmation, resolving the actual published Harness dependency without overrides.
+Retained-artifact terminal/web, four-manager acceptance and registry bytes with
+source-bound provenance remain mandatory. Preserve published `next` and all history.
+
+## Historical RC.8 preparation: 2026-10-08
 
 This checkout prepares Code `0.3.0-rc.8`, pinned exactly to Harness
 `1.4.0-rc.8`, for npm `next`. The matched engine includes the reviewed

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets candidate `1.4.0-rc.8`, pending publication to npm `next`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0.
+This guide targets stable `1.4.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0 until that publication.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.0-rc.8
+npm install -g @zhivex-ai/harness@1.4.0
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.4.0-rc.8
+bun add --global @zhivex-ai/harness@1.4.0
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.4.0-rc.8 --version
-bunx @zhivex-ai/harness@1.4.0-rc.8 --help
-bunx @zhivex-ai/harness@1.4.0-rc.8 doctor
+bunx @zhivex-ai/harness@1.4.0 --version
+bunx @zhivex-ai/harness@1.4.0 --help
+bunx @zhivex-ai/harness@1.4.0 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/PROJECT_MEMORY.md

@@ -7,7 +7,7 @@ generated automatically; hosts may submit a suggestion for operator review.
 
 ## CLI
 
-Use `zhx` or `zhivex-code` with Harness 1.4.0-rc.8 (Code 0.3.0-rc.8), pending publication. Commands
+Use `zhx` or `zhivex-code` with Harness 1.4.0 (Code 0.3.0), pending publication. Commands
 print bounded JSON, including the selected workspace/scope hashes. Quote content
 as one argument. Memory commands do not start a model or read credentials.
 

package/evaluations/representative-assembly-matrix.json

@@ -61,7 +61,8 @@
     "v1.4.0-rc.5",
     "v1.4.0-rc.6",
     "v1.4.0-rc.7",
-    "v1.4.0-rc.8"
+    "v1.4.0-rc.8",
+    "v1.4.0"
   ],
   "expectedModels": [
     {
@@ -543,6 +544,14 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.4.0",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/examples/README.md

@@ -1,22 +1,22 @@
-# Examples for Zhivex Harness 1.3
+# Examples for Zhivex Harness 1.4
 
 ## Isolated Bun installation
 
-Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected RC publication, this installs the 1.4.0-rc.8 candidate artifact in a temporary consumer, without building the source checkout or changing global tools:
+Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected stable publication, this installs the 1.4.0 artifact in a temporary consumer, without building the source checkout or changing global tools:
 
 ```bash
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.4.0-rc.8
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.4.0
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json
 ```
 
-Version must print `1.4.0-rc.8`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
+Version must print `1.4.0`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
 
-To continue in your actual project, use the [global installation and credential setup](../README.md#installation), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).
+To continue in your actual project, use the [global installation and credential setup](../README.md#quick-start), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).
 
 ## Configuration and change examples
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.4.0-rc.8",
+  "version": "1.4.0",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",