@zhivex-ai/harness 1.4.0 → 1.4.1

package/dist/zhx.js

@@ -1,13 +1,38 @@
 #!/usr/bin/env node
 import {
   HARNESS_VERSION,
+  NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-w0hterjs.js";
+} from "./cli-entry-3s63zn4w.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
 
+// src/cli/node-engine.ts
+var nodeEngineError = (version, range) => {
+  const minimumMatch = /^>=(\d+)\.(\d+)\.(\d+)$/.exec(range.trim());
+  const actualMatch = /^(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  const failure = `Node.js ${version} does not satisfy the package engine requirement (${range}).
+`;
+  if (!minimumMatch || !actualMatch)
+    return failure;
+  for (let index = 1;index <= 3; index += 1) {
+    const actual = Number(actualMatch[index]);
+    const minimum = Number(minimumMatch[index]);
+    if (actual !== minimum)
+      return actual > minimum ? undefined : failure;
+  }
+  return;
+};
+
 // src/cli-entry.ts
+if (!process.versions.bun) {
+  const engineError = nodeEngineError(process.versions.node, NODE_ENGINE_RANGE);
+  if (engineError) {
+    process.stderr.write(engineError);
+    process.exit(1);
+  }
+}
 var argv = process.argv.slice(2);
 if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${HARNESS_VERSION}
@@ -16,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-2h37qyvg.js");
+  const { runCli } = await import("./cli-1cf4dcnj.js");
   await runCli(argv);
 }

package/docs/AUDIT_PACK.md

@@ -0,0 +1,99 @@
+# Audit pack
+
+Experimental operator export. It is not part of the stable root API. Import it
+from `@zhivex-ai/harness/audit`. The commands are `export-audit` and
+`verify-audit` on both `zhx` and `zhivex-code`.
+
+```sh
+export ZHIVEX_AUDIT_SIGNING_KEY="$(openssl rand -base64 32)"
+zhx export-audit <task-id> --out ./audit-pack
+zhx verify-audit --out ./audit-pack
+```
+
+`--signing-key-file <path>` overrides the environment variable. The key is 32 to
+4096 bytes. A single trailing newline in the file is ignored. The key is not
+written into the pack. `--out` and `--signing-key-file` are experimental flags
+and are not members of the stable `CLI_OPTION_NAMES` tuple.
+
+## What one bundle contains
+
+The subject is a run id, or a guided task id. A run id produces one flat
+directory. A guided task id produces one directory whose member runs live under
+`runs/<id>/`. A task with a single recorded run stays flat.
+
+| File | Source |
+| --- | --- |
+| `manifest.json` | Hashes and the HMAC. Not hashed inside itself. |
+| `governance-report.json` | `exportHarnessGovernanceReport`. Pseudonymous tree projection. |
+| `approvals.json` | Every `approvalDecisionViews` page, up to the governance report's 512-record ceiling, then the same email and common-token redaction policy used by the activity journal. |
+| `policy-decisions.json` | Activity events parsed with `harnessPolicyDecisionEventSchema`. |
+| `redaction.jsonl` | The durable redacted activity journal for that run. This is not a second redactor and not a list of removed tokens. |
+| `usage-ledger.json` | `inspectUsageLedger` on the run metadata, plus `UsageLedger.summary` when the operations database can be opened. |
+
+The governance report already walks child runs. Approval, policy, redaction and
+usage files describe the selected run, or each run on the task account. Those
+files and the governance report are taken from one captured snapshot of each
+selected run and its journal. If that snapshot, or the task account that named
+the runs, changes before the manifest is signed, export fails with
+`AUDIT_PACK_STATE_CHANGED` and writes nothing. Export does not call a model,
+execute a tool, or rewrite run state. Opening the usage ledger uses the existing
+`UsageLedger.open` path, which ensures its transport tables exist and does not
+append call rows. Estimates are not invoices.
+
+Each payload file is at most 8 MiB. The manifest plus every payload file is at
+most 32 MiB. Verification uses the same total, so a directory that exports can
+be verified. A larger directory fails with `AUDIT_PACK_LIMIT`.
+
+Pass `--session <sessionId>` to include the retained activity journal. Without
+it, the redaction log and policy file say `unavailable`. Retention and truncation
+stay explicit. Session ids are not copied into the JSONL; the governance report
+keeps its session pseudonym.
+
+The first JSONL line is a `zhivex-redaction-log` header. Later lines are
+`zhivex-redacted-activity` records: sequence, run id, optional time, and the
+stored activity object.
+
+## Manifest and HMAC
+
+`manifest.json` is schema 1, kind `zhivex-harness-audit-pack`, integrity
+`hmac-sha256`. `files` lists each payload path, byte length, and SHA-256.
+Verification requires the directory to contain exactly those files plus
+`manifest.json`. Paths stay inside the directory. Symlinks are rejected.
+Unknown files, missing files, and hash mismatches fail.
+
+The signature covers the canonical form of the manifest with the `signature`
+field removed:
+
+- arrays keep their order
+- object keys are sorted lexicographically by UTF-16 code unit
+- `undefined` object entries are omitted
+- strings and numbers use `JSON.stringify`
+- there is no whitespace
+
+`signature.keyId` is the first 16 hexadecimal characters of SHA-256 over the
+raw key bytes. `signature.value` is standard base64 of HMAC-SHA256 over the
+canonical UTF-8 bytes. Verification uses a constant-time compare. A different
+key fails with `AUDIT_PACK_KEY_MISMATCH` when the key id does not match, and
+`AUDIT_PACK_SIGNATURE_INVALID` when the key id matches but the MAC does not.
+
+HMAC is the mechanism in this repository that an operator can configure without
+a new key format. Change envelopes already bind SHA-256 digests and leave
+producer authenticity unverified. Desktop update manifests use Ed25519 because
+a publisher and a verifier must not share a secret. An audit pack is an
+operator seal of local records: the same party exports and verifies, or shares
+the key out of band. Anyone who has the key can produce a pack that verifies.
+This is integrity against modification by someone who does not have the key. It
+is not a third-party attestation and it does not prove who ran the task.
+
+## Commands
+
+```sh
+zhx export-audit <task-id> --out <directory> [--session <id>] [--json]
+zhx verify-audit --out <directory> [--json]
+```
+
+`zhivex-code` accepts the same two commands. Locator flags match other state
+commands. `--json` prints the manifest or the verification document. The
+directory must not already exist for export. Verification reads the directory
+and the signing key only. It does not resolve provider, store, or budget
+configuration, and it does not open the workspace.

package/docs/AZURE_OPENAI.md

@@ -0,0 +1,53 @@
+# Azure OpenAI (provisional)
+
+Azure OpenAI is a separate provider (`azure-openai`). It does not reuse
+`OPENAI_API_KEY` or `OPENAI_BASE_URL`. No live Harness certification has been
+run for this route. Prices are not copied from the public OpenAI catalog.
+
+Published `@zhivex-ai/azure-openai@0.7.8` is the adapter pinned by this tree.
+It requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+Language models report Tier A. Hosted tool gates such as tool search follow
+the model id (`gpt-5.4` and `gpt-6-astra` in this adapter). An opaque
+deployment name does not receive those gates unless a deployment map names
+the base model.
+
+Published 0.7.8 accepts a deployments map and a token provider for Microsoft
+Entra ID. This route still authenticates with an API key and does not pass a
+token provider.
+
+## Configuration
+
+Set `AZURE_OPENAI_ENDPOINT` to an https URL with no user, password, query, or
+fragment. Set `AZURE_OPENAI_API_KEY` in the environment, or store it in the CLI
+keychain or a temporary session. The endpoint is required with a managed key.
+It is not treated as an override that blocks the keychain.
+
+`AZURE_OPENAI_API_VERSION` is optional. When it is set, requests use
+`/openai/deployments/{deployment}/chat/completions?api-version=...` and the
+deployment name is not also sent as `model`. When it is omitted, requests use
+`/openai/v1/chat/completions` and the body includes the model id.
+
+`AZURE_OPENAI_DEPLOYMENTS` is optional JSON, at most 8192 characters and 32
+entries. Each entry is `"name": "gpt-5.4"` or `"name": { "model": "gpt-5.4" }`.
+Deployment names and model ids are restricted to simple identifier characters.
+Harness passes the map to the adapter. Published 0.7.8 uses the base model for
+capabilities and request shape while the request still uses the deployment
+name. Harness also overlays those capability flags.
+
+The published adapter also reads omitted endpoint, key, and API version from
+`process.env`. Harness passes the endpoint and key from the selected
+environment. When that environment omits the API version, Harness hides
+`process.env.AZURE_OPENAI_API_VERSION` for the adapter constructor so a host
+value cannot change the route.
+
+## Durable execution
+
+Endpoint, API version, and the deployments document are hashed into the durable
+transport binding. The API key is not. Unconfigured Azure OpenAI does not
+change existing provider transport bindings.
+
+Provider errors are replaced with a generic message. Numeric status and the
+retryable flag are kept. Response bodies and the API key are dropped.
+
+Deterministic tests stub `fetch`. They do not contact Azure and they do not
+check account access.

package/docs/BEDROCK.md

@@ -0,0 +1,56 @@
+# Amazon Bedrock (provisional)
+
+Bedrock is a separate provider (`bedrock`). It is not enabled by the Anthropic
+direct API route. No live Harness certification has been run for this route.
+Pricing and context limits are not inferred.
+
+Published `@zhivex-ai/bedrock@2.0.7` is the adapter pinned by this tree. It
+requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+This integration reports the installed adapter's labels and does not relabel
+them.
+
+## Runtimes
+
+`BEDROCK_RUNTIME` is optional. An empty value or `converse` selects the Converse
+API. `openai` selects the OpenAI-compatible runtime. Any other value is rejected.
+
+Converse reports Tier B on the published 2.0.7 adapter: reasoning is supported
+and `toolChoiceNone` is true. Approval requests stay false on that runtime.
+Harness reports that installed label.
+
+The OpenAI-compatible runtime reports Tier A, including approval requests.
+It needs `BEDROCK_API_KEY` or `AWS_BEARER_TOKEN_BEDROCK`, plus an https
+`BEDROCK_OPENAI_BASE_URL` with no user, password, or fragment. Harness does
+not read `OPENAI_API_KEY` or `OPENAI_BASE_URL` for this route.
+
+## Credentials
+
+Converse uses the AWS SDK default credential chain: instance roles, SSO,
+shared config, and environment credentials. Set `AWS_REGION` or
+`AWS_DEFAULT_REGION` to a region such as `us-east-1`. `AWS_PROFILE` is part of
+the transport fingerprint. Published 2.0.7 accepts a profile and static
+credentials on the adapter. This route does not pass `AWS_PROFILE`. When
+`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are both set, and no bearer
+token is set, Converse uses that static pair and an optional
+`AWS_SESSION_TOKEN`. Otherwise the AWS SDK default chain applies. Harness
+does not call AWS while checking that the route is configured. Incomplete
+settings, such as a profile or runtime with no region or OpenAI route, stay
+out of the durable transport fingerprint.
+
+An explicit `AWS_BEARER_TOKEN_BEDROCK` in the Harness environment selects bearer
+auth for Converse and skips the default chain. The CLI does not store a Converse
+API key. The OpenAI-compatible runtime can use a keychain or temporary
+`BEDROCK_API_KEY` together with the required base URL.
+
+## Durable execution
+
+Region, default region, profile, runtime, and the OpenAI base URL are hashed
+into the durable transport binding. API keys and bearer tokens are not.
+Unconfigured Bedrock does not change existing provider transport bindings.
+
+Provider errors are replaced with a generic message. Numeric status and the
+retryable flag are kept. Response bodies, account identifiers, and credentials
+are dropped.
+
+Deterministic tests mock the AWS client and the OpenAI-compatible HTTP call.
+They are not evidence of model access, IAM, or a live region.

package/docs/CLI.md

@@ -826,6 +826,21 @@ expiry are checked separately. Patch bytes and producer authenticity remain
 unverified. No envelope v1 fields are added. Concurrent source changes and hard
 capacity limits reject export; bounded tree/history truncation is reported.
 
+### Audit pack (Experimental)
+
+`zhx export-audit <task-id> --out <directory>` writes one signed directory for a
+run, or for every run recorded on a guided task account. `zhx verify-audit --out <directory>`
+recomputes the file hashes and the HMAC. It does not resolve provider, store, or
+budget configuration. Both commands also accept the workspace locator options
+(`--workspace`, `--state-dir`, `--store`, `--tenant`, `--user`, `--namespace`)
+and `--json`. Export also accepts `--session <sessionId>` and is the command
+that resolves those options.
+
+`--out` and `--signing-key-file` are experimental flags for these commands. They
+are not part of the stable option list. The signing key comes from
+`--signing-key-file` or `ZHIVEX_AUDIT_SIGNING_KEY` and is never written into the
+pack. See [Audit pack](AUDIT_PACK.md).
+
 ## Experimental project memory (unreleased)
 
 `zhx memory` supports `remember`, `list`, `read`, `update`, `forget`, `suggest`, `accept`, `context`, `clear`, `enable` and `disable`. Content is one quoted argument. Updates, acceptance and forgetting require the current revision. `--source` supplies a provenance label; `--no-memory` disables curated retrieval and SDK memory loading/capture for a local run/chat/resume invocation. Existing workspace/tenant/user/namespace flags select scope. See [Project memory](PROJECT_MEMORY.md) for bounds, review, deletion semantics and next-release pairing.

package/docs/CLIENT_PROTOCOL.md

@@ -91,8 +91,141 @@ or a replacement for the engine's signed approval validation.
 | session.rename | projectId, sessionId, expectedRevision, idempotencyKey, title | session | REVISION_CONFLICT |
 | run.start | projectId, sessionId, expectedRevision, idempotencyKey, prompt | run | INVALID_STATE |
 | run.get | projectId, sessionId, runId | run | NOT_FOUND |
+| task.get | projectId, sessionId, runId, projectionVersion: 1 | task | VERSION_UNSUPPORTED / NOT_FOUND |
 | approval.resolve | projectId, sessionId, runId, expectedRevision, idempotencyKey, decisions | run | APPROVAL_MISMATCH |
 | run.cancel | projectId, sessionId, runId, expectedRevision, idempotencyKey | run | REVISION_CONFLICT |
+
+## Task projection v1 (HAR-HU-73)
+
+Negotiate `task.get` and `task.projection.v1` before using this additive read.
+Protocol major 1 and all legacy commands keep their meaning. Older hosts without
+the capability cannot provide this projection; clients must show it as unavailable.
+The host must already have a task contract and a session binding for its runs.
+This command creates neither a task nor a budget and does not provide a new execution
+or acceptance API. CODE-05 presentation remains separate.
+
+```ts
+import { reduceHarnessTaskProjection } from '@zhivex-ai/harness/protocol';
+
+const hello = adapter.negotiate([1]);
+if (!hello.ok || !hello.capabilities.includes('task.projection.v1')) {
+  throw new Error('Task projection unavailable');
+}
+const scope = { connectionId: hello.connectionId, projectId: hello.projectId,
+  sessionId, runId }; // IDs selected from this host's session index.
+const response = await adapter.dispatch({ protocolVersion: 1, requestId: 'task-read-1',
+  connectionId: scope.connectionId,
+  command: { method: 'task.get', projectId: scope.projectId, sessionId, runId,
+    projectionVersion: 1 } });
+if (response.ok && response.data.kind === 'task') {
+  const view = reduceHarnessTaskProjection(null, response.data.projection, scope);
+  // Display view.snapshot as untrusted text. This helper never executes anything.
+}
+```
+
+The same request uses `/command` on the existing authenticated local service.
+Reads remain available while admission is busy or paused. The host checks the full
+task-account run set against the selected session before reading run journals or
+artifacts; mixed-session accounts fail closed. An older requested run identifies
+the task, but `observedRunId` and `historicalRequest` explicitly identify its latest
+recorded run. Missing runs never turn an earlier delivery into the current result.
+
+The strict DTO carries:
+
+- Contract revision/digest, retained operator objective with provenance, run revision
+  and durable execution status. No provider response or hidden reasoning is included.
+- Observed and delivered snapshot digests, contract path labels, and current/stale/
+  missing correspondence. No arbitrary file path or artifact-content request exists.
+  Artifact references stay under the same project/session/run read boundary.
+- Checks reconciled against the current contract, exact native bytes and completed
+  tool journal. `structure: verified` is deterministic evidence only; semantic review
+  stays `pending` and final acceptance stays `not_recorded`. Human requirements retain
+  their canonical `pending` state. Execution completion is never human acceptance.
+- Authoritative confirmed/reserved/unknown token quantities, remaining allowance,
+  frozen limits and account revision. Reservations are admission estimates, not
+  confirmed consumption; a separate token estimate is not recorded. Monetary
+  confirmed-call estimates, reservations and unknown exposure remain estimates, not
+  invoices. Unknown quantities stay null/unknown, never invented zeros.
+- Read-only/recorded/unknown effect counts and missing-evidence flags. Provider stop
+  remains unconfirmed. Next action explains wait/reconciliation/review/explicit
+  continuation, preserves contract/receipts/budget/effects and never grants execution
+  authority or automatic replay. A persisted running status alone does not prove a
+  live worker; uncertain finalization requires reconciliation.
+
+Genuine legacy contracts without a task account show `legacy_not_enabled` and null
+budget values. An existing account with a missing binding, an unreadable bound
+account, incomplete backup, or conflicting identity is an error, not legacy mode.
+HAR55/56 acceptance, HAR58 evidence principles and HAR70/71/72 ledgers/receipts remain
+the authority; this DTO stores no alternate ledger or acceptance state.
+
+Snapshots are derived on demand and revalidated before publication. The host bounds
+the serialized DTO to 64 KiB, each display string to 2,048 UTF-16 code units (with an
+explicit truncation flag), check/review lists to 32 and contract path labels to 256.
+Oversized evidence fails closed. Only allowlisted fields leave the host; roots,
+known secrets and credential patterns are redacted before publication. In-process
+hosts supply `taskProjectionSensitiveValues`; the local service includes its token,
+configured sensitive values and relevant credential environment values. Redaction
+does not make arbitrary workspace text trusted or HTML-safe.
+
+### Replay and reconnection
+
+`sequence` is assigned at read admission within `connectionId`, not at completion.
+The pure browser-compatible reducer only replaces a snapshot in the caller's
+negotiated connection/project/session/run scope. Duplicate and older responses are
+ignored; conflicting duplicates, unsupported versions and wrong epochs request a
+fresh read. It never adopts a connection ID from an incoming response.
+
+Existing activity events are invalidations, not task snapshots or instructions to
+execute. After a relevant page, read `task.get` again. A repeated/out-of-order event
+may cause another harmless read; it cannot recreate effects. When `/events` reports
+`cursorExpired`, discard assumptions derived from missing history and obtain a new
+task snapshot. After service restart, negotiate again, set the expected epoch and
+read durable state; never replay mutations or accept old-epoch snapshots. This is
+snapshot convergence, not a new event store, streaming protocol or delivery guarantee.
+Callers should coalesce refreshes and retry a changing snapshot with a bounded policy.
+
+### Finite task errors
+
+Task-read errors add `taskDiagnostic` to the existing error envelope, with a finite
+cause, `impact: projection_unavailable`, and the action below. Raw exception text,
+paths, provider payloads and journals are excluded. Malformed command shapes retain
+the existing `INVALID_REQUEST` envelope. Unsupported versions never execute work.
+
+| Cause | Client code | Safe action |
+| --- | --- | --- |
+| UNSUPPORTED_VERSION | VERSION_UNSUPPORTED | review_configuration |
+| OUT_OF_SCOPE | NOT_FOUND | review_configuration |
+| UNSUPPORTED_HOST / CONTRACT_UNAVAILABLE | INVALID_STATE | review_configuration |
+| EVIDENCE_UNAVAILABLE | INVALID_STATE | reconcile |
+| SNAPSHOT_CHANGED | REVISION_CONFLICT | retry_read |
+| PAYLOAD_LIMIT | CAPACITY_EXCEEDED | review_configuration |
+
+Inside a successful projection, terminal failure/cancellation/timeout and incomplete
+evidence have separate finite diagnostics with `acceptance_not_established` impact.
+No diagnostic recommends replaying an uncertain operation. This cut supports one
+trusted native workspace/SQLite writer and sequential host handoff only. OCI task
+projections, multiagent scope, new document/web adapters and final semantic/human
+acceptance are unsupported; legacy execution APIs are unchanged.
+
+### Reproducible installed consumer
+
+Build and pack Harness and Code from the same clean candidate following their
+normal build instructions. The existing HAR75 installer accepts an optional sixth
+argument selecting the HAR73 profile; it freezes/rechecks consumer, manifest and
+tarball hashes and verifies Code/service share the installed engine:
+
+```sh
+node scripts/task-recovery-lab-installed.mjs /tmp/harness.tgz /tmp/code.tgz \
+  /absolute/path/to/node /tmp/projection-node 90000 projection
+```
+
+Repeat with supported Node 22/24 and Bun. `evaluations/task-projection.json` fixes
+the reused HAR75 fixture and ten consumer scenarios: version negotiation, readonly
+snapshot, redaction, duplicate/out-of-order responses, artifact scope, expired cursor,
+paused admission, fresh-epoch restart, artifact drift and legacy budget. Source
+regressions additionally exercise corrupted/missing bindings and runs, changing
+snapshots, read admission races, active mutations and payload limits. These are offline
+contract tests, not CODE-05 UI acceptance, live-model quality or an external pilot.
 | checkpoint.list | projectId, sessionId | checkpoints | NOT_FOUND |
 | checkpoint.inspect | projectId, sessionId, checkpointId | checkpoint | NOT_FOUND |
 | checkpoint.capture | projectId, sessionId, expectedRevision, idempotencyKey, turnId, paths | checkpoint | EXECUTION_FAILED |
@@ -273,3 +406,48 @@ It omits command argv, repository output and arbitrary tool payloads.
 or human acceptance. Existing status/exit-code and schema-version contracts remain
 unchanged. Code inspection/export derives the same safe projection from completed
 tool-journal entries; the engine inspection API signature is unchanged.
+
+
+## Task controls (CODE-HU-05, experimental)
+
+Negotiate `task.control.v1` and each command before showing mutation controls.
+The strict command schema remains protocol v1. The host creates the contract;
+clients cannot supply a contract, receipt, budget ledger or execution grant.
+
+| Method | Additional input | Result |
+| --- | --- | --- |
+| `task.start` | session, expectedRevision, idempotencyKey, bounded brief with goal/paths/checks/constraints and explicit input/output/total token limits | run |
+| `task.review` | session, run | taskReview |
+| `task.keep` | session, run, reviewId, idempotencyKey | task + humanDecision |
+| `task.revise` | same review binding + correction (1–500 characters) | task + humanDecision |
+| `task.continue` | same review binding + prompt (1–2000 characters) | run |
+
+A taskReview contains a redacted bounded Git diff, fresh projection, allowed
+actions, a `complete` flag, operator-decision status and a five-minute, one-use host token. Tokens
+bind connection, session, run revision, contract, current snapshot, task budget
+revision and Git status/diff identity. The web host additionally binds tokens
+to its authenticated browser identity and workspace. Missing, consumed, expired
+or changed reviews fail closed. Hidden/truncated review content cannot enable keep. A command retry with the same idempotency key
+returns its existing response; a renderer must read state after a lost response,
+never manufacture another mutation key automatically.
+
+Keep records `humanDecision` with `explicit_operator_review` provenance under
+task-account exclusion and run CAS. It does not change the projection's semantic
+pending/acceptance-not-recorded fields, commit files or imply independent human
+quality measurement. A changed contract or snapshot makes the record stale.
+Revise appends a bounded pending human requirement without executing work.
+Continue uses the original durable account and rechecks the reviewed admission
+tuple inside runtime continuity; it cannot replenish credit or replay uncertainty.
+Ordinary run.start is rejected in sessions retaining governed task authority.
+
+A continuation rejected before admission can have a failed session attempt with
+a host-owned reference to its prior admitted run. Reads resolve this reference
+only within the same session and only when the attempt is absent from the budget
+account. The projection preserves the requested runId, exposes observedRunId and
+historicalRequest, and retains stale/missing checks honestly. New review commands
+must target observedRunId. No budget admission or consumption is fabricated.
+
+Migration: fields and commands are additive and experimental. Existing projection
+version 1, legacy chat and exact tool approvals remain intact. Match host and Code
+builds; unsupported hosts display an unavailable task-control state. See
+[Code web tasks](CODE_WEB_TASKS.md) for native workspace limits and offline QA.

package/docs/CODE_RELEASE.md

@@ -1,6 +1,36 @@
 # Code release procedure
 
-## Current stable preparation: 2026-10-09
+## Pending patch: 2026-10-14
+
+This checkout prepares Code `0.3.1`, pinned exactly to Harness `1.4.1`, for npm
+`latest`. Published Code `0.3.0` and Harness `1.4.0` are the current `latest`
+packages. Published npm `next` is Code `0.3.0-rc.8` and Harness `1.4.0-rc.8`.
+The Vertex transient-failure retry and explicit monetary output caps shipped in
+Code `0.3.0` / Harness `1.4.0`. This patch keeps the narrow composer readable,
+says when you rejected an operation, checks Node before startup, describes
+command reviews as commands, and shows web limits in English. The local browser
+retries reconciliation when a command finishes during reconnect. That patch
+moved Core to 1.33.0 for private-host checks. Unreleased Bedrock and Azure
+OpenAI routes pin Core 1.34.0. Anthropic 0.14.0, OpenAI 0.16.0 and Vertex 1.2.7
+replace the previous adapter pins; Agents, Qwen, Meta and Gemini stay as they
+are on main. Optional `@napi-rs/keyring` is 2.1.1. Approval and transport
+protections and provider/API tiers stay unchanged.
+Desktop stays private alpha with the same engine binding. The 1.4.0 preparation
+below remains historical; its evidence does not certify or authorize `0.3.1`.
+
+This preparation creates no tags, paid calls, campaign dispatch or publication.
+After review and user integration, require all four successful exact-main workflows
+(`ci.yml`, `codeql.yml`, `code-journey.yml`, `web.yml`) and direct-main CodeQL.
+New explicit campaign/publication authority is required before any Harness
+`v1.4.1` or Code `code-v0.3.1` tag/dispatch. Harness must first pass its
+unchanged protected exact-artifact, OCI, live and representative gates and actual
+registry integrity/provenance verification. Code's protected OIDC workflow then
+uses the matching reviewed SHA with `channel=latest`, `mode=oidc` and explicit
+confirmation, resolving the actual published Harness dependency without overrides.
+Retained-artifact terminal/web, four-manager acceptance and registry bytes with
+source-bound provenance remain mandatory. Preserve published `next` and all history.
+
+## Previous stable preparation: 2026-10-09
 
 This checkout prepares Code `0.3.0`, pinned exactly to Harness `1.4.0`, for npm
 `latest`. Published Code `0.2.0` and Harness `1.3.0` on `latest` remain

package/docs/CODE_WEB_TASKS.md

@@ -0,0 +1,116 @@
+# Code web tasks — CODE-HU-05
+
+Canonical story: https://app.notion.com/p/3ef777b104f681309854c8f1e73803f1.
+This screen sits on the experimental task evidence read (`task.get` /
+`task.projection.v1`) and the experimental task controls (`task.control.v1`).
+It extends the existing browser in `packages/web`, packaged by `packages/code`.
+It does not create a second client, an IDE, a file tree, an SDK patch, or a release.
+An operator reviews the host evidence and explicitly accepts that snapshot before
+treating the delivery as acknowledged. Continuation is a separate confirmed
+action on a fresh review ticket; model prose and a completed run are not acceptance.
+
+## Operator flow
+
+1. Open `zhivex-code web`, select an allowed workspace and create an empty session.
+   Choose **Define task**. Enter the goal, exact existing editable files, package
+   checks and explicit input/output/total token limits for the entire task.
+2. Review each proposed edit or check through the existing exact approval controls.
+   Mark every changed file viewed before approval. Execution, deterministic
+   checks, and human acceptance remain separate statuses.
+3. Open **Result, checks and provenance** for paths, contract/current-byte identity,
+   required checks and human requirements. The renderer displays host evidence;
+   assistant prose does not establish a passing check or permission.
+4. Open **Task budget and continuation** for confirmed usage, reservations,
+   unknown held exposure and remaining tokens. The account covers all task turns;
+   do not add its values to the existing per-run monitor. Missing pricing stays
+   unknown; monetary values are estimates, never invoices.
+5. Choose **Review task** to obtain a bounded fresh Git diff and a five-minute
+   review ticket. Explicitly acknowledge the diff and requirements before
+   **Accept this snapshot**. This records operator acknowledgement separately
+   from engine checks; it does not commit, merge or assert measured quality.
+6. **Correct requirements** adds a pending requirement without a model call.
+   **Continue task** requires another explicit instruction and confirmation.
+   Both preserve the original account; continuation may consume its remaining
+   credit for model/compaction work, approved edits and checks. Back, Escape,
+   Close, reload and reconnect do not execute work.
+
+## Interruption and handoff
+
+Cancel initially means requested, not confirmed. A confirmed local cancelled run
+does not prove provider termination. Missing provider usage retains unknown
+exposure and blocks continuation. A lost/failed command response requires reading
+state through Reconnect; it is never automatically retried. Relaunch reopens the
+same durable task, contract, checks, budget and effects without depending on the
+chat transcript or claiming human minutes.
+
+The runtime records the first interruption source while relaying its signal;
+nested cancellation signals cannot change a caller cancellation into an
+unclassified failure. It settles local interruption only after the execution
+owner releases its lease. The session index can observe `cancel_requested`
+directly from `created` when busy reads have not yet observed `running`.
+Neither change confirms provider termination or releases unknown exposure.
+
+A continuation rejected before admission retains a failed session attempt linked
+to its previous admitted task. The panel explicitly identifies retained evidence;
+checks stale against changed bytes cannot authorize acceptance. The rejected
+attempt does not fabricate budget admission or consumption. A fresh review targets
+the observed admitted run and must satisfy current host checks again.
+
+## Authority and limits
+
+- The browser sends a bounded operator brief, never a contract, receipt, policy,
+  credential, ledger or execution grant. The host resolves package checks and
+  compiles the existing task contract.
+- Initially native Unix workspaces only: clean Git baseline, selected tracked
+  visible files (at most 20, each at most 64 KiB), at most eight package checks,
+  no subagents. Existing exact edit/check approvals remain mandatory.
+- Reviews bind browser identity/workspace, service connection, session, run
+  revision, contract, snapshot, budget revision and Git identity. They are
+  one-use and expire after five minutes. Account exclusion plus run CAS protects
+  acceptance; continuation rechecks admission after host preparation.
+- Git failure, process-output truncation, oversized review, hidden files,
+  missing/changed receipts or uncertain effects fail closed. The diff is plain
+  escaped text with host-path/secret redaction. Redacted or truncated review
+  content disables acceptance. No arbitrary file-reading route
+  or generic browser command dispatcher is added.
+- The existing public projection reducer ignores duplicate/older snapshots,
+  rejects changed epochs/scopes and requests refresh for conflicts. Task reads
+  are sequential and cancelled on selection changes. Existing activity cursor
+  expiry recovery is retained; no activity event grants mutation authority.
+- Ordinary chat remains available in ordinary sessions. Once task authority is
+  retained, `run.start` cannot bypass task continuation/accounting. Older hosts
+  without negotiated controls show an unsupported state.
+
+## Offline acceptance and reproducibility
+
+The frozen HU75 greeting fixture remains SHA256
+`473a9e2144b0042b1b46ef54f915de693045df89d6175bde42a3393d2b083263`.
+`packages/web/scripts/task-browser-journey.mjs` drives actual packaged Code and
+Chromium at desktop/mobile sizes. Its preload replaces provider fetch with a
+synthetic transport and blocks every other fetch; it does not fabricate SDK
+state, tool receipts or check outcomes. `node check.mjs` and exact approvals run
+through the real host/service/engine. This is automated operator input, not a
+human pilot or semantic-quality measurement.
+
+The integrated installed runner binds clean source, exact Harness/Code tarball
+hashes and their shared installed engine. It runs the existing recovery/projection
+consumers plus the Code UI journey, then verifies hashes and cleanup. Preserve
+all initial failures separately; only final reports for the exact reviewed SHA
+certify that candidate. Browser fixtures cover normal acceptance, multiple tabs,
+obsolete review, edit/back/Escape, explicit continuation/double click, workspace
+switch, unknown usage on cancellation, reload and process restart. Existing Web
+security/browser gates and projection reducer tests cover host/CSRF/path boundaries,
+expired cursors, stale epochs, reordered/duplicate pages and unavailable evidence.
+
+Run the source suites and existing browser regression before the installed runner:
+
+```sh
+node scripts/code-task-ui-installed.mjs /absolute/harness.tgz /absolute/code.tgz /absolute/node /absolute/evidence
+```
+
+The runner requires a clean source checkout and uses an explicit exact candidate
+engine override in its isolated npm consumer; published pins remain unchanged.
+Use `CI=1`, `umask 022` and the repository-required test policy root. Human minutes,
+real quality, real costs and external-team outcomes remain unmeasured. A real
+3–5-team pilot and any paid provider campaign need separate authorization; this
+change does not authorize HU74, a release or promotion to latest.