@zhivex-ai/harness 1.4.0 → 1.4.1

package/docs/CONTEXT_ENGINEERING.md

@@ -451,3 +451,62 @@ unchanged; the model must issue a corrected request, and edits still require
 current read evidence and approval.
 
 Project memory is a separate kind of explicit operator context in the existing durable memory table. It is projected per request as untrusted data, with revision-based review and hard byte/entry budgets. It does not become project instructions or skills. See [Project memory](PROJECT_MEMORY.md).
+
+### Semantic compaction with bounded subagents
+
+When semantic compaction and subagents are enabled without a shared budget
+coordinator, Harness uses serial tool execution. This follows the SDK's supported
+combination and retains its rejection of paid compaction with uncoordinated
+parallel children. Callers cannot enable that incompatible combination by setting
+`toolExecution.parallel` alone. Other runs retain their existing scheduling.
+
+Applications can opt in to a shared token pool through the Beta
+`HarnessRunOptions.sharedBudget` option:
+
+```ts
+const result = await runHarness(harness, {
+  runId: "bounded-inspection-42",
+  prompt: "Inspect and review the API boundary."
+}, {
+  sharedBudget: {
+    modelReservation: {
+      inputTokens: 20000, outputTokens: 1000, totalTokens: 21000
+    },
+    childModelReservation: {
+      inputTokens: 10000, outputTokens: 1000, totalTokens: 11000
+    }
+  }
+});
+```
+
+These example reservations are host-owned conservative bounds for each request,
+not recommended limits for every model or task. Choose them for the admitted
+route and context. The SDK coordinator reuses the configured parent input,
+output and total ceilings, atomically admitting primary calls, child lifetime
+allocations and auxiliary compaction. Each child has an SDK subpool inside its
+parent allocation. There is no second Harness token ledger. A child allocation
+that cannot fit fails before its model dispatch; unused or unknown consumption
+is not converted into a fresh allowance. An individual model request is capped
+at the reserved output, and an estimated input request above its reservation is
+rejected before transport. The estimator is not a provider tokenizer or a billing
+guarantee; actual over-reservation receipts are recorded and rejected by the SDK
+before tool execution. Unknown receipts keep their allocation held.
+
+Child allocations must satisfy the SDK's component-sum contract. Under the
+existing default child ceilings (30000 input, 8000 output, 36000 total), shared
+execution narrows the input allocation to 28000. It preserves the 36000 total
+and 8000 output authorization; it never increases the total to 38000. The narrowed
+budget is visible in the child runtime manifest. Legacy execution retains its
+configured child ceilings.
+
+The option requires finite token limits and uses the Harness scope. A resumed
+run must use its original reservation policy and complete SDK budget ledger;
+changing the policy, opting an existing legacy run into a fresh pool or restoring
+only a run snapshot fails closed. Supply the same option on approval resumes.
+The SDK also prevents resuming a bound run without its coordinator. Unknown
+compaction or reservation consumption still requires operational reconciliation;
+this tranche does not add a reconciliation API or clear reservations automatically.
+Qwen routes are excluded from this option until an output-cap route is certified.
+It does not add a service/wire-protocol field or enable this token pool for
+application-owned review groups. Monetary accounting and its existing output
+clamp remain separate. No provider calls are required by the regression suite.

package/docs/CREDENTIALS.md

@@ -68,6 +68,27 @@ the console offers to use the saved destination for this session or cancel. It n
 sends a managed key to an arbitrary shell-defined endpoint. Custom endpoints still
 require explicit environment credentials.
 
+## Amazon Bedrock
+
+Converse does not store an API key. Set `AWS_REGION` or `AWS_DEFAULT_REGION` in
+the launching environment and leave credentials to the AWS SDK default chain.
+`AWS_PROFILE` selects a profile through that chain. The credentials screen
+explains this and does not write a key.
+
+`BEDROCK_RUNTIME=openai` requires an https `BEDROCK_OPENAI_BASE_URL`. The key
+may be `BEDROCK_API_KEY` or `AWS_BEARER_TOKEN_BEDROCK` in the environment, or a
+keychain/temporary `BEDROCK_API_KEY`. The base URL is not an override that
+blocks a managed key. See [Bedrock](BEDROCK.md).
+
+## Azure OpenAI
+
+Set an https `AZURE_OPENAI_ENDPOINT` before saving a key. Optional
+`AZURE_OPENAI_API_VERSION` and `AZURE_OPENAI_DEPLOYMENTS` stay in the
+environment and are not written to the keychain. A managed
+`AZURE_OPENAI_API_KEY` is allowed together with that endpoint. Published
+`@zhivex-ai/azure-openai@0.7.8` accepts a token provider, and this route still
+stores and sends the API key. See [Azure OpenAI](AZURE_OPENAI.md).
+
 ## Qwen interactive setup
 
 Open `/credentials` → Qwen → save or temporary → Standard API or QwenCloud Token

package/docs/DURABLE_OPERATIONS.md

@@ -70,7 +70,7 @@ Loading a run reconstructs its complete state for compatibility with approvals,
 
 Logical backups contain hydrated history rather than database references, so restoration does not require the original artifact tables. Exports up to 64 MiB retain the legacy JSON format; larger exports use the versioned `ZHIVEX-STATE-SEGMENTS-1` transport with bounded frames, including split strings. RC13 reads both formats and verifies the same logical checksum before import. Older versions cannot read segmented exports. File I/O and checksum serialization are incremental; the public backup/import APIs still hydrate the complete logical bundle in memory. Segmented files have no aggregate 64 MiB ceiling. A state-limit failure records a bounded terminal diagnostic on the last durable checkpoint; the unsaved payload is not claimed as preserved. Use `/status` to inspect the failed run before `/continue`. Recovery retains tool journal receipts and never re-executes an operation itself.
 
-The current candidate pins Core 1.31.0 and Agents 1.11.0. New stores require no
+The current source pins Core 1.34.0 and Agents 1.11.0. New stores require no
 conversion. Before upgrading an existing shared SDK store, stop its workers and
 upgrade them together with a complete backup. Verified legacy runs retain their
 physical keys and remain readable; new runs use canonical keys that distinguish
@@ -277,3 +277,95 @@ approvals, and provider per-request limits remain enforced. Stored numeric token
 ceilings are inactive until `unlimitedTokens` is set back to `false`.
 
 Next-version [project memory](PROJECT_MEMORY.md) reuses the existing SDK memory table and state export records. Historical state is not harvested into curated memory. Forget/clear remove current memory content, while backups, run histories and SQLite WAL retention remain separate. Older importers reject the new reserved memory key safely.
+
+## Durable review groups (Beta)
+
+`runHarnessReviewGroup` retains its ephemeral v1 contract. Applications can opt in
+through `runHarnessDurableReviewGroup(harness, { groupId, prompt })`. The new API
+uses the Harness scope, an application-owned root and a fixed roster of at most
+two read-only explorer/reviewer members. This first implementation schedules
+members serially. It requires a store with atomic idempotency claims, CAS saves
+and fenced acquire/renew/release leases; the default SQLite backend supports them.
+Custom stores must honor these contracts. No database schema migration is needed.
+
+```ts
+import {
+  runHarnessDurableReviewGroup,
+  inspectHarnessReviewGroup,
+  cancelHarnessReviewGroup
+} from "@zhivex-ai/harness";
+
+const result = await runHarnessDurableReviewGroup(harness, {
+  groupId: "review-request-42",
+  prompt: "Inspect the public API boundary."
+});
+const snapshot = await inspectHarnessReviewGroup(harness, result.groupId);
+// Cancellation can be requested from another worker using the same scope/store.
+const cancellation = await cancelHarnessReviewGroup(harness, result.groupId);
+```
+
+A repeated ID must have the same prompt, ordered profiles, scope and member
+runtime bindings. A mismatch fails before a model request. Completed members
+replay their durable receipts; an interrupted group resumes the original member
+IDs. A concurrent caller receives a retryable state conflict while the group
+worker lease is held. After a worker dies, wait for lease expiry before retrying.
+Inspection reconstructs results without executing a member. Keep the complete
+state store when backing up or restoring; deleting a root or member is not a
+supported way to reset a request.
+
+Execution statuses include `blocked`, `partial`, `waiting_approval`, `suspended`,
+`timed_out`, `cancel_requested` and `cancelled`. `partial` means all members are
+terminal and some completed while others did not. Completion describes execution;
+existing evidence and acceptance contracts still determine acceptance. The root
+is visible to ordinary run inspection; its SDK status maps `partial` to `failed`,
+and `blocked` maps to `suspended`, with the richer value in `harnessReviewGroupStatusV1`. Use group inspection for
+the full result. Approvals are not automatically resumed by this API.
+
+Cancellation records intention under the same fenced root lease used for fresh
+member admission. Each admission is recorded before claiming a child checkpoint.
+Subsequent model requests also check the root before dispatch. Already admitted
+requests can finish late; cancellation does not roll back an external effect.
+Terminal children are preserved, and active children receive durable cancellation
+requests. Inactive queued, approval or suspended checkpoints become cancelled.
+Once the group worker sees an in-flight member return, a child left at
+`cancel_requested` is settled to `cancelled` before the root snapshot is saved.
+Inspection while that request is still in flight stays `cancel_requested`.
+Confirmation requires every admitted child to have a terminal checkpoint. A cut
+between recorded admission and child persistence remains `cancel_requested`
+because the claim is uncertain; this tranche does not provide an automatic
+reconciliation API for that cut. Repeated cancellation rechecks the fixed roster.
+
+Generic cancellation of the root also closes group admission, but callers should
+use the group cancellation API to preserve terminal member receipts; the SDK
+'s generic tree-cancellation semantics are unchanged.
+
+This fence applies to the opt-in application-owned review group. It does not fix
+the SDK's general parent/subagent admission and cancellation primitives. No
+exactly-once guarantee for external effects, distributed scheduling or research
+workflow acceptance is implied. Model tests use only offline mocks. Regressions
+in `tests/durable-review-group.test.ts` cover repeated identity, interruption,
+terminal preservation, concurrent callers and separate-process SQLite control.
+
+Terminal replay reconciles the root's persisted status, member summaries and richer
+group status before returning, including recovery after a cut following child
+completion. Cancellation also reconciles its reconstructed projection. Internal
+worker checkpoints are children of the group: they become `running` while leased,
+`suspended` after an interrupted or blocked attempt, and terminal only after the
+root's terminal projection is persisted. Recovery repairs an idle legacy worker
+without taking ownership from a live worker. Default terminal cleanup can collect
+finished groups and their workers; suspended coordination remains resumable.
+
+New member records include an optional `checkpointed` marker, saved after the SDK
+child claim and before request dispatch. If a previously persisted child disappears,
+recovery blocks before transport and requires the complete backup. Existing records
+without that marker remain readable; admitted members with missing receipts are
+conservatively blocked. Admission and model dispatch also recheck receipt presence
+under the root lock, so a stale caller snapshot cannot bypass the guard. Cleanup
+while a group is active can remove an older terminal child's receipt and leave the
+group blocked; it must not be used to reset or restart that child. Cancellation may
+remain uncertain in this case. Retention deleting the entire group expires its
+stored identity; no permanent deduplication beyond retained state is promised.
+
+Groups modified by the checkpoint-marker fix require a current artifact. Older
+artifacts with strict pre-marker schemas cannot read the additional marker;
+downgrades require restoring a complete pre-upgrade backup.

package/docs/ENGINE_API.md

@@ -1,7 +1,7 @@
 # Engine API and Code integration
 
-This checkout adds terminal-independent package entrypoints for
-Harness 1.3.0 (published and verified on `latest`). They are not present in the previously published Harness 1.2.0.
+The terminal-independent package entrypoints shipped in Harness 1.3.0 and remain
+in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.4.1, pending publication. They are not present in Harness 1.2.0.
 The protected workflow validated the exact stable tarball, live gates and
 registry integrity/provenance; local candidate smoke remains contributor evidence. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.
@@ -18,6 +18,7 @@ expect the new entrypoints to exist.
 | `@zhivex-ai/harness/code-support` | Named host helpers used by Code, including a read-only SQLite diagnostic projection | Node |
 | `@zhivex-ai/harness/models` | Beta catalog schemas, bundled metadata, model selection and display helpers; no host loading | Browser or Node |
 | `@zhivex-ai/harness/mcp/stdio/v1` | Experimental host admission, isolated MCP sessions, recovery and reconciliation; see [host flow](MCP_STDIO.md) | Node or Bun |
+| `@zhivex-ai/harness/audit` | Experimental audit pack export and HMAC verification; see [audit pack](AUDIT_PACK.md) | Node |
 | `@zhivex-ai/harness/desktop/v1/state` | Versioned host-only snapshot, validation, safe-file-read and lease handoff operations for Desktop updates | Node |
 
 [`contracts/engine-api.json`](../contracts/engine-api.json) enumerates every named
@@ -208,6 +209,8 @@ Publishing Code requires a compatible Harness release, authenticated scope/name
 verification and the release compatibility gates in
 [ADR 0001](https://github.com/Zhivex/zhivex-harness/blob/main/docs/adr/0001-harness-code-public-boundary.md).
 Local packing does not establish npm permissions or public availability.
+The additive [task projection v1](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73) exposes existing task evidence through the client/service without moving execution or judgment into a renderer. `/protocol` exports its bounded schema and pure snapshot reducer.
+
 ## Experimental task acceptance contracts
 
 `runHarness(host, input, { taskAcceptance })` accepts application-owned requirements

package/docs/EXTENSIBILITY.md

@@ -4,11 +4,11 @@ Zhivex Harness `0.11.x` combines governed external tools and bounded multi-agent
 
 ## Provider registry
 
-Built-in registrations are Meta, Qwen, OpenAI, and Gemini. Each registration owns its descriptor, default model, credential names, capability/support labels, factory, and declarative diagnostics. The registry never dynamically imports provider code or returns credential/endpoint values from diagnostics.
+Built-in registrations are Meta, Qwen, OpenAI, Gemini, Anthropic, Vertex, Amazon Bedrock, and Azure OpenAI. Bedrock and Azure OpenAI are provisional and are not part of the default live certification cohort. Each registration owns its descriptor, default model, credential names, capability/support labels, factory, and declarative diagnostics. The registry never dynamically imports provider code or returns credential/endpoint values from diagnostics.
 
 Library callers can use `DEFAULT_PROVIDER_REGISTRY`, `BUILTIN_PROVIDER_REGISTRATIONS`, `createProviderRegistry`, or `DEFAULT_PROVIDER_REGISTRY.extend(...)`, then pass the registry to `resolveHarnessConfig`, `createProviderModel`, provider diagnostics, or `createHarness({ providerRegistry })`. Registration IDs, environment-variable names, defaults, diagnostics, and factories are validated before they become selectable.
 
-The coordinated stable SDK batch pins `@zhivex-ai/agents@1.11.0`, `@zhivex-ai/core@1.31.0`, `@zhivex-ai/meta@0.2.9`, `@zhivex-ai/qwen@0.16.4`, `@zhivex-ai/openai@0.14.1`, `@zhivex-ai/gemini@0.13.0`, `@zhivex-ai/anthropic@0.13.2`, and `@zhivex-ai/vertex@1.2.4`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.31.0 satisfies the updated Agents, Anthropic, OpenAI and Vertex `^1.30.0` ranges and Qwen `^1.29.0` range. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
+The coordinated stable SDK batch pins `@zhivex-ai/agents@1.11.0`, `@zhivex-ai/core@1.34.0`, `@zhivex-ai/meta@0.2.9`, `@zhivex-ai/qwen@0.16.4`, `@zhivex-ai/openai@0.16.0`, `@zhivex-ai/gemini@0.13.0`, `@zhivex-ai/anthropic@0.14.0`, `@zhivex-ai/vertex@1.2.7`, `@zhivex-ai/bedrock@2.0.7`, and `@zhivex-ai/azure-openai@0.7.8`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.34.0 satisfies Agents, OpenAI and Vertex `^1.31.0`, Anthropic `^1.30.0`, Qwen `^1.29.0`, and the provisional Bedrock and Azure OpenAI `^1.34.0` ranges. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
 
 OpenAI is based on the GPT-5.6 family: `gpt-5.6-luna` is the default, with `gpt-5.6-terra` and `gpt-5.6-sol` available through `--model`. Availability remains organization-dependent while the upstream family is in limited preview, and the adapter uses the Responses API by default.
 

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets stable `1.4.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0 until that publication.
+This guide targets stable `1.4.1`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0 until that publication.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.0
+npm install -g @zhivex-ai/harness@1.4.1
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.4.0
+bun add --global @zhivex-ai/harness@1.4.1
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.4.0 --version
-bunx @zhivex-ai/harness@1.4.0 --help
-bunx @zhivex-ai/harness@1.4.0 doctor
+bunx @zhivex-ai/harness@1.4.1 --version
+bunx @zhivex-ai/harness@1.4.1 --help
+bunx @zhivex-ai/harness@1.4.1 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/MINIMUM_TASK_AUTHORITY.md

@@ -52,10 +52,10 @@ dispatch/cap behavior, not provider billing guarantees or model quality.
 
 | Route | Direct guided task | Verified wire cap and dispatch boundary |
 | --- | --- | --- |
-| Built-in OpenAI (`@zhivex-ai/openai` 0.14.1) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
-| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.13.2) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
+| Built-in OpenAI (`@zhivex-ai/openai` 0.16.0) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
+| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.14.0) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
 | Built-in Gemini (`@zhivex-ai/gemini` 0.13.0) | Supported | `generationConfig.maxOutputTokens`; `maxRetries=0` |
-| Built-in Vertex (`@zhivex-ai/vertex` 1.2.4) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
+| Built-in Vertex (`@zhivex-ai/vertex` 1.2.7) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
 | Qwen (`@zhivex-ai/qwen` 0.16.4) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
 | Meta | Blocked | Harness continuation fetch can replay a 400 response outside SDK retry admission |
 | Injected/custom adapters, refreshable Anthropic OAuth | Blocked | No vetted transport provenance; OAuth transport can replay a 401 after refresh outside ordinary retry admission |

package/docs/PROJECT_MEMORY.md

@@ -7,7 +7,7 @@ generated automatically; hosts may submit a suggestion for operator review.
 
 ## CLI
 
-Use `zhx` or `zhivex-code` with Harness 1.4.0 (Code 0.3.0), pending publication. Commands
+Use `zhx` or `zhivex-code` with Harness 1.4.1 (Code 0.3.1), pending publication. Commands
 print bounded JSON, including the selected workspace/scope hashes. Quote content
 as one argument. Memory commands do not start a model or read credentials.
 

package/docs/README.md

@@ -9,6 +9,8 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 - [Usage reference](USAGE.md): scripts, providers and security boundaries.
 - [Model catalog administration](MODEL_CATALOG.md): shared CLI/Desktop recommendations and remote distribution.
 - [Anthropic direct API](ANTHROPIC.md): provisional setup and continuity contract.
+- [Amazon Bedrock](BEDROCK.md): provisional Converse and OpenAI-compatible routes.
+- [Azure OpenAI](AZURE_OPENAI.md): provisional endpoint, deployment, and API-key route.
 - [Credentials](CREDENTIALS.md): system keychain, temporary keys and automation.
 - [Project instructions and context](CONTEXT_ENGINEERING.md).
 - [Execution environments](EXECUTION_ENVIRONMENTS.md): isolated command execution.
@@ -23,9 +25,12 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 - [CLI reference](CLI.md): command options, JSON/JSONL and exit codes.
 - [Extensibility](EXTENSIBILITY.md): providers, MCP, routing and subagents.
 - [API stability](STABILITY.md) and [deprecations](DEPRECATIONS.md).
-- [Local service](LOCAL_SERVICE.md) and [client protocol](CLIENT_PROTOCOL.md).
+- [Local service](LOCAL_SERVICE.md) and [client protocol](CLIENT_PROTOCOL.md), including the experimental [task evidence read](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73).
+- [Code web tasks](CODE_WEB_TASKS.md): operator review and explicit snapshot acceptance before continuation.
+- [Installed recovery laboratory](https://github.com/Zhivex/zhivex-harness/blob/main/docs/TASK_RECOVERY_LAB.md): contributor fixtures for the evidence read. The laboratory guide stays in the repository and is not part of the published package.
 - [Experimental ACP text sessions](ACP.md) and [workspace checkpoint restoration](WORKSPACE_CHECKPOINTS.md).
 - [Durable operations](DURABLE_OPERATIONS.md), [repository editing](REPOSITORY_EDITING.md) and [change envelopes](CHANGE_ENVELOPES.md).
+- [Audit pack](AUDIT_PACK.md): experimental signed export of one run or guided task.
 - [Threat model](THREAT_MODEL.md) and [public repository security](PUBLIC_SECURITY.md).
 
 ## Contribute and maintain

package/docs/STABILITY.md

@@ -18,6 +18,8 @@ Beta APIs may change in a minor with changelog and migration guidance. Experimen
 
 The host-only `/mcp/stdio/v1` entry point and `CreateHarnessOptions.isolatedMcpSession` option are experimental additive capabilities. Workspace MCP configuration does not enable stdio; see [host admission and lifecycle](MCP_STDIO.md).
 
-The semantic compactor, compaction recommendations, declarative tool policy (including `toolPolicyFile` and `--tool-policy`), progress monitor, ACP text-session adapter, and workspace checkpoint restoration APIs are experimental. ACP implements the documented text-session subset; it does not claim full editor interoperability. Deterministic compaction and the existing client protocol remain available. See [tool policy semantics](TOOL_POLICY.md), [ACP limitations](ACP.md), [context behavior](CONTEXT_ENGINEERING.md), and [checkpoint constraints](WORKSPACE_CHECKPOINTS.md).
+The semantic compactor, compaction recommendations, declarative tool policy (including `toolPolicyFile` and `--tool-policy`), progress monitor, ACP text-session adapter, workspace checkpoint restoration APIs, and the `@zhivex-ai/harness/audit` subpath are experimental. `export-audit` and `verify-audit` are additive CLI commands. Their `--out` and `--signing-key-file` flags stay outside `CLI_OPTION_NAMES` and `CLI_COMMAND_OPTION_CONTRACTS`, so the stable option tuple and command-option declaration do not change. See [audit pack](AUDIT_PACK.md). ACP implements the documented text-session subset; it does not claim full editor interoperability. Deterministic compaction and the existing client protocol remain available. See [tool policy semantics](TOOL_POLICY.md), [ACP limitations](ACP.md), [context behavior](CONTEXT_ENGINEERING.md), and [checkpoint constraints](WORKSPACE_CHECKPOINTS.md).
+
+Task evidence reads (`task.get`, capability `task.projection.v1`) and operator task controls (`task.start`, `task.review`, `task.keep`, `task.revise`, `task.continue`, capability `task.control.v1`) are experimental additions on client protocol major 1. They do not change protocol version 1, existing command meanings, or the stable declaration signature baseline. The browser-safe projection schema and reducer are experimental exports of the existing `/protocol` entry. See [task projection](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73) and [task controls](CLIENT_PROTOCOL.md#task-controls-code-hu-05-experimental).
 
 Before `1.0.0-rc.1`, maintainers classified every current runtime and type export as stable, beta, or experimental. The gate rejects unreviewed additions, removals, omissions, and membership in more than one tier so future stability changes remain deliberate. Root aliases remain available during 1.x; any future beta subpath must be additive until the next major release.

package/docs/SUPPORT_MATRIX.md

@@ -10,7 +10,7 @@ The machine-readable source is [`support-matrix.json`](./support-matrix.json). `
 | OCI | Docker on Linux | — | Podman | managed remote sandbox |
 | Target package manager | npm | Bun | pnpm, Yarn | — |
 | MCP | bounded Streamable HTTP | — | broader remote implementations | stdio |
-| Provider | Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, OpenAI `gpt-5.6-luna` | — | Gemini, Anthropic, Vertex (ADC) | undocumented providers |
+| Provider | Meta `muse-spark-1.3-contributor`, Qwen `qwen3.8-flash`, OpenAI `gpt-6-luna` | — | Gemini, Anthropic, Vertex (ADC), Amazon Bedrock, Azure OpenAI | undocumented providers |
 
 Provider evidence is release-, account-, endpoint-, model-, and date-bound. A provider is supported for a release only when the exact candidate passes base, orchestration, routing, and model-directed execution gates. The table does not imply upstream feature parity.
 

package/docs/SUPPORT_MATRIX_1_1.md

@@ -10,7 +10,7 @@ The machine-readable source is [`support-matrix-1.1.json`](./support-matrix-1.1.
 | OCI | Docker on Linux | — | Podman | managed remote sandbox |
 | Target package manager | npm | Bun | pnpm, Yarn | — |
 | MCP | bounded Streamable HTTP | — | broader remote implementations | stdio |
-| Provider | Meta `muse-spark-1.3`, Qwen `qwen3.8-max`, OpenAI `gpt-6-luna` | — | Gemini | undocumented providers |
+| Provider | Meta `muse-spark-1.3`, Qwen `qwen3.8-max`, OpenAI `gpt-6-luna` | — | Gemini, Amazon Bedrock, Azure OpenAI | undocumented providers |
 
 Provider evidence is release-, account-, endpoint-, model-, and date-bound. A provider is supported for a release only when the exact candidate passes base, orchestration, routing, and model-directed execution gates. The table does not imply upstream feature parity.
 

package/docs/USAGE.md

@@ -149,8 +149,10 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · RC.10 default; fresh release-bound certification pending. |
 | OpenAI | `gpt-6-luna` | `OPENAI_API_KEY` · new default; fresh release-bound certification required |
 | Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
+| Amazon Bedrock | `anthropic.claude-haiku-5-5` | AWS credential chain plus `AWS_REGION` or `AWS_DEFAULT_REGION` · provisional; `BEDROCK_RUNTIME=openai` is a separate Tier A path and is not live-certified |
+| Azure OpenAI | `gpt-5.4` | `AZURE_OPENAI_API_KEY` and https `AZURE_OPENAI_ENDPOINT` · provisional until the harness live matrix passes |
 
-Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
+Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Bedrock also reads `AWS_REGION`, `AWS_DEFAULT_REGION`, `AWS_PROFILE`, `BEDROCK_RUNTIME`, and `BEDROCK_OPENAI_BASE_URL`. Azure OpenAI also reads `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_API_VERSION`, and `AZURE_OPENAI_DEPLOYMENTS`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
 The exact `v1.0.0` release passed protected base, delegation, routing and model-directed OCI gates for Meta, Qwen and OpenAI on 2026-09-20. The representative matrix passed 14/14 cases per provider on its authorized second attempt. Gemini remains provisional. See the [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md#current-public-status) for artifact identity and the preserved first-attempt failure. Controlled and official-SDK MCP interoperability are separate transport evidence. Credential detection and deterministic tests do not replace real provider certification.
 

package/docs/VERTEX.md

@@ -44,7 +44,7 @@ Errors expose bounded categories for authentication, permission, unavailable
 model/route, rate limit and server failures. Raw Google payloads, token values,
 credential paths and service-account identities are not retained in errors.
 
-The integration pins `@zhivex-ai/vertex@1.1.2` with Core 1.26.0 and
-`google-auth-library@11.0.2`. Deterministic tests exercise the installed SDK's
+The integration pins `@zhivex-ai/vertex@1.2.7` with Core 1.34.0 and
+`google-auth-library@11.1.0`. Deterministic tests exercise the installed SDK's
 transport, streaming, signed continuation, approval/reopen and route mismatch.
 They are not evidence of a live project, renewable ADC or IAM authorization.

package/docs/WEB_LIMITS.md

@@ -3,8 +3,9 @@
 New interactive Web/terminal tasks have no accumulated spend, token, step,
 tool-call or duration cap unless configured. This change uses the published SDK contract from
 Zhivex/zhivex-ai-sdk PR 142 (Core/SDK 1.31.0, Agents 1.11.0). Direct Harness, Code
-and Web Core/Agents pins and the root Core override use those verified releases.
-Provider package pins, headless policies and release gates remain unchanged.
+and the root Core override now pin Core 1.34.0; Agents stays 1.11.0.
+Provider package pins are Anthropic 0.14.0, OpenAI 0.16.0 and Vertex 1.2.7.
+Headless policies and release gates remain unchanged.
 
 The Web header opens the approved gradual configuration modal. Next task settings
 override project settings once, including an empty override. Project settings
@@ -21,7 +22,7 @@ Unsupported pricing tiers and unaccounted auxiliary usage make the estimate
 unavailable. The price source is visible on the run. No money is reserved and this
 is not a guaranteed financial cap.
 
-**Avisar** records a notice and lets the run continue. **Detener** requests the
+**Notify** records a notice and lets the run continue. **Stop** requests the
 existing active-run cancellation once, after observing the threshold. An in-flight
 operation or final response can exceed it; completed work is not rolled back.
 Consumption and durable effects remain recorded. Cancellation produces a cancelled

package/docs/adr/0002-isolated-mcp-stdio.md

@@ -16,9 +16,12 @@ activate stdio, change configuration schema 1, or claim isolated execution passe
   private workspace volume and optional read-only dependencies. Its adapter has
   finite `run`/`runBatch`, not an interactive stdio process lease. All MCP is
   currently rejected with OCI enforcement before discovery.
-- Installed `@zhivex-ai/core` 1.26.0 exposes `McpClient`, call options with abort,
-  timeout/idempotency key, and an HTTP transport; no executable stdio factory was
-  found in this dependency. The control-plane transport enum is not an executor.
+- At this proposal, installed `@zhivex-ai/core` 1.26.0 exposed `McpClient`, call
+  options with abort, timeout/idempotency key, and an HTTP transport; no executable
+  stdio factory was found in that dependency. The control-plane transport enum is
+  not an executor.
+- The current pin is `@zhivex-ai/core` 1.34.0, which includes an experimental
+  stdio client. Harness still does not treat that factory as the OCI boundary.
 
 MCP stdio uses UTF-8 newline-delimited JSON-RPC on stdin/stdout; stderr is a
 separate diagnostic stream. Preserve message correlation and initialization.

package/docs/support-matrix-1.1.json

@@ -24,6 +24,8 @@
     { "id": "provider-meta", "dimension": "provider", "target": "Meta muse-spark-1.3", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", ".github/workflows/release.yml"] },
     { "id": "provider-qwen", "dimension": "provider", "target": "Qwen qwen3.8-max", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", ".github/workflows/release.yml"] },
     { "id": "provider-openai", "dimension": "provider", "target": "OpenAI gpt-6-luna", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", ".github/workflows/release.yml"] },
-    { "id": "provider-gemini", "dimension": "provider", "target": "Gemini gemini-3.6-flash / 3.7-flash", "level": "provisional", "evidence": ["docs/LIVE_CERTIFICATION.md"] }
+    { "id": "provider-gemini", "dimension": "provider", "target": "Gemini gemini-3.6-flash / 3.7-flash", "level": "provisional", "evidence": ["docs/LIVE_CERTIFICATION.md"] },
+    { "id": "provider-bedrock", "dimension": "provider", "target": "Amazon Bedrock Converse / OpenAI-compatible runtime", "level": "provisional", "evidence": ["docs/BEDROCK.md", "tests/bedrock-provider.test.ts"] },
+    { "id": "provider-azure-openai", "dimension": "provider", "target": "Azure OpenAI", "level": "provisional", "evidence": ["docs/AZURE_OPENAI.md", "tests/azure-openai-provider.test.ts"] }
   ]
 }

package/docs/support-matrix.json

@@ -21,11 +21,13 @@
     { "id": "pm-yarn", "dimension": "target-package-manager", "target": "Yarn", "level": "provisional", "evidence": ["tests/package-manager.test.ts"] },
     { "id": "mcp-http", "dimension": "mcp-transport", "target": "bounded Streamable HTTP JSON-RPC", "level": "supported", "evidence": ["scripts/mcp-interoperability-smoke.ts", "scripts/mcp-official-sdk-smoke.ts"] },
     { "id": "mcp-stdio", "dimension": "mcp-transport", "target": "stdio", "level": "unsupported", "evidence": ["SUPPORT.md"] },
-    { "id": "provider-meta", "dimension": "provider", "target": "Meta muse-spark-1.2", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
-    { "id": "provider-qwen", "dimension": "provider", "target": "Qwen qwen3.8-max", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
-    { "id": "provider-openai", "dimension": "provider", "target": "OpenAI gpt-5.6-luna", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
+    { "id": "provider-meta", "dimension": "provider", "target": "Meta muse-spark-1.3-contributor", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
+    { "id": "provider-qwen", "dimension": "provider", "target": "Qwen qwen3.8-flash", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
+    { "id": "provider-openai", "dimension": "provider", "target": "OpenAI gpt-6-luna", "level": "supported", "evidence": ["docs/LIVE_CERTIFICATION.md", "release-status.json"] },
     { "id": "provider-vertex", "dimension": "provider", "target": "Google Cloud Vertex AI (ADC)", "level": "provisional", "evidence": ["docs/VERTEX.md", "tests/vertex-provider.test.ts", "tests/vertex-auth.test.ts"] },
     { "id": "provider-anthropic", "dimension": "provider", "target": "Anthropic direct API / claude-sonnet-5", "level": "provisional", "evidence": ["docs/ANTHROPIC.md"] },
-    { "id": "provider-gemini", "dimension": "provider", "target": "Gemini gemini-3.6-flash / 3.7-flash", "level": "provisional", "evidence": ["docs/LIVE_CERTIFICATION.md"] }
+    { "id": "provider-gemini", "dimension": "provider", "target": "Gemini gemini-3.6-flash / 3.7-flash", "level": "provisional", "evidence": ["docs/LIVE_CERTIFICATION.md"] },
+    { "id": "provider-bedrock", "dimension": "provider", "target": "Amazon Bedrock Converse / OpenAI-compatible runtime", "level": "provisional", "evidence": ["docs/BEDROCK.md", "tests/bedrock-provider.test.ts"] },
+    { "id": "provider-azure-openai", "dimension": "provider", "target": "Azure OpenAI", "level": "provisional", "evidence": ["docs/AZURE_OPENAI.md", "tests/azure-openai-provider.test.ts"] }
   ]
 }

package/evaluations/code-task-ui.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": 1,
+  "story": "CODE-HU-05",
+  "scope": "automated installed UI/service/engine plus retained HU75 recovery laboratory",
+  "fixtureSha256": "473a9e2144b0042b1b46ef54f915de693045df89d6175bde42a3393d2b083263",
+  "browserScenarios": [
+    "normal-task-review-accept",
+    "reload-without-replay",
+    "two-tabs-obsolete-review-and-edit-back",
+    "corrected-task-explicit-continuation-double-click",
+    "workspace-switch-without-stale-evidence-or-replay",
+    "slow-cancel-unknown-usage-blocks-continuation",
+    "process-restart-handoff-without-transcript-or-replay"
+  ],
+  "requiredEvidence": ["exact artifact binding before and after execution", "native check receipts", "desktop and mobile screenshots", "zero automatic effect replay", "retained unknown usage", "scripted operator acknowledgement separately labeled"],
+  "liveProvider": false,
+  "humanPilotPerformed": false,
+  "humanMinutes": null,
+  "realCostPerAcceptedTask": null
+}

package/evaluations/representative-assembly-matrix.json

@@ -62,7 +62,8 @@
     "v1.4.0-rc.6",
     "v1.4.0-rc.7",
     "v1.4.0-rc.8",
-    "v1.4.0"
+    "v1.4.0",
+    "v1.4.1"
   ],
   "expectedModels": [
     {
@@ -552,6 +553,14 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.4.1",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/evaluations/task-projection.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": 1,
+  "story": "HAR-HU-73",
+  "lineage": "Restacked onto current main. Fixture identity is fixtureSha256, not a closed stack commit.",
+  "fixtureSha256": "473a9e2144b0042b1b46ef54f915de693045df89d6175bde42a3393d2b083263",
+  "installedScenarios": ["negotiation-version", "snapshot-read-only", "host-redaction", "duplicate-out-of-order", "artifact-scope", "cursor-expiry-replay", "paused-host-read", "restart-new-epoch", "artifact-drift", "legacy-budget"],
+  "excluded": ["CODE-05 UI", "live providers", "external pilot", "concurrent host takeover", "non-native execution", "semantic acceptance", "release"],
+  "fixtureSource": "HAR75 phase-one greeting oracle; unchanged bytes",
+  "runner": "scripts/task-recovery-lab-installed.mjs, optional sixth argument projection"
+}

package/evaluations/task-recovery-lab.json

@@ -0,0 +1,60 @@
+{
+  "schemaVersion": 1,
+  "id": "HAR-HU-75-base-lab",
+  "scopeDecision": "HAR-HU-61",
+  "measurementConsumer": "HAR-HU-74 (not executed)",
+  "lineage": "Restacked onto current main with the task evidence read. Fixture identity is fixtureSha256, not a closed stack commit.",
+  "fixtureSha256": "473a9e2144b0042b1b46ef54f915de693045df89d6175bde42a3393d2b083263",
+  "installedScenarios": [
+    "failed-start",
+    "exhaustion-after-work",
+    "native-path-boundary",
+    "normal-control",
+    "contract-artifact-drift",
+    "obsolete-approval",
+    "concurrent-cancel-unknown-usage",
+    "concurrent-cancel-late-usage",
+    "disk-full-final-save",
+    "compaction-untrusted-evidence",
+    "crash-before-receipt",
+    "crash-after-receipt",
+    "service-disconnect"
+  ],
+  "limits": {
+    "singleWriter": true,
+    "backend": "native",
+    "store": "sqlite",
+    "maxSteps": 16,
+    "maxToolCalls": 40,
+    "timeoutMs": 150000,
+    "inputTokens": 60000,
+    "outputTokens": 8192,
+    "totalTokens": 68192,
+    "liveProvider": false,
+    "humanMeasurement": false
+  },
+  "sourceRegressions": [
+    "tests/task-continuity.test.ts",
+    "tests/task-cancellation-host.test.ts",
+    "tests/task-cancellation-transport.test.ts",
+    "tests/task-budget-accounting.test.ts",
+    "tests/task-budget-compatibility.test.ts",
+    "tests/local-service.test.ts",
+    "tests/local-service-recovery.test.ts",
+    "tests/governance-report.test.ts",
+    "tests/governance-context.test.ts",
+    "tests/tool-policy-paths.test.ts",
+    "tests/security.test.ts"
+  ],
+  "pending": [
+    "HAR73 versioned task service projection",
+    "CODE05 task review UI and rendering of active text/citations",
+    "HAR74 ratified human rubric, time, cost and pilot"
+  ],
+  "notSupported": [
+    "Concurrent writers or host takeover",
+    "Remote provider stop confirmation",
+    "Arbitrary disk hardware failure",
+    "New SSRF/document/web adapters"
+  ]
+}

package/examples/README.md

@@ -2,19 +2,19 @@
 
 ## Isolated Bun installation
 
-Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected stable publication, this installs the 1.4.0 artifact in a temporary consumer, without building the source checkout or changing global tools:
+Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected stable publication, this installs the 1.4.1 artifact in a temporary consumer, without building the source checkout or changing global tools:
 
 ```bash
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.4.0
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.4.1
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json
 ```
 
-Version must print `1.4.0`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
+Version must print `1.4.1`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
 
 To continue in your actual project, use the [global installation and credential setup](../README.md#quick-start), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).