@zhivex-ai/harness 1.4.0 → 1.5.0

package/dist/engine/index.js

@@ -1,11 +1,5 @@
 import {
-  CHANGE_ENVELOPE_DIGEST_ALGORITHM,
-  CHANGE_ENVELOPE_SCHEMA_VERSION,
   DEFAULT_TIME_TO_SAFE_FIX_GOAL,
-  MAX_CHANGE_ENVELOPE_APPROVALS,
-  MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES,
-  MAX_CHANGE_ENVELOPE_ATTESTATIONS,
-  MAX_CHANGE_ENVELOPE_CHECKS,
   TIME_TO_SAFE_FIX_CARRIERS,
   TIME_TO_SAFE_FIX_DIAGNOSTIC_CODES,
   TIME_TO_SAFE_FIX_FAILURE_ORIGINS,
@@ -13,16 +7,7 @@ import {
   TIME_TO_SAFE_FIX_GOALS,
   TIME_TO_SAFE_FIX_PROFILES,
   TIME_TO_SAFE_FIX_SCHEMA_VERSION,
-  canonicalizeChangeEnvelope,
-  changeEnvelopeApprovalSchema,
-  changeEnvelopeBaseSchema,
-  changeEnvelopeCheckSchema,
-  changeEnvelopeEvidenceSchema,
-  changeEnvelopeFingerprintsSchema,
-  changeEnvelopeInputSchema,
-  changeEnvelopePatchSchema,
-  changeEnvelopePreconditionsSchema,
-  changeEnvelopeSchema,
+  cancelHarnessReviewGroup,
   classifyTimeToSafeFixFailure,
   cliChangeEnvelopeVerificationDocumentSchema,
   cliDoctorDocumentSchema,
@@ -46,23 +31,19 @@ import {
   cliStateStatusDocumentSchema,
   cliStreamErrorDocumentSchema,
   cliStreamResultDocumentSchema,
-  computeChangeEnvelopeDigest,
-  computeChangeEnvelopeEvidenceDigest,
-  createChangeEnvelope,
   createTimeToSafeFixCases,
   createTimeToSafeFixReport,
   createTimeToSafeFixSample,
-  digestChangeEnvelopeArtifact,
-  externalAttestationReferenceSchema,
   injectTimeToSafeFixAttack,
+  inspectHarnessReviewGroup,
   parseCliJsonDocument,
   parseCliJsonLineDocument,
   recommendCompactionModels,
+  runHarnessDurableReviewGroup,
   timeToSafeFixDriverResultSchema,
   timeToSafeFixLatencyStatistics,
-  timeToSafeFixTaskSchema,
-  verifyChangeEnvelope
-} from "../index-m82cfspw.js";
+  timeToSafeFixTaskSchema
+} from "../index-eps3c3g6.js";
 import {
   HARNESS_STATE_BACKUP_MAX_BYTES,
   HARNESS_STATE_BACKUP_SCHEMA_VERSION,
@@ -73,7 +54,7 @@ import {
   inspectHarnessState,
   readHarnessStateBackup,
   stateBackupBundleSchema
-} from "../index-tfzta544.js";
+} from "../index-xfedewpt.js";
 import {
   CLI_COMMAND_OPTION_CONTRACTS,
   CLI_OPTION_DEFINITIONS,
@@ -83,7 +64,40 @@ import {
   resolveHarnessModelRoutes,
   serializeHarnessModelRoutes,
   validateCliCommandOptions
-} from "../index-61gthdz6.js";
+} from "../index-8sm2a1wa.js";
+import {
+  createAcpConnection,
+  serveAcpStdio
+} from "../index-3ah1f369.js";
+import {
+  exportHarnessGovernanceReport,
+  harnessGovernanceReportSchema,
+  renderHarnessGovernanceMarkdown
+} from "../index-jpdvn09j.js";
+import {
+  CHANGE_ENVELOPE_DIGEST_ALGORITHM,
+  CHANGE_ENVELOPE_SCHEMA_VERSION,
+  MAX_CHANGE_ENVELOPE_APPROVALS,
+  MAX_CHANGE_ENVELOPE_APPROVAL_SCOPES,
+  MAX_CHANGE_ENVELOPE_ATTESTATIONS,
+  MAX_CHANGE_ENVELOPE_CHECKS,
+  canonicalizeChangeEnvelope,
+  changeEnvelopeApprovalSchema,
+  changeEnvelopeBaseSchema,
+  changeEnvelopeCheckSchema,
+  changeEnvelopeEvidenceSchema,
+  changeEnvelopeFingerprintsSchema,
+  changeEnvelopeInputSchema,
+  changeEnvelopePatchSchema,
+  changeEnvelopePreconditionsSchema,
+  changeEnvelopeSchema,
+  computeChangeEnvelopeDigest,
+  computeChangeEnvelopeEvidenceDigest,
+  createChangeEnvelope,
+  digestChangeEnvelopeArtifact,
+  externalAttestationReferenceSchema,
+  verifyChangeEnvelope
+} from "../index-yx52bt4a.js";
 import {
   harnessLocalCredentialsSchema,
   openHarnessActivityStore,
@@ -91,19 +105,14 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-5jhgatga.js";
-import {
-  createAcpConnection,
-  serveAcpStdio
-} from "../index-3ah1f369.js";
+} from "../index-vvzc5ezz.js";
 import {
   createHarnessClientAdapter
-} from "../index-937cb7y8.js";
+} from "../index-vc7yxz50.js";
 import {
   openWorkspaceCheckpointStore
-} from "../index-6dft2vev.js";
+} from "../index-63gbp0cz.js";
 import {
-  APPROVAL_HISTORY_KEY,
   DEFAULT_HARNESS_CONTEXT_MANIFEST,
   DEFAULT_HARNESS_PROJECT_INSTRUCTIONS,
   HARNESS_CONTEXT_BUNDLE_SCHEMA_VERSION,
@@ -119,8 +128,6 @@ import {
   MAX_HARNESS_SKILL_FILE_BYTES,
   SEMANTIC_COMPACTION_VERSION,
   appendUserMessage,
-  applyHarnessToolPolicy,
-  approvalDecisionViews,
   assertHarnessModelCapabilities,
   compactHarnessMessages,
   createEmptyHarnessContextBundle,
@@ -128,18 +135,14 @@ import {
   createHarness,
   createHarnessLifecycleDispatcher,
   createHarnessSubagents,
-  createHarnessToolPolicy,
   createProgressMonitor,
   createSemanticCompactor,
   estimateMessageTokens,
   harnessContextConfigurationSchema,
   harnessContextFingerprintInput,
   harnessLifecycleFingerprintInput,
-  harnessPolicyDecisionEventSchema,
   harnessSkillLoadInputSchema,
-  harnessToolPolicySchema,
   inspectHarnessModelCapabilities,
-  inspectHarnessPolicy,
   inspectHarnessTaskAcceptance,
   isHarnessContextDigest,
   loadHarnessProjectContext,
@@ -149,80 +152,41 @@ import {
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel
-} from "../index-pp474137.js";
+} from "../index-6fp7kdpx.js";
 import {
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_PROJECT_MEMORY_LIMITS,
   HARNESS_PROJECT_MEMORY_SCHEMA_VERSION,
-  HARNESS_SESSION_INDEX_FILE,
-  HARNESS_SESSION_SCHEMA_VERSION,
   HARNESS_SQLITE_FILE,
-  SESSION_RUN_STATUSES,
-  TASK_ACCEPTANCE_EVIDENCE_KEY,
   TERMINAL_RUN_STATUSES,
-  TERMINAL_SESSION_RUN_STATUSES,
-  USAGE_LEDGER_KEY,
   cancelHarnessRun,
   cleanupHarnessRuns,
-  compileTaskAcceptanceContract,
   inspectHarnessRun,
-  inspectRuntimeManifest,
-  inspectUsageLedger,
   listHarnessRuns,
   migrateLegacyFileRuns,
-  openCliSessionStore,
   openHarnessPersistence,
-  openHarnessProjectMemory,
-  openSessionStore,
-  readTaskAcceptanceLedger,
-  taskAcceptanceContractSchema,
-  validateStateDirectory
-} from "../index-s2k2edts.js";
+  openHarnessProjectMemory
+} from "../index-wwthv10a.js";
 import {
-  BUN_ENGINE_RANGE,
   HARNESS_MCP_CONFIG_SCHEMA_VERSION,
   HARNESS_MCP_PERMISSIONS,
-  HARNESS_VERSION,
-  NODE_ENGINE_RANGE,
   createHarnessMcpTools,
   createHttpMcpClient,
   loadHarnessMcpConfiguration,
   normalizeHarnessMcpConfiguration
-} from "../index-pdmevfxv.js";
+} from "../index-5zbq9ztj.js";
 import {
   CliOciRuntimeAdapter,
-  EDIT_CONTRACT_SCHEMA_VERSION,
-  EDIT_DIGEST_ALGORITHM,
   HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
   HARNESS_OCI_LABEL,
   HARNESS_OCI_LABEL_VALUE,
-  MAX_EDIT_CHANGES,
-  MAX_EDIT_FILE_BYTES,
-  MAX_EDIT_PROPOSAL_BYTES,
   Workspace,
-  applyEditProposalInputSchema,
   cleanupHarnessExecutionArtifacts,
-  createEditProposal,
   createHarnessOciExecutionEnvironment,
   describeOciCommand,
-  editChangeSchema,
-  editChangesSchema,
-  editContractDocument,
-  editProposalChangeSchema,
-  editProposalInputSchema,
-  editProposalSchema,
   executionFingerprintInput,
-  fileDigestSchema,
-  harnessExecutionSession,
-  moveFileInputSchema,
-  mutationAuditEntrySchema,
-  mutationOperationSchema,
-  quarantineFileInputSchema,
-  restoreFileInputSchema,
-  taskCheckReceiptSchema,
-  validateEditProposal,
-  workspaceFilePathSchema
-} from "../index-m34q25jj.js";
+  harnessExecutionSession
+} from "../index-ggstwr0v.js";
 import {
   BUILTIN_PROVIDER_REGISTRATIONS,
   DEFAULT_ALLOWED_CHECKS,
@@ -247,9 +211,54 @@ import {
   providerAvailability,
   providerDescriptor,
   resolveHarnessConfig
-} from "../index-8zjmnyw5.js";
-import"../index-m49jx72n.js";
-import"../index-xqxeypt5.js";
+} from "../index-1265j7t2.js";
+import"../index-c39197wq.js";
+import"../index-mzydbzp8.js";
+import {
+  applyHarnessToolPolicy,
+  createHarnessToolPolicy,
+  harnessToolPolicySchema,
+  inspectHarnessPolicy
+} from "../index-bt2p8x7r.js";
+import {
+  HARNESS_SESSION_INDEX_FILE,
+  HARNESS_SESSION_SCHEMA_VERSION,
+  SESSION_RUN_STATUSES,
+  TERMINAL_SESSION_RUN_STATUSES,
+  compileTaskAcceptanceContract,
+  openCliSessionStore,
+  openSessionStore,
+  taskAcceptanceContractSchema,
+  validateStateDirectory
+} from "../index-fqqz1yt8.js";
+import {
+  BUN_ENGINE_RANGE,
+  HARNESS_VERSION,
+  NODE_ENGINE_RANGE
+} from "../index-pq3kz1r8.js";
+import {
+  EDIT_CONTRACT_SCHEMA_VERSION,
+  EDIT_DIGEST_ALGORITHM,
+  MAX_EDIT_CHANGES,
+  MAX_EDIT_FILE_BYTES,
+  MAX_EDIT_PROPOSAL_BYTES,
+  applyEditProposalInputSchema,
+  createEditProposal,
+  editChangeSchema,
+  editChangesSchema,
+  editContractDocument,
+  editProposalChangeSchema,
+  editProposalInputSchema,
+  editProposalSchema,
+  fileDigestSchema,
+  moveFileInputSchema,
+  mutationAuditEntrySchema,
+  mutationOperationSchema,
+  quarantineFileInputSchema,
+  restoreFileInputSchema,
+  validateEditProposal,
+  workspaceFilePathSchema
+} from "../index-6dxrbnxm.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION,
@@ -260,7 +269,7 @@ import {
   serializeStreamResult,
   streamEventDocument,
   streamResultDocument
-} from "../index-nmjdwd4p.js";
+} from "../index-4gt045j0.js";
 import {
   HARNESS_ERROR_CODES,
   HARNESS_ERROR_SCHEMA_VERSION,
@@ -345,471 +354,6 @@ async function executeHarnessMemoryCommand(options, command, args, source = "Exp
     memory.close();
   }
 }
-// src/persistence/governance-report.ts
-import { createHash as createHash2 } from "node:crypto";
-import { z as z2 } from "zod";
-
-// src/persistence/governance-context.ts
-import { createHash } from "node:crypto";
-import { z } from "zod";
-var digest = z.string().regex(/^sha256:[a-f0-9]{64}$/);
-var count = z.number().int().nonnegative().safe();
-var governanceReference = (kind, value) => "sha256:" + createHash("sha256").update(JSON.stringify([kind, value])).digest("hex");
-var governanceSessionSchema = z.strictObject({ availability: z.enum(["recorded", "unavailable"]), reference: digest.nullable(), revision: count.nullable() });
-var governanceHistorySchema = z.strictObject({
-  availability: z.enum(["recorded", "unavailable"]),
-  retention: z.enum(["unknown", "retained", "expired"]),
-  incomplete: z.boolean(),
-  policyDecisions: z.array(z.strictObject({
-    runReference: digest,
-    sequence: count,
-    toolReference: digest,
-    phase: z.enum(["approval-request", "tool-entry"]),
-    decision: z.enum(["allow", "ask_user", "deny"]),
-    policyDigest: digest.nullable(),
-    source: z.enum(["operator-file", "application", "baseline"]),
-    ruleReferences: z.array(digest).max(128),
-    explicitReviewRequired: z.boolean()
-  })).max(512)
-});
-var governanceEnvelopeSchema = z.strictObject({
-  source: z.literal("caller-supplied"),
-  envelopeId: digest.nullable(),
-  patchReference: digest.nullable(),
-  patchDigest: digest.nullable(),
-  linkedRunReferences: z.array(digest).max(64),
-  schemaValid: z.boolean(),
-  integrity: z.enum(["valid", "invalid"]),
-  expiration: z.enum(["unknown", "current", "expired", "not-yet-valid"]),
-  checkedAt: z.iso.datetime(),
-  expiredApprovals: count,
-  authenticity: z.literal("not-verified"),
-  patchBytes: z.literal("not-verified")
-});
-async function readGovernanceSession(source, rootRunId, runIds) {
-  const session = { availability: "unavailable", reference: null, revision: null };
-  const history = { availability: "unavailable", retention: "unknown", incomplete: true, policyDecisions: [] };
-  if (!source)
-    return { session, history, verify: async () => {} };
-  const initial = await source.index.get(source.id);
-  if (!initial || initial.sessionId !== source.id || !initial.runs.some((run) => run.runId === rootRunId))
-    throw new Error("GOVERNANCE_SESSION_MISMATCH");
-  const captured = JSON.stringify(initial);
-  session.availability = "recorded";
-  session.reference = governanceReference("session", initial.sessionId);
-  session.revision = initial.revision;
-  const pages = [];
-  if (source.history) {
-    let cursor = 0;
-    history.availability = "recorded";
-    history.retention = "retained";
-    history.incomplete = false;
-    for (let pageIndex = 0;pageIndex < 50; pageIndex++) {
-      const page = source.history.replay(source.id, cursor);
-      pages.push({ cursor, digest: governanceReference("history-page", JSON.stringify(page)) });
-      if (page.schemaVersion !== 1 || !Number.isSafeInteger(page.nextCursor) || page.nextCursor < cursor || page.events.length > 200)
-        throw new Error("GOVERNANCE_HISTORY_INVALID");
-      if (page.cursorExpired || page.policyEvidenceIncomplete) {
-        history.retention = "expired";
-        history.incomplete = true;
-      }
-      let lastSequence = cursor;
-      for (const event of page.events) {
-        if (event.sessionId !== source.id || !Number.isSafeInteger(event.sequence) || event.sequence <= lastSequence || event.sequence > page.nextCursor)
-          throw new Error("GOVERNANCE_HISTORY_INVALID");
-        lastSequence = event.sequence;
-        if (!runIds.has(event.runId) || event.activity.type !== "policy-decision")
-          continue;
-        const parsed = harnessPolicyDecisionEventSchema.safeParse(event.activity);
-        if (!parsed.success) {
-          history.incomplete = true;
-          continue;
-        }
-        if (history.policyDecisions.length === 512) {
-          history.incomplete = true;
-          continue;
-        }
-        const value = parsed.data;
-        history.policyDecisions.push({
-          runReference: governanceReference("run", event.runId),
-          sequence: event.sequence,
-          toolReference: governanceReference("tool", value.toolName),
-          phase: value.phase,
-          decision: value.decision,
-          policyDigest: value.policyDigest,
-          source: value.source,
-          ruleReferences: value.ruleIds.map((rule) => governanceReference("rule", rule)),
-          explicitReviewRequired: value.explicitReviewRequired
-        });
-      }
-      if (page.cursorExpired || !page.hasMore)
-        break;
-      if (page.nextCursor === cursor)
-        throw new Error("GOVERNANCE_HISTORY_INVALID");
-      cursor = page.nextCursor;
-      if (pageIndex === 49)
-        history.incomplete = true;
-    }
-  }
-  return { session, history, verify: async () => {
-    for (const page of pages)
-      if (governanceReference("history-page", JSON.stringify(source.history.replay(source.id, page.cursor))) !== page.digest)
-        throw new Error("GOVERNANCE_STATE_CHANGED");
-    if (JSON.stringify(await source.index.get(source.id)) !== captured)
-      throw new Error("GOVERNANCE_STATE_CHANGED");
-  } };
-}
-function projectGovernanceEnvelopes(envelopes, patches, now) {
-  if (envelopes.length > 32)
-    throw new Error("GOVERNANCE_ENVELOPE_LIMIT");
-  return envelopes.map((input) => {
-    if (Buffer.byteLength(JSON.stringify(input) ?? "") > 256 * 1024)
-      throw new Error("GOVERNANCE_ENVELOPE_LIMIT");
-    const parsed = changeEnvelopeSchema.safeParse(input);
-    const proof = verifyChangeEnvelope(input, { now });
-    const envelope = parsed.success ? parsed.data : undefined;
-    return governanceEnvelopeSchema.parse({
-      source: "caller-supplied",
-      envelopeId: envelope?.envelopeId ?? null,
-      patchReference: envelope ? governanceReference("patch", envelope.patch.patchId) : null,
-      patchDigest: envelope?.patch.patchDigest ?? null,
-      linkedRunReferences: envelope ? [...patches.get(envelope.patch.patchId) ?? []] : [],
-      schemaValid: parsed.success,
-      integrity: proof.integrity.envelopeDigestValid && proof.integrity.evidenceDigestValid ? "valid" : "invalid",
-      expiration: !envelope ? "unknown" : proof.expiration.envelopeNotYetValid ? "not-yet-valid" : proof.expiration.envelopeExpired ? "expired" : "current",
-      checkedAt: proof.expiration.checkedAt,
-      expiredApprovals: proof.expiration.expiredApprovalIds.length,
-      authenticity: "not-verified",
-      patchBytes: "not-verified"
-    });
-  });
-}
-
-// src/persistence/governance-report.ts
-var digest2 = z2.string().regex(/^sha256:[a-f0-9]{64}$/);
-var version = z2.string().regex(/^\d+\.\d+\.\d+(?:[-+][a-zA-Z0-9.-]+)?$/);
-var bindingSchema = z2.object({ schemaVersion: z2.literal(1), id: z2.literal("zhivex-harness"), version, fingerprint: digest2, algorithm: z2.literal("sha256") });
-var count2 = z2.number().int().nonnegative().safe();
-var status = z2.enum(["created", "running", "waiting_approval", "cancel_requested", "completed", "failed", "cancelled", "timed_out", "unknown"]);
-var availability = z2.enum(["recorded", "unavailable", "invalid"]);
-var providerReason = z2.enum(["empty_arguments", "invalid_json", "arguments_too_large", "incomplete_arguments", "inconsistent_metadata", "response_failed", "response_incomplete", "stream_truncated"]);
-var deliveryReason = z2.enum(["TASK_ACCEPTANCE_NO_DELIVERY_EVIDENCE", "TASK_ACCEPTANCE_SCOPE_VIOLATION", "TASK_ACCEPTANCE_RUN_NOT_COMPLETED", "TASK_ACCEPTANCE_RUN_NOT_FINISHED", "TASK_ACCEPTANCE_IMPORT_UNCONFIRMED", "TASK_ACCEPTANCE_CHECKS_MISSING", "TASK_ACCEPTANCE_DELIVERY_DRIFT", "TASK_ACCEPTANCE_DELIVERY_INSPECTION_FAILED", "TASK_ACCEPTANCE_HUMAN_REVIEW_REQUIRED", "TASK_ACCEPTANCE_VERIFIED"]);
-var deliveryStatus = z2.enum(["pending", "incomplete", "failed", "pending_review", "verified", "unknown"]);
-var checkSchema = z2.strictObject({
-  reference: digest2,
-  argvDigest: digest2,
-  patchId: digest2,
-  snapshotDigest: digest2,
-  exitCode: z2.number().int(),
-  timedOut: z2.boolean(),
-  unchanged: z2.boolean()
-});
-var deliverySchema = z2.object({
-  schemaVersion: z2.literal(1),
-  contractRevision: count2,
-  contractDigest: digest2,
-  status: deliveryStatus,
-  checks: z2.array(taskCheckReceiptSchema).max(32),
-  delivery: z2.object({ runId: z2.string().max(512), executionIdentity: z2.string().max(512), patchId: digest2, snapshotDigest: digest2 }).optional()
-});
-var approvalSchema = z2.strictObject({
-  reference: digest2,
-  toolReference: digest2,
-  approved: z2.boolean(),
-  origin: z2.enum(["interactive", "automatic", "application", "unknown"]),
-  channelReference: digest2,
-  policyDigest: digest2.nullable(),
-  status: z2.enum(["rejected", "approved", "applied", "succeeded", "failed", "unknown"]),
-  proposalId: digest2.nullable(),
-  exitCode: z2.number().int().nullable(),
-  timedOut: z2.boolean().nullable(),
-  effects: z2.array(z2.strictObject({ pathReference: digest2, beforeDigest: digest2.nullable(), afterDigest: digest2.nullable() })).max(50)
-});
-var delegationReason = z2.enum(["valid", "invalid_json", "invalid_schema", "task_mismatch", "incomplete", "duplicate_claim", "path_denied", "evidence_missing", "coverage_missing", "missing_child", "child_identity_unavailable"]);
-var delegationSchema = z2.strictObject({
-  taskReference: digest2,
-  childReference: digest2.nullable(),
-  recordedAcceptance: z2.boolean(),
-  reason: delegationReason,
-  semanticReview: z2.enum(["pending", "not_requested"]),
-  correctionsUsed: count2.nullable()
-});
-var delegationInput = z2.object({ schemaVersion: z2.literal(1), evaluations: z2.array(z2.object({
-  taskId: z2.string().max(128),
-  childRunId: z2.string().max(512).nullable(),
-  childStatus: z2.string().max(32),
-  accepted: z2.boolean(),
-  reason: delegationReason,
-  semanticReview: z2.enum(["pending", "not_requested"]),
-  correctionsUsed: count2.optional()
-})).max(64) });
-var runSchema = z2.strictObject({
-  reference: digest2,
-  parentReference: digest2.nullable(),
-  revision: count2.nullable(),
-  status,
-  finalized: z2.boolean(),
-  failure: z2.enum(["run_failed", "cancelled", "timed_out", "not_reported"]).nullable(),
-  failureDetails: z2.strictObject({ providerToolReason: providerReason.nullable(), diagnosticReference: digest2.nullable(), deliveryReason: deliveryReason.nullable() }),
-  identity: z2.literal("not-verified"),
-  runtimePolicy: z2.enum(["assistant-v3-durable-closure"]).nullable(),
-  contract: z2.strictObject({
-    availability,
-    digest: digest2.nullable(),
-    revision: count2.nullable(),
-    requiredChecks: count2.nullable(),
-    humanReviewsPending: count2.nullable(),
-    allowedWritePathReferences: z2.array(digest2).max(256),
-    protectedPathReferences: z2.array(digest2).max(256),
-    checks: z2.array(z2.strictObject({ reference: digest2, argvDigest: digest2, kind: z2.enum(["argv", "package-script"]), backend: z2.enum(["none", "oci"]), approval: z2.literal("required") })).max(32),
-    humanReviewReferences: z2.array(digest2).max(32)
-  }),
-  delivery: z2.strictObject({
-    availability,
-    status: deliveryStatus,
-    patchId: digest2.nullable(),
-    snapshotDigest: digest2.nullable(),
-    interpretation: z2.literal("recorded-checkpoint-not-current-workspace-verification"),
-    checks: z2.array(checkSchema).max(32)
-  }),
-  approvals: z2.strictObject({ availability, items: z2.array(approvalSchema).max(512) }),
-  usage: z2.strictObject({
-    availability: z2.enum(["recorded", "unavailable"]),
-    calls: count2.nullable(),
-    inputTokens: count2.nullable(),
-    outputTokens: count2.nullable(),
-    complete: z2.boolean().nullable(),
-    estimatedUsd: z2.number().finite().nonnegative().nullable(),
-    costKind: z2.literal("estimate-not-invoice")
-  }),
-  journal: z2.strictObject({ availability: z2.enum(["recorded", "unavailable"]), entries: count2, failed: count2, unfinished: count2 }),
-  delegations: z2.strictObject({ availability, interpretation: z2.literal("recorded-checkpoint-not-semantic-review"), items: z2.array(delegationSchema).max(64) }),
-  children: z2.array(digest2).max(64)
-});
-var harnessGovernanceReportSchema = z2.strictObject({
-  schemaVersion: z2.literal(1),
-  kind: z2.literal("harness-governance-report"),
-  exporterVersion: z2.string().regex(/^\d+\.\d+\.\d+(?:[-+][a-zA-Z0-9.-]+)?$/),
-  executionArtifact: z2.strictObject({ version: version.nullable(), digest: z2.null(), availability: z2.enum(["recorded-version", "unavailable"]), configurationFingerprint: digest2.nullable(), authenticity: z2.literal("not-verified") }),
-  rootReference: digest2,
-  identity: z2.literal("not-verified"),
-  referencePolicy: z2.literal("sha256-domain-separated-pseudonyms-not-anonymity"),
-  session: governanceSessionSchema,
-  eventHistory: governanceHistorySchema,
-  changeEnvelopes: z2.array(governanceEnvelopeSchema).max(32),
-  runs: z2.array(runSchema).max(64),
-  missingChildren: z2.array(digest2).max(64),
-  limitations: z2.array(z2.enum(["tree_limit", "missing_child", "invalid_contract", "invalid_delivery", "invalid_approvals", "journal_unavailable"])).max(6)
-});
-var MAX_JOURNAL = 2048;
-var MAX_REPORT_BYTES = 2 * 1024 * 1024;
-var sameScope = (state, scope) => !state.scope || state.scope.tenantId === scope?.tenantId && state.scope.userId === scope?.userId && state.scope.namespace === scope?.namespace;
-function projectRun(state, journal, limitations) {
-  const runStatus = status.safeParse(state.status);
-  const stateStatus = runStatus.success ? runStatus.data : "unknown";
-  let ledger;
-  let contractAvailability = "unavailable";
-  try {
-    ledger = readTaskAcceptanceLedger(state);
-    if (ledger)
-      contractAvailability = "recorded";
-  } catch {
-    contractAvailability = "invalid";
-    limitations.add("invalid_contract");
-  }
-  const contract = ledger?.revisions.at(-1);
-  const rawDelivery = state.metadata?.[TASK_ACCEPTANCE_EVIDENCE_KEY];
-  const parsedDelivery = deliverySchema.safeParse(rawDelivery);
-  const bound = parsedDelivery.success && contract && parsedDelivery.data.contractDigest === contract.digest && parsedDelivery.data.contractRevision === contract.revision && (!parsedDelivery.data.delivery || parsedDelivery.data.delivery.runId === state.runId);
-  const candidate = bound ? parsedDelivery.data : undefined;
-  const verified = candidate?.status === "verified" || candidate?.status === "pending_review";
-  const validSuccess = !verified || stateStatus === "completed" && candidate.delivery && contract && contract.contract.requiredChecks.every((required) => candidate.checks.some((check) => check.checkId === required.id && check.runId === state.runId && check.argvDigest === "sha256:" + createHash2("sha256").update(JSON.stringify([required.command, ...required.args])).digest("hex") && check.contractDigest === contract.digest && check.contractRevision === contract.revision && check.exitCode === 0 && !check.timedOut && check.unchanged && check.patchId === candidate.delivery.patchId && check.snapshotDigest === candidate.delivery.snapshotDigest && check.executionIdentity === candidate.delivery.executionIdentity)) && candidate.status === "pending_review" === contract.contract.humanReview.length > 0;
-  const delivery = validSuccess ? candidate : undefined;
-  if (rawDelivery !== undefined && !delivery)
-    limitations.add("invalid_delivery");
-  const approvals = { availability: state.metadata?.[APPROVAL_HISTORY_KEY] === undefined ? "unavailable" : "recorded", items: [] };
-  try {
-    for (let offset = 0;offset < 512; offset += 25) {
-      const rows = approvalDecisionViews(state, journal ?? [], offset);
-      for (const row of rows)
-        approvals.items.push({
-          reference: governanceReference("approval", row.approvalId),
-          toolReference: governanceReference("tool", row.name),
-          approved: row.approved,
-          origin: row.provenance?.origin ?? "unknown",
-          channelReference: governanceReference("channel", row.provenance?.channel ?? "unknown"),
-          policyDigest: row.provenance?.policyDigest ?? null,
-          status: row.status,
-          proposalId: row.evidence?.proposalId ?? null,
-          exitCode: row.evidence?.exitCode ?? null,
-          timedOut: row.evidence?.timedOut ?? null,
-          effects: (row.evidence?.effects ?? []).map((effect) => ({ pathReference: governanceReference("path", effect.path), beforeDigest: effect.beforeDigest, afterDigest: effect.afterDigest }))
-        });
-      if (rows.length < 25)
-        break;
-    }
-  } catch {
-    approvals.availability = "invalid";
-    approvals.items = [];
-    limitations.add("invalid_approvals");
-  }
-  const parsedUsage = inspectUsageLedger(state.metadata?.[USAGE_LEDGER_KEY]);
-  const usage = parsedUsage?.runId === state.runId ? parsedUsage : null;
-  const rawDelegations = state.metadata?.zhivexDelegationAcceptanceV1;
-  const delegations = delegationInput.safeParse(rawDelegations);
-  const manifest = inspectRuntimeManifest(state.metadata?.effectiveRuntime);
-  return {
-    reference: governanceReference("run", state.runId),
-    parentReference: state.parentRunId ? governanceReference("run", state.parentRunId) : null,
-    revision: count2.safeParse(state.revision).success ? state.revision : null,
-    status: stateStatus,
-    finalized: ["completed", "failed", "cancelled", "timed_out"].includes(stateStatus),
-    failure: stateStatus === "failed" ? "run_failed" : stateStatus === "cancelled" ? "cancelled" : stateStatus === "timed_out" ? "timed_out" : state.error ? "not_reported" : null,
-    failureDetails: {
-      providerToolReason: providerReason.safeParse(state.error?.reason).success ? state.error.reason : null,
-      diagnosticReference: state.error?.diagnosticCode ? governanceReference("diagnostic", state.error.diagnosticCode) : null,
-      deliveryReason: deliveryReason.safeParse(rawDelivery && typeof rawDelivery === "object" && !Array.isArray(rawDelivery) ? rawDelivery.reason : undefined).success ? rawDelivery.reason : null
-    },
-    identity: "not-verified",
-    runtimePolicy: manifest?.policyVersion ?? null,
-    contract: {
-      availability: contractAvailability,
-      digest: contract?.digest ?? null,
-      revision: contract?.revision ?? null,
-      requiredChecks: contract?.contract.requiredChecks.length ?? null,
-      humanReviewsPending: contract?.contract.humanReview.length ?? null,
-      allowedWritePathReferences: contract?.contract.allowedWritePaths.map((file) => governanceReference("path", file)) ?? [],
-      protectedPathReferences: contract?.contract.protectedFiles.map((file) => governanceReference("path", file)) ?? [],
-      checks: contract?.contract.requiredChecks.map((check) => ({ reference: governanceReference("check", check.id), argvDigest: "sha256:" + createHash2("sha256").update(JSON.stringify([check.command, ...check.args])).digest("hex"), kind: check.kind, backend: check.execution.backend, approval: check.execution.approval })) ?? [],
-      humanReviewReferences: contract?.contract.humanReview.map((review) => governanceReference("review", review.id)) ?? []
-    },
-    delivery: {
-      availability: delivery ? "recorded" : rawDelivery === undefined ? "unavailable" : "invalid",
-      status: delivery?.status ?? "unknown",
-      patchId: delivery?.delivery?.patchId ?? null,
-      snapshotDigest: delivery?.delivery?.snapshotDigest ?? null,
-      interpretation: "recorded-checkpoint-not-current-workspace-verification",
-      checks: (delivery?.checks ?? []).filter((check) => check.runId === state.runId && check.contractDigest === contract?.digest && check.contractRevision === contract?.revision).map((check) => ({ reference: governanceReference("check", check.checkId), argvDigest: check.argvDigest, patchId: check.patchId, snapshotDigest: check.snapshotDigest, exitCode: check.exitCode, timedOut: check.timedOut, unchanged: check.unchanged }))
-    },
-    approvals,
-    usage: {
-      availability: usage ? "recorded" : "unavailable",
-      calls: usage?.calls ?? null,
-      inputTokens: usage?.inputTokens ?? null,
-      outputTokens: usage?.outputTokens ?? null,
-      complete: usage?.usageComplete ?? null,
-      estimatedUsd: usage?.estimatedUsd ?? null,
-      costKind: "estimate-not-invoice"
-    },
-    journal: {
-      availability: journal ? "recorded" : "unavailable",
-      entries: journal?.length ?? 0,
-      failed: journal?.filter((entry) => entry.status === "failed").length ?? 0,
-      unfinished: journal?.filter((entry) => entry.status !== "completed" && entry.status !== "failed").length ?? 0
-    },
-    delegations: {
-      availability: rawDelegations === undefined ? "unavailable" : delegations.success ? "recorded" : "invalid",
-      interpretation: "recorded-checkpoint-not-semantic-review",
-      items: delegations.success ? delegations.data.evaluations.map((item) => ({
-        taskReference: governanceReference("task", item.taskId),
-        childReference: item.childRunId ? governanceReference("run", item.childRunId) : null,
-        recordedAcceptance: item.accepted,
-        reason: item.reason,
-        semanticReview: item.semanticReview,
-        correctionsUsed: item.correctionsUsed ?? null
-      })) : []
-    },
-    children: (state.childRuns ?? []).slice(0, 64).map((child) => governanceReference("run", child.runId))
-  };
-}
-async function exportHarnessGovernanceReport(store, scope, runId, options = {}) {
-  const limitations = new Set;
-  const runs = [], missingChildren = [];
-  const observed = [];
-  const queue = [{ id: runId }], seen = new Set;
-  while (queue.length && runs.length + missingChildren.length < 64) {
-    const item = queue.shift();
-    if (seen.has(item.id))
-      continue;
-    seen.add(item.id);
-    const loaded = await store.load(item.id, scope);
-    const state = loaded ? structuredClone(loaded) : undefined;
-    if (!state || state.runId !== item.id || !sameScope(state, scope) || item.parent !== undefined && state.parentRunId !== item.parent) {
-      if (item.parent === undefined)
-        throw new Error("GOVERNANCE_RUN_UNAVAILABLE");
-      missingChildren.push(governanceReference("run", item.id));
-      limitations.add("missing_child");
-      continue;
-    }
-    const loadedJournal = await store.listToolCalls?.(state.runId, scope);
-    const journal = loadedJournal ? structuredClone(loadedJournal) : undefined;
-    if (journal && journal.length > MAX_JOURNAL)
-      throw new Error("GOVERNANCE_JOURNAL_LIMIT");
-    if (journal?.some((entry) => entry.runId !== state.runId))
-      throw new Error("GOVERNANCE_JOURNAL_SCOPE");
-    if (!journal)
-      limitations.add("journal_unavailable");
-    observed.push({ state, journal });
-    runs.push(projectRun(state, journal, limitations));
-    if ((state.childRuns?.length ?? 0) > 64)
-      limitations.add("tree_limit");
-    for (const child of (state.childRuns ?? []).slice(0, 64))
-      queue.push({ id: child.runId, parent: state.runId });
-  }
-  if (queue.length)
-    limitations.add("tree_limit");
-  const context = await readGovernanceSession(options.session, runId, new Set(observed.map((item) => item.state.runId)));
-  for (const { state, journal } of observed) {
-    const current = await store.load(state.runId, scope);
-    const currentJournal = await store.listToolCalls?.(state.runId, scope);
-    if (!current || JSON.stringify(current) !== JSON.stringify(state) || JSON.stringify(currentJournal) !== JSON.stringify(journal))
-      throw new Error("GOVERNANCE_STATE_CHANGED");
-  }
-  await context.verify();
-  const patches = new Map;
-  for (const run of runs)
-    for (const patch of new Set([run.delivery.patchId, ...run.approvals.items.map((row) => row.proposalId)].filter((id) => id !== null)))
-      patches.set(patch, [...patches.get(patch) ?? [], run.reference]);
-  const binding = bindingSchema.safeParse(observed[0]?.state.harness);
-  const report = harnessGovernanceReportSchema.parse({
-    schemaVersion: 1,
-    kind: "harness-governance-report",
-    exporterVersion: HARNESS_VERSION,
-    executionArtifact: { version: binding.success ? binding.data.version : null, digest: null, availability: binding.success ? "recorded-version" : "unavailable", configurationFingerprint: binding.success ? binding.data.fingerprint : null, authenticity: "not-verified" },
-    rootReference: governanceReference("run", runId),
-    identity: "not-verified",
-    referencePolicy: "sha256-domain-separated-pseudonyms-not-anonymity",
-    session: context.session,
-    eventHistory: context.history,
-    changeEnvelopes: projectGovernanceEnvelopes(options.changeEnvelopes ?? [], patches, options.now ?? Date.now()),
-    runs,
-    missingChildren,
-    limitations: [...limitations].sort()
-  });
-  if (Buffer.byteLength(JSON.stringify(report)) > MAX_REPORT_BYTES)
-    throw new Error("GOVERNANCE_REPORT_LIMIT");
-  return report;
-}
-function renderHarnessGovernanceMarkdown(input) {
-  const report = harnessGovernanceReportSchema.parse(input);
-  return [
-    "# Execution and governance report",
-    "",
-    `Schema: ${report.schemaVersion}. Exporter: ${report.exporterVersion}.`,
-    `Identity: not verified. Recorded execution version: ${report.executionArtifact.version ?? "unavailable"}. Artifact digest: unavailable. Hash references are pseudonyms, not signatures.`,
-    "Delivery describes a recorded checkpoint; export does not recheck the workspace.",
-    "",
-    "| Run reference | Execution | Recorded delivery | Usage |",
-    "| --- | --- | --- | --- |",
-    ...report.runs.map((run) => `| ${run.reference} | ${run.status} | ${run.delivery.status} | ${run.usage.availability === "unavailable" ? "unavailable" : `${run.usage.inputTokens} input / ${run.usage.outputTokens} output (${run.usage.complete ? "complete" : "incomplete"})`} |`),
-    "",
-    `Missing children: ${report.missingChildren.length}. Limitations: ${report.limitations.join(", ") || "none detected"}.`,
-    `Session: ${report.session.availability}. Event history: ${report.eventHistory.availability}. Retention: ${report.eventHistory.retention}. Incomplete: ${report.eventHistory.incomplete}.`,
-    `Change envelopes: ${report.changeEnvelopes.length}. Envelope integrity does not verify patch bytes or authenticity. Estimates are not invoices.`,
-    ""
-  ].join(`
-`);
-}
 export {
   BUILTIN_PROVIDER_REGISTRATIONS,
   BUN_ENGINE_RANGE,
@@ -900,6 +444,7 @@ export {
   applyEditProposalInputSchema,
   applyHarnessToolPolicy,
   assertHarnessModelCapabilities,
+  cancelHarnessReviewGroup,
   cancelHarnessRun,
   canonicalizeChangeEnvelope,
   changeEnvelopeApprovalSchema,
@@ -994,6 +539,7 @@ export {
   injectTimeToSafeFixAttack,
   inspectHarnessModelCapabilities,
   inspectHarnessPolicy,
+  inspectHarnessReviewGroup,
   inspectHarnessRun,
   inspectHarnessState,
   inspectHarnessTaskAcceptance,
@@ -1034,6 +580,7 @@ export {
   restoreFileInputSchema,
   reviseHarnessTaskAcceptance,
   runHarness,
+  runHarnessDurableReviewGroup,
   runHarnessReviewGroup,
   selectHarnessModel,
   serializeHarnessModelRoutes,