@zhivex-ai/harness 1.4.0 → 1.5.0

package/dist/workspace/edit-contracts.d.ts

@@ -70,8 +70,8 @@ export declare const quarantineFileInputSchema: z.ZodObject<{
 export type QuarantineFileInput = z.infer<typeof quarantineFileInputSchema>;
 export declare const restoreFileInputSchema: z.ZodObject<{
     quarantineId: z.ZodString;
-    destination: z.ZodOptional<z.ZodString>;
-    expectedDigest: z.ZodOptional<z.ZodString>;
+    destination: z.ZodString;
+    expectedDigest: z.ZodString;
 }, z.core.$strict>;
 export type RestoreFileInput = z.infer<typeof restoreFileInputSchema>;
 export declare const mutationOperationSchema: z.ZodEnum<{

package/dist/workspace/path-policy.d.ts

@@ -1,4 +1,5 @@
-/** Shared lexical exclusions for workspace access and acceptance preflight. */
+/** Shared lexical exclusions for workspace access and acceptance preflight.
+ * Comparisons use toLowerCase so a Turkish locale cannot map ASCII I to dotless ı and skip .git or id_rsa. */
 export declare const HARD_IGNORES: Set<string>;
 export declare const isSensitiveName: (name: string) => boolean;
 export declare const isHardIgnored: (relativePath: string) => boolean;

package/dist/workspace/workspace.d.ts

@@ -214,6 +214,19 @@ export declare class Workspace {
     private readInternalRegularFile;
     quarantineFile(input: QuarantineFileInput, assertActive?: () => Promise<void>): Promise<QuarantineFileResult>;
     private quarantineFileLocked;
+    private readRestorableQuarantine;
+    /** Read-only preview of a pinned restore. Destination and digest are required, and nothing is written. */
+    previewRestore(input: unknown): Promise<{
+        proposalId: string;
+        files: {
+            path: string;
+            expectedDigest: string;
+            before: null;
+            after: string;
+            afterDigest: string;
+            operation: "restore";
+        }[];
+    }>;
     restoreQuarantined(input: RestoreFileInput): Promise<RestoreFileResult>;
     private restoreQuarantinedLocked;
     runCheck(check: HarnessCheck, expectedScript: string, allowedChecks?: readonly string[]): Promise<CommandResult>;

package/dist/zhx.js

@@ -1,13 +1,38 @@
 #!/usr/bin/env node
 import {
   HARNESS_VERSION,
+  NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-w0hterjs.js";
+} from "./cli-entry-q8bgkn9m.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
 
+// src/cli/node-engine.ts
+var nodeEngineError = (version, range) => {
+  const minimumMatch = /^>=(\d+)\.(\d+)\.(\d+)$/.exec(range.trim());
+  const actualMatch = /^(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  const failure = `Node.js ${version} does not satisfy the package engine requirement (${range}).
+`;
+  if (!minimumMatch || !actualMatch)
+    return failure;
+  for (let index = 1;index <= 3; index += 1) {
+    const actual = Number(actualMatch[index]);
+    const minimum = Number(minimumMatch[index]);
+    if (actual !== minimum)
+      return actual > minimum ? undefined : failure;
+  }
+  return;
+};
+
 // src/cli-entry.ts
+if (!process.versions.bun) {
+  const engineError = nodeEngineError(process.versions.node, NODE_ENGINE_RANGE);
+  if (engineError) {
+    process.stderr.write(engineError);
+    process.exit(1);
+  }
+}
 var argv = process.argv.slice(2);
 if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${HARNESS_VERSION}
@@ -16,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-2h37qyvg.js");
+  const { runCli } = await import("./cli-vyrytn3m.js");
   await runCli(argv);
 }

package/docs/AUDIT_PACK.md

@@ -0,0 +1,99 @@
+# Audit pack
+
+Experimental operator export. It is not part of the stable root API. Import it
+from `@zhivex-ai/harness/audit`. The commands are `export-audit` and
+`verify-audit` on both `zhx` and `zhivex-code`.
+
+```sh
+export ZHIVEX_AUDIT_SIGNING_KEY="$(openssl rand -base64 32)"
+zhx export-audit <task-id> --out ./audit-pack
+zhx verify-audit --out ./audit-pack
+```
+
+`--signing-key-file <path>` overrides the environment variable. The key is 32 to
+4096 bytes. A single trailing newline in the file is ignored. The key is not
+written into the pack. `--out` and `--signing-key-file` are experimental flags
+and are not members of the stable `CLI_OPTION_NAMES` tuple.
+
+## What one bundle contains
+
+The subject is a run id, or a guided task id. A run id produces one flat
+directory. A guided task id produces one directory whose member runs live under
+`runs/<id>/`. A task with a single recorded run stays flat.
+
+| File | Source |
+| --- | --- |
+| `manifest.json` | Hashes and the HMAC. Not hashed inside itself. |
+| `governance-report.json` | `exportHarnessGovernanceReport`. Pseudonymous tree projection. |
+| `approvals.json` | Every `approvalDecisionViews` page, up to the governance report's 512-record ceiling, then the same email and common-token redaction policy used by the activity journal. |
+| `policy-decisions.json` | Activity events parsed with `harnessPolicyDecisionEventSchema`. |
+| `redaction.jsonl` | The durable redacted activity journal for that run. This is not a second redactor and not a list of removed tokens. |
+| `usage-ledger.json` | `inspectUsageLedger` on the run metadata, plus `UsageLedger.summary` when the operations database can be opened. |
+
+The governance report already walks child runs. Approval, policy, redaction and
+usage files describe the selected run, or each run on the task account. Those
+files and the governance report are taken from one captured snapshot of each
+selected run and its journal. If that snapshot, or the task account that named
+the runs, changes before the manifest is signed, export fails with
+`AUDIT_PACK_STATE_CHANGED` and writes nothing. Export does not call a model,
+execute a tool, or rewrite run state. Opening the usage ledger uses the existing
+`UsageLedger.open` path, which ensures its transport tables exist and does not
+append call rows. Estimates are not invoices.
+
+Each payload file is at most 8 MiB. The manifest plus every payload file is at
+most 32 MiB. Verification uses the same total, so a directory that exports can
+be verified. A larger directory fails with `AUDIT_PACK_LIMIT`.
+
+Pass `--session <sessionId>` to include the retained activity journal. Without
+it, the redaction log and policy file say `unavailable`. Retention and truncation
+stay explicit. Session ids are not copied into the JSONL; the governance report
+keeps its session pseudonym.
+
+The first JSONL line is a `zhivex-redaction-log` header. Later lines are
+`zhivex-redacted-activity` records: sequence, run id, optional time, and the
+stored activity object.
+
+## Manifest and HMAC
+
+`manifest.json` is schema 1, kind `zhivex-harness-audit-pack`, integrity
+`hmac-sha256`. `files` lists each payload path, byte length, and SHA-256.
+Verification requires the directory to contain exactly those files plus
+`manifest.json`. Paths stay inside the directory. Symlinks are rejected.
+Unknown files, missing files, and hash mismatches fail.
+
+The signature covers the canonical form of the manifest with the `signature`
+field removed:
+
+- arrays keep their order
+- object keys are sorted lexicographically by UTF-16 code unit
+- `undefined` object entries are omitted
+- strings and numbers use `JSON.stringify`
+- there is no whitespace
+
+`signature.keyId` is the first 16 hexadecimal characters of SHA-256 over the
+raw key bytes. `signature.value` is standard base64 of HMAC-SHA256 over the
+canonical UTF-8 bytes. Verification uses a constant-time compare. A different
+key fails with `AUDIT_PACK_KEY_MISMATCH` when the key id does not match, and
+`AUDIT_PACK_SIGNATURE_INVALID` when the key id matches but the MAC does not.
+
+HMAC is the mechanism in this repository that an operator can configure without
+a new key format. Change envelopes already bind SHA-256 digests and leave
+producer authenticity unverified. Desktop update manifests use Ed25519 because
+a publisher and a verifier must not share a secret. An audit pack is an
+operator seal of local records: the same party exports and verifies, or shares
+the key out of band. Anyone who has the key can produce a pack that verifies.
+This is integrity against modification by someone who does not have the key. It
+is not a third-party attestation and it does not prove who ran the task.
+
+## Commands
+
+```sh
+zhx export-audit <task-id> --out <directory> [--session <id>] [--json]
+zhx verify-audit --out <directory> [--json]
+```
+
+`zhivex-code` accepts the same two commands. Locator flags match other state
+commands. `--json` prints the manifest or the verification document. The
+directory must not already exist for export. Verification reads the directory
+and the signing key only. It does not resolve provider, store, or budget
+configuration, and it does not open the workspace.

package/docs/AZURE_OPENAI.md

@@ -0,0 +1,53 @@
+# Azure OpenAI (provisional)
+
+Azure OpenAI is a separate provider (`azure-openai`). It does not reuse
+`OPENAI_API_KEY` or `OPENAI_BASE_URL`. No live Harness certification has been
+run for this route. Prices are not copied from the public OpenAI catalog.
+
+Published `@zhivex-ai/azure-openai@0.7.8` is the adapter pinned by this tree.
+It requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+Language models report Tier A. Hosted tool gates such as tool search follow
+the model id (`gpt-5.4` and `gpt-6-astra` in this adapter). An opaque
+deployment name does not receive those gates unless a deployment map names
+the base model.
+
+Published 0.7.8 accepts a deployments map and a token provider for Microsoft
+Entra ID. This route still authenticates with an API key and does not pass a
+token provider.
+
+## Configuration
+
+Set `AZURE_OPENAI_ENDPOINT` to an https URL with no user, password, query, or
+fragment. Set `AZURE_OPENAI_API_KEY` in the environment, or store it in the CLI
+keychain or a temporary session. The endpoint is required with a managed key.
+It is not treated as an override that blocks the keychain.
+
+`AZURE_OPENAI_API_VERSION` is optional. When it is set, requests use
+`/openai/deployments/{deployment}/chat/completions?api-version=...` and the
+deployment name is not also sent as `model`. When it is omitted, requests use
+`/openai/v1/chat/completions` and the body includes the model id.
+
+`AZURE_OPENAI_DEPLOYMENTS` is optional JSON, at most 8192 characters and 32
+entries. Each entry is `"name": "gpt-5.4"` or `"name": { "model": "gpt-5.4" }`.
+Deployment names and model ids are restricted to simple identifier characters.
+Harness passes the map to the adapter. Published 0.7.8 uses the base model for
+capabilities and request shape while the request still uses the deployment
+name. Harness also overlays those capability flags.
+
+The published adapter also reads omitted endpoint, key, and API version from
+`process.env`. Harness passes the endpoint and key from the selected
+environment. When that environment omits the API version, Harness hides
+`process.env.AZURE_OPENAI_API_VERSION` for the adapter constructor so a host
+value cannot change the route.
+
+## Durable execution
+
+Endpoint, API version, and the deployments document are hashed into the durable
+transport binding. The API key is not. Unconfigured Azure OpenAI does not
+change existing provider transport bindings.
+
+Provider errors are replaced with a generic message. Numeric status and the
+retryable flag are kept. Response bodies and the API key are dropped.
+
+Deterministic tests stub `fetch`. They do not contact Azure and they do not
+check account access.

package/docs/BEDROCK.md

@@ -0,0 +1,56 @@
+# Amazon Bedrock (provisional)
+
+Bedrock is a separate provider (`bedrock`). It is not enabled by the Anthropic
+direct API route. No live Harness certification has been run for this route.
+Pricing and context limits are not inferred.
+
+Published `@zhivex-ai/bedrock@2.0.7` is the adapter pinned by this tree. It
+requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+This integration reports the installed adapter's labels and does not relabel
+them.
+
+## Runtimes
+
+`BEDROCK_RUNTIME` is optional. An empty value or `converse` selects the Converse
+API. `openai` selects the OpenAI-compatible runtime. Any other value is rejected.
+
+Converse reports Tier B on the published 2.0.7 adapter: reasoning is supported
+and `toolChoiceNone` is true. Approval requests stay false on that runtime.
+Harness reports that installed label.
+
+The OpenAI-compatible runtime reports Tier A, including approval requests.
+It needs `BEDROCK_API_KEY` or `AWS_BEARER_TOKEN_BEDROCK`, plus an https
+`BEDROCK_OPENAI_BASE_URL` with no user, password, or fragment. Harness does
+not read `OPENAI_API_KEY` or `OPENAI_BASE_URL` for this route.
+
+## Credentials
+
+Converse uses the AWS SDK default credential chain: instance roles, SSO,
+shared config, and environment credentials. Set `AWS_REGION` or
+`AWS_DEFAULT_REGION` to a region such as `us-east-1`. `AWS_PROFILE` is part of
+the transport fingerprint. Published 2.0.7 accepts a profile and static
+credentials on the adapter. This route does not pass `AWS_PROFILE`. When
+`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are both set, and no bearer
+token is set, Converse uses that static pair and an optional
+`AWS_SESSION_TOKEN`. Otherwise the AWS SDK default chain applies. Harness
+does not call AWS while checking that the route is configured. Incomplete
+settings, such as a profile or runtime with no region or OpenAI route, stay
+out of the durable transport fingerprint.
+
+An explicit `AWS_BEARER_TOKEN_BEDROCK` in the Harness environment selects bearer
+auth for Converse and skips the default chain. The CLI does not store a Converse
+API key. The OpenAI-compatible runtime can use a keychain or temporary
+`BEDROCK_API_KEY` together with the required base URL.
+
+## Durable execution
+
+Region, default region, profile, runtime, and the OpenAI base URL are hashed
+into the durable transport binding. API keys and bearer tokens are not.
+Unconfigured Bedrock does not change existing provider transport bindings.
+
+Provider errors are replaced with a generic message. Numeric status and the
+retryable flag are kept. Response bodies, account identifiers, and credentials
+are dropped.
+
+Deterministic tests mock the AWS client and the OpenAI-compatible HTTP call.
+They are not evidence of model access, IAM, or a live region.

package/docs/CLI.md

@@ -826,6 +826,21 @@ expiry are checked separately. Patch bytes and producer authenticity remain
 unverified. No envelope v1 fields are added. Concurrent source changes and hard
 capacity limits reject export; bounded tree/history truncation is reported.
 
+### Audit pack (Experimental)
+
+`zhx export-audit <task-id> --out <directory>` writes one signed directory for a
+run, or for every run recorded on a guided task account. `zhx verify-audit --out <directory>`
+recomputes the file hashes and the HMAC. It does not resolve provider, store, or
+budget configuration. Both commands also accept the workspace locator options
+(`--workspace`, `--state-dir`, `--store`, `--tenant`, `--user`, `--namespace`)
+and `--json`. Export also accepts `--session <sessionId>` and is the command
+that resolves those options.
+
+`--out` and `--signing-key-file` are experimental flags for these commands. They
+are not part of the stable option list. The signing key comes from
+`--signing-key-file` or `ZHIVEX_AUDIT_SIGNING_KEY` and is never written into the
+pack. See [Audit pack](AUDIT_PACK.md).
+
 ## Experimental project memory (unreleased)
 
 `zhx memory` supports `remember`, `list`, `read`, `update`, `forget`, `suggest`, `accept`, `context`, `clear`, `enable` and `disable`. Content is one quoted argument. Updates, acceptance and forgetting require the current revision. `--source` supplies a provenance label; `--no-memory` disables curated retrieval and SDK memory loading/capture for a local run/chat/resume invocation. Existing workspace/tenant/user/namespace flags select scope. See [Project memory](PROJECT_MEMORY.md) for bounds, review, deletion semantics and next-release pairing.

package/docs/CLIENT_PROTOCOL.md

@@ -91,8 +91,141 @@ or a replacement for the engine's signed approval validation.
 | session.rename | projectId, sessionId, expectedRevision, idempotencyKey, title | session | REVISION_CONFLICT |
 | run.start | projectId, sessionId, expectedRevision, idempotencyKey, prompt | run | INVALID_STATE |
 | run.get | projectId, sessionId, runId | run | NOT_FOUND |
+| task.get | projectId, sessionId, runId, projectionVersion: 1 | task | VERSION_UNSUPPORTED / NOT_FOUND |
 | approval.resolve | projectId, sessionId, runId, expectedRevision, idempotencyKey, decisions | run | APPROVAL_MISMATCH |
 | run.cancel | projectId, sessionId, runId, expectedRevision, idempotencyKey | run | REVISION_CONFLICT |
+
+## Task projection v1 (HAR-HU-73)
+
+Negotiate `task.get` and `task.projection.v1` before using this additive read.
+Protocol major 1 and all legacy commands keep their meaning. Older hosts without
+the capability cannot provide this projection; clients must show it as unavailable.
+The host must already have a task contract and a session binding for its runs.
+This command creates neither a task nor a budget and does not provide a new execution
+or acceptance API. CODE-05 presentation remains separate.
+
+```ts
+import { reduceHarnessTaskProjection } from '@zhivex-ai/harness/protocol';
+
+const hello = adapter.negotiate([1]);
+if (!hello.ok || !hello.capabilities.includes('task.projection.v1')) {
+  throw new Error('Task projection unavailable');
+}
+const scope = { connectionId: hello.connectionId, projectId: hello.projectId,
+  sessionId, runId }; // IDs selected from this host's session index.
+const response = await adapter.dispatch({ protocolVersion: 1, requestId: 'task-read-1',
+  connectionId: scope.connectionId,
+  command: { method: 'task.get', projectId: scope.projectId, sessionId, runId,
+    projectionVersion: 1 } });
+if (response.ok && response.data.kind === 'task') {
+  const view = reduceHarnessTaskProjection(null, response.data.projection, scope);
+  // Display view.snapshot as untrusted text. This helper never executes anything.
+}
+```
+
+The same request uses `/command` on the existing authenticated local service.
+Reads remain available while admission is busy or paused. The host checks the full
+task-account run set against the selected session before reading run journals or
+artifacts; mixed-session accounts fail closed. An older requested run identifies
+the task, but `observedRunId` and `historicalRequest` explicitly identify its latest
+recorded run. Missing runs never turn an earlier delivery into the current result.
+
+The strict DTO carries:
+
+- Contract revision/digest, retained operator objective with provenance, run revision
+  and durable execution status. No provider response or hidden reasoning is included.
+- Observed and delivered snapshot digests, contract path labels, and current/stale/
+  missing correspondence. No arbitrary file path or artifact-content request exists.
+  Artifact references stay under the same project/session/run read boundary.
+- Checks reconciled against the current contract, exact native bytes and completed
+  tool journal. `structure: verified` is deterministic evidence only; semantic review
+  stays `pending` and final acceptance stays `not_recorded`. Human requirements retain
+  their canonical `pending` state. Execution completion is never human acceptance.
+- Authoritative confirmed/reserved/unknown token quantities, remaining allowance,
+  frozen limits and account revision. Reservations are admission estimates, not
+  confirmed consumption; a separate token estimate is not recorded. Monetary
+  confirmed-call estimates, reservations and unknown exposure remain estimates, not
+  invoices. Unknown quantities stay null/unknown, never invented zeros.
+- Read-only/recorded/unknown effect counts and missing-evidence flags. Provider stop
+  remains unconfirmed. Next action explains wait/reconciliation/review/explicit
+  continuation, preserves contract/receipts/budget/effects and never grants execution
+  authority or automatic replay. A persisted running status alone does not prove a
+  live worker; uncertain finalization requires reconciliation.
+
+Genuine legacy contracts without a task account show `legacy_not_enabled` and null
+budget values. An existing account with a missing binding, an unreadable bound
+account, incomplete backup, or conflicting identity is an error, not legacy mode.
+HAR55/56 acceptance, HAR58 evidence principles and HAR70/71/72 ledgers/receipts remain
+the authority; this DTO stores no alternate ledger or acceptance state.
+
+Snapshots are derived on demand and revalidated before publication. The host bounds
+the serialized DTO to 64 KiB, each display string to 2,048 UTF-16 code units (with an
+explicit truncation flag), check/review lists to 32 and contract path labels to 256.
+Oversized evidence fails closed. Only allowlisted fields leave the host; roots,
+known secrets and credential patterns are redacted before publication. In-process
+hosts supply `taskProjectionSensitiveValues`; the local service includes its token,
+configured sensitive values and relevant credential environment values. Redaction
+does not make arbitrary workspace text trusted or HTML-safe.
+
+### Replay and reconnection
+
+`sequence` is assigned at read admission within `connectionId`, not at completion.
+The pure browser-compatible reducer only replaces a snapshot in the caller's
+negotiated connection/project/session/run scope. Duplicate and older responses are
+ignored; conflicting duplicates, unsupported versions and wrong epochs request a
+fresh read. It never adopts a connection ID from an incoming response.
+
+Existing activity events are invalidations, not task snapshots or instructions to
+execute. After a relevant page, read `task.get` again. A repeated/out-of-order event
+may cause another harmless read; it cannot recreate effects. When `/events` reports
+`cursorExpired`, discard assumptions derived from missing history and obtain a new
+task snapshot. After service restart, negotiate again, set the expected epoch and
+read durable state; never replay mutations or accept old-epoch snapshots. This is
+snapshot convergence, not a new event store, streaming protocol or delivery guarantee.
+Callers should coalesce refreshes and retry a changing snapshot with a bounded policy.
+
+### Finite task errors
+
+Task-read errors add `taskDiagnostic` to the existing error envelope, with a finite
+cause, `impact: projection_unavailable`, and the action below. Raw exception text,
+paths, provider payloads and journals are excluded. Malformed command shapes retain
+the existing `INVALID_REQUEST` envelope. Unsupported versions never execute work.
+
+| Cause | Client code | Safe action |
+| --- | --- | --- |
+| UNSUPPORTED_VERSION | VERSION_UNSUPPORTED | review_configuration |
+| OUT_OF_SCOPE | NOT_FOUND | review_configuration |
+| UNSUPPORTED_HOST / CONTRACT_UNAVAILABLE | INVALID_STATE | review_configuration |
+| EVIDENCE_UNAVAILABLE | INVALID_STATE | reconcile |
+| SNAPSHOT_CHANGED | REVISION_CONFLICT | retry_read |
+| PAYLOAD_LIMIT | CAPACITY_EXCEEDED | review_configuration |
+
+Inside a successful projection, terminal failure/cancellation/timeout and incomplete
+evidence have separate finite diagnostics with `acceptance_not_established` impact.
+No diagnostic recommends replaying an uncertain operation. This cut supports one
+trusted native workspace/SQLite writer and sequential host handoff only. OCI task
+projections, multiagent scope, new document/web adapters and final semantic/human
+acceptance are unsupported; legacy execution APIs are unchanged.
+
+### Reproducible installed consumer
+
+Build and pack Harness and Code from the same clean candidate following their
+normal build instructions. The existing HAR75 installer accepts an optional sixth
+argument selecting the HAR73 profile; it freezes/rechecks consumer, manifest and
+tarball hashes and verifies Code/service share the installed engine:
+
+```sh
+node scripts/task-recovery-lab-installed.mjs /tmp/harness.tgz /tmp/code.tgz \
+  /absolute/path/to/node /tmp/projection-node 90000 projection
+```
+
+Repeat with supported Node 22/24 and Bun. `evaluations/task-projection.json` fixes
+the reused HAR75 fixture and ten consumer scenarios: version negotiation, readonly
+snapshot, redaction, duplicate/out-of-order responses, artifact scope, expired cursor,
+paused admission, fresh-epoch restart, artifact drift and legacy budget. Source
+regressions additionally exercise corrupted/missing bindings and runs, changing
+snapshots, read admission races, active mutations and payload limits. These are offline
+contract tests, not CODE-05 UI acceptance, live-model quality or an external pilot.
 | checkpoint.list | projectId, sessionId | checkpoints | NOT_FOUND |
 | checkpoint.inspect | projectId, sessionId, checkpointId | checkpoint | NOT_FOUND |
 | checkpoint.capture | projectId, sessionId, expectedRevision, idempotencyKey, turnId, paths | checkpoint | EXECUTION_FAILED |
@@ -273,3 +406,48 @@ It omits command argv, repository output and arbitrary tool payloads.
 or human acceptance. Existing status/exit-code and schema-version contracts remain
 unchanged. Code inspection/export derives the same safe projection from completed
 tool-journal entries; the engine inspection API signature is unchanged.
+
+
+## Task controls (CODE-HU-05, experimental)
+
+Negotiate `task.control.v1` and each command before showing mutation controls.
+The strict command schema remains protocol v1. The host creates the contract;
+clients cannot supply a contract, receipt, budget ledger or execution grant.
+
+| Method | Additional input | Result |
+| --- | --- | --- |
+| `task.start` | session, expectedRevision, idempotencyKey, bounded brief with goal/paths/checks/constraints and explicit input/output/total token limits | run |
+| `task.review` | session, run | taskReview |
+| `task.keep` | session, run, reviewId, idempotencyKey | task + humanDecision |
+| `task.revise` | same review binding + correction (1–500 characters) | task + humanDecision |
+| `task.continue` | same review binding + prompt (1–2000 characters) | run |
+
+A taskReview contains a redacted bounded Git diff, fresh projection, allowed
+actions, a `complete` flag, operator-decision status and a five-minute, one-use host token. Tokens
+bind connection, session, run revision, contract, current snapshot, task budget
+revision and Git status/diff identity. The web host additionally binds tokens
+to its authenticated browser identity and workspace. Missing, consumed, expired
+or changed reviews fail closed. Hidden/truncated review content cannot enable keep. A command retry with the same idempotency key
+returns its existing response; a renderer must read state after a lost response,
+never manufacture another mutation key automatically.
+
+Keep records `humanDecision` with `explicit_operator_review` provenance under
+task-account exclusion and run CAS. It does not change the projection's semantic
+pending/acceptance-not-recorded fields, commit files or imply independent human
+quality measurement. A changed contract or snapshot makes the record stale.
+Revise appends a bounded pending human requirement without executing work.
+Continue uses the original durable account and rechecks the reviewed admission
+tuple inside runtime continuity; it cannot replenish credit or replay uncertainty.
+Ordinary run.start is rejected in sessions retaining governed task authority.
+
+A continuation rejected before admission can have a failed session attempt with
+a host-owned reference to its prior admitted run. Reads resolve this reference
+only within the same session and only when the attempt is absent from the budget
+account. The projection preserves the requested runId, exposes observedRunId and
+historicalRequest, and retains stale/missing checks honestly. New review commands
+must target observedRunId. No budget admission or consumption is fabricated.
+
+Migration: fields and commands are additive and experimental. Existing projection
+version 1, legacy chat and exact tool approvals remain intact. Match host and Code
+builds; unsupported hosts display an unavailable task-control state. See
+[Code web tasks](CODE_WEB_TASKS.md) for native workspace limits and offline QA.

package/docs/CODE_RELEASE.md

@@ -1,6 +1,47 @@
 # Code release procedure
 
-## Current stable preparation: 2026-10-09
+## Pending patch: 2026-10-16
+
+The source version is `1.5.0`, pending publication to `latest`. This checkout
+prepares Harness `1.5.0` and Code `0.4.0` for npm `latest`, with Code pinned
+exactly to the engine and private Desktop bound to the same Harness version.
+Published `latest` is Harness `1.4.1` and Code `0.3.2`. It adds the `v1.5.0`
+representative mapping with the same Meta, Qwen and OpenAI models as `v1.4.1`
+and does not change provider/API tiers. Annotated `v1.5.0` then `code-v0.4.0`
+on the same reviewed main SHA, `channel=latest`, run through the unchanged
+protected workflows and their environment approvals.
+
+## Pending patch: 2026-10-14
+
+This checkout prepares Code `0.3.1`, pinned exactly to Harness `1.4.1`, for npm
+`latest`. Published Code `0.3.0` and Harness `1.4.0` are the current `latest`
+packages. Published npm `next` is Code `0.3.0-rc.8` and Harness `1.4.0-rc.8`.
+The Vertex transient-failure retry and explicit monetary output caps shipped in
+Code `0.3.0` / Harness `1.4.0`. This patch keeps the narrow composer readable,
+says when you rejected an operation, checks Node before startup, describes
+command reviews as commands, and shows web limits in English. The local browser
+retries reconciliation when a command finishes during reconnect. That patch
+moved Core to 1.33.0 for private-host checks. Unreleased Bedrock and Azure
+OpenAI routes pin Core 1.34.0. Anthropic 0.14.0, OpenAI 0.16.0 and Vertex 1.2.7
+replace the previous adapter pins; Agents, Qwen, Meta and Gemini stay as they
+are on main. Optional `@napi-rs/keyring` is 2.1.1. Approval and transport
+protections and provider/API tiers stay unchanged.
+Desktop stays private alpha with the same engine binding. The 1.4.0 preparation
+below remains historical; its evidence does not certify or authorize `0.3.1`.
+
+This preparation creates no tags, paid calls, campaign dispatch or publication.
+After review and user integration, require all four successful exact-main workflows
+(`ci.yml`, `codeql.yml`, `code-journey.yml`, `web.yml`) and direct-main CodeQL.
+New explicit campaign/publication authority is required before any Harness
+`v1.4.1` or Code `code-v0.3.1` tag/dispatch. Harness must first pass its
+unchanged protected exact-artifact, OCI, live and representative gates and actual
+registry integrity/provenance verification. Code's protected OIDC workflow then
+uses the matching reviewed SHA with `channel=latest`, `mode=oidc` and explicit
+confirmation, resolving the actual published Harness dependency without overrides.
+Retained-artifact terminal/web, four-manager acceptance and registry bytes with
+source-bound provenance remain mandatory. Preserve published `next` and all history.
+
+## Previous stable preparation: 2026-10-09
 
 This checkout prepares Code `0.3.0`, pinned exactly to Harness `1.4.0`, for npm
 `latest`. Published Code `0.2.0` and Harness `1.3.0` on `latest` remain
@@ -248,9 +289,17 @@ support remain unchanged; estimated budgets are not guaranteed financial caps.
    verification as ordered in [the Harness release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md).
    From a clean checkout of that main commit, create an annotated
    `code-v0.2.0` tag and push it. Never move or overwrite release tags.
-4. Dispatch `release-code.yml` **at that tag**, with input `tag` matching it and
-   `channel=latest`, `mode=oidc`, and `confirm_publication=true`. Dispatching
-   main while supplying a different tag is rejected.
+4. Dispatch `release-code.yml` **from that exact tag ref**, with input `tag`
+   matching it and `channel=latest`, `mode=oidc`, and `confirm_publication=true`.
+   A no-permission job is defense in depth, not the trust boundary, because
+   GitHub loads it from the dispatched ref. When it still runs, it requires
+   `GITHUB_REF` to be exactly `refs/tags/code-v0.2.0`, resolves that annotated
+   tag to the workflow commit, and requires the commit to be reachable from
+   `main` before provenance OIDC, provider-free validation, or npm publication
+   starts. Dispatch from `main` or any other ref is rejected, including when
+   the commit matches the tag. Publication still depends on the `npm`
+   environment allowing only selected `v*` and `code-v*` tags, and on the tag
+   ruleset in [Public repository security](PUBLIC_SECURITY.md).
 
 ```sh
 gh workflow run release-code.yml --ref code-v0.2.0 \
@@ -320,10 +369,13 @@ In npm package settings, configure GitHub Actions with organization `Zhivex`,
 repository `zhivex-harness`, workflow filename `release-code.yml`, and environment
 `npm`. Enable the allowed action `npm publish`; the OIDC job uses direct
 publishing after GitHub approval, not `npm stage publish`. Preserve the GitHub
-environment's required human approval. Then prepare a
+environment's required human approval and the selected-tag deployment rule in
+[Public repository security](PUBLIC_SECURITY.md). That environment rule, with
+the maintainer-only tag ruleset, is the trust boundary. The in-repo resolver is
+defense in depth, not the trust boundary. Then prepare a
 new Code stable or RC version and annotated tag through the same PR and main CI process.
-Dispatch its tag with the matching channel, `mode=oidc` and
-`confirm_publication=true`. Stable versions require `latest` and a stable exact
+Dispatch the workflow from that exact tag ref, with the matching channel, `mode=oidc` and
+`confirm_publication=true`. A dispatch from `main` is rejected. Stable versions require `latest` and a stable exact
 Harness dependency; canonical RC versions require `next`. Version/channel drift
 fails before engine downloads. An RC may pin a stable engine. Stable publication
 does not upgrade beta/experimental APIs, provisional providers or Desktop alpha.