@zhivex-ai/harness 1.4.0 → 1.5.0

package/docs/CODE_WEB_TASKS.md

@@ -0,0 +1,116 @@
+# Code web tasks — CODE-HU-05
+
+Canonical story: https://app.notion.com/p/3ef777b104f681309854c8f1e73803f1.
+This screen sits on the experimental task evidence read (`task.get` /
+`task.projection.v1`) and the experimental task controls (`task.control.v1`).
+It extends the existing browser in `packages/web`, packaged by `packages/code`.
+It does not create a second client, an IDE, a file tree, an SDK patch, or a release.
+An operator reviews the host evidence and explicitly accepts that snapshot before
+treating the delivery as acknowledged. Continuation is a separate confirmed
+action on a fresh review ticket; model prose and a completed run are not acceptance.
+
+## Operator flow
+
+1. Open `zhivex-code web`, open Sessions, choose an allowed project and create an empty session.
+   Choose **Define task**. Enter the goal, exact existing editable files, package
+   checks and explicit input/output/total token limits for the entire task.
+2. Review each proposed edit or check through the existing exact approval controls.
+   Mark every changed file viewed before approval. Execution, deterministic
+   checks, and human acceptance remain separate statuses.
+3. Open **Result, checks and provenance** for paths, contract/current-byte identity,
+   required checks and human requirements. The renderer displays host evidence;
+   assistant prose does not establish a passing check or permission.
+4. Open **Task budget and continuation** for confirmed usage, reservations,
+   unknown held exposure and remaining tokens. The account covers all task turns;
+   do not add its values to the existing per-run monitor. Missing pricing stays
+   unknown; monetary values are estimates, never invoices.
+5. Choose **Review task** to obtain a bounded fresh Git diff and a five-minute
+   review ticket. Explicitly acknowledge the diff and requirements before
+   **Accept this snapshot**. This records operator acknowledgement separately
+   from engine checks; it does not commit, merge or assert measured quality.
+6. **Correct requirements** adds a pending requirement without a model call.
+   **Continue task** requires another explicit instruction and confirmation.
+   Both preserve the original account; continuation may consume its remaining
+   credit for model/compaction work, approved edits and checks. Back, Escape,
+   Close, reload and reconnect do not execute work.
+
+## Interruption and handoff
+
+Cancel initially means requested, not confirmed. A confirmed local cancelled run
+does not prove provider termination. Missing provider usage retains unknown
+exposure and blocks continuation. A lost/failed command response requires reading
+state through Reconnect; it is never automatically retried. Relaunch reopens the
+same durable task, contract, checks, budget and effects without depending on the
+chat transcript or claiming human minutes.
+
+The runtime records the first interruption source while relaying its signal;
+nested cancellation signals cannot change a caller cancellation into an
+unclassified failure. It settles local interruption only after the execution
+owner releases its lease. The session index can observe `cancel_requested`
+directly from `created` when busy reads have not yet observed `running`.
+Neither change confirms provider termination or releases unknown exposure.
+
+A continuation rejected before admission retains a failed session attempt linked
+to its previous admitted task. The panel explicitly identifies retained evidence;
+checks stale against changed bytes cannot authorize acceptance. The rejected
+attempt does not fabricate budget admission or consumption. A fresh review targets
+the observed admitted run and must satisfy current host checks again.
+
+## Authority and limits
+
+- The browser sends a bounded operator brief, never a contract, receipt, policy,
+  credential, ledger or execution grant. The host resolves package checks and
+  compiles the existing task contract.
+- Initially native Unix workspaces only: clean Git baseline, selected tracked
+  visible files (at most 20, each at most 64 KiB), at most eight package checks,
+  no subagents. Existing exact edit/check approvals remain mandatory.
+- Reviews bind browser identity/workspace, service connection, session, run
+  revision, contract, snapshot, budget revision and Git identity. They are
+  one-use and expire after five minutes. Account exclusion plus run CAS protects
+  acceptance; continuation rechecks admission after host preparation.
+- Git failure, process-output truncation, oversized review, hidden files,
+  missing/changed receipts or uncertain effects fail closed. The diff is plain
+  escaped text with host-path/secret redaction. Redacted or truncated review
+  content disables acceptance. No arbitrary file-reading route
+  or generic browser command dispatcher is added.
+- The existing public projection reducer ignores duplicate/older snapshots,
+  rejects changed epochs/scopes and requests refresh for conflicts. Task reads
+  are sequential and cancelled on selection changes. Existing activity cursor
+  expiry recovery is retained; no activity event grants mutation authority.
+- Ordinary chat remains available in ordinary sessions. Once task authority is
+  retained, `run.start` cannot bypass task continuation/accounting. Older hosts
+  without negotiated controls show an unsupported state.
+
+## Offline acceptance and reproducibility
+
+The frozen HU75 greeting fixture remains SHA256
+`473a9e2144b0042b1b46ef54f915de693045df89d6175bde42a3393d2b083263`.
+`packages/web/scripts/task-browser-journey.mjs` drives actual packaged Code and
+Chromium at desktop/mobile sizes. Its preload replaces provider fetch with a
+synthetic transport and blocks every other fetch; it does not fabricate SDK
+state, tool receipts or check outcomes. `node check.mjs` and exact approvals run
+through the real host/service/engine. This is automated operator input, not a
+human pilot or semantic-quality measurement.
+
+The integrated installed runner binds clean source, exact Harness/Code tarball
+hashes and their shared installed engine. It runs the existing recovery/projection
+consumers plus the Code UI journey, then verifies hashes and cleanup. Preserve
+all initial failures separately; only final reports for the exact reviewed SHA
+certify that candidate. Browser fixtures cover normal acceptance, multiple tabs,
+obsolete review, edit/back/Escape, explicit continuation/double click, workspace
+switch, unknown usage on cancellation, reload and process restart. Existing Web
+security/browser gates and projection reducer tests cover host/CSRF/path boundaries,
+expired cursors, stale epochs, reordered/duplicate pages and unavailable evidence.
+
+Run the source suites and existing browser regression before the installed runner:
+
+```sh
+node scripts/code-task-ui-installed.mjs /absolute/harness.tgz /absolute/code.tgz /absolute/node /absolute/evidence
+```
+
+The runner requires a clean source checkout and uses an explicit exact candidate
+engine override in its isolated npm consumer; published pins remain unchanged.
+Use `CI=1`, `umask 022` and the repository-required test policy root. Human minutes,
+real quality, real costs and external-team outcomes remain unmeasured. A real
+3–5-team pilot and any paid provider campaign need separate authorization; this
+change does not authorize HU74, a release or promotion to latest.

package/docs/CONTEXT_ENGINEERING.md

@@ -451,3 +451,62 @@ unchanged; the model must issue a corrected request, and edits still require
 current read evidence and approval.
 
 Project memory is a separate kind of explicit operator context in the existing durable memory table. It is projected per request as untrusted data, with revision-based review and hard byte/entry budgets. It does not become project instructions or skills. See [Project memory](PROJECT_MEMORY.md).
+
+### Semantic compaction with bounded subagents
+
+When semantic compaction and subagents are enabled without a shared budget
+coordinator, Harness uses serial tool execution. This follows the SDK's supported
+combination and retains its rejection of paid compaction with uncoordinated
+parallel children. Callers cannot enable that incompatible combination by setting
+`toolExecution.parallel` alone. Other runs retain their existing scheduling.
+
+Applications can opt in to a shared token pool through the Beta
+`HarnessRunOptions.sharedBudget` option:
+
+```ts
+const result = await runHarness(harness, {
+  runId: "bounded-inspection-42",
+  prompt: "Inspect and review the API boundary."
+}, {
+  sharedBudget: {
+    modelReservation: {
+      inputTokens: 20000, outputTokens: 1000, totalTokens: 21000
+    },
+    childModelReservation: {
+      inputTokens: 10000, outputTokens: 1000, totalTokens: 11000
+    }
+  }
+});
+```
+
+These example reservations are host-owned conservative bounds for each request,
+not recommended limits for every model or task. Choose them for the admitted
+route and context. The SDK coordinator reuses the configured parent input,
+output and total ceilings, atomically admitting primary calls, child lifetime
+allocations and auxiliary compaction. Each child has an SDK subpool inside its
+parent allocation. There is no second Harness token ledger. A child allocation
+that cannot fit fails before its model dispatch; unused or unknown consumption
+is not converted into a fresh allowance. An individual model request is capped
+at the reserved output, and an estimated input request above its reservation is
+rejected before transport. The estimator is not a provider tokenizer or a billing
+guarantee; actual over-reservation receipts are recorded and rejected by the SDK
+before tool execution. Unknown receipts keep their allocation held.
+
+Child allocations must satisfy the SDK's component-sum contract. Under the
+existing default child ceilings (30000 input, 8000 output, 36000 total), shared
+execution narrows the input allocation to 28000. It preserves the 36000 total
+and 8000 output authorization; it never increases the total to 38000. The narrowed
+budget is visible in the child runtime manifest. Legacy execution retains its
+configured child ceilings.
+
+The option requires finite token limits and uses the Harness scope. A resumed
+run must use its original reservation policy and complete SDK budget ledger;
+changing the policy, opting an existing legacy run into a fresh pool or restoring
+only a run snapshot fails closed. Supply the same option on approval resumes.
+The SDK also prevents resuming a bound run without its coordinator. Unknown
+compaction or reservation consumption still requires operational reconciliation;
+this tranche does not add a reconciliation API or clear reservations automatically.
+Qwen routes are excluded from this option until an output-cap route is certified.
+It does not add a service/wire-protocol field or enable this token pool for
+application-owned review groups. Monetary accounting and its existing output
+clamp remain separate. No provider calls are required by the regression suite.

package/docs/CREDENTIALS.md

@@ -68,6 +68,27 @@ the console offers to use the saved destination for this session or cancel. It n
 sends a managed key to an arbitrary shell-defined endpoint. Custom endpoints still
 require explicit environment credentials.
 
+## Amazon Bedrock
+
+Converse does not store an API key. Set `AWS_REGION` or `AWS_DEFAULT_REGION` in
+the launching environment and leave credentials to the AWS SDK default chain.
+`AWS_PROFILE` selects a profile through that chain. The credentials screen
+explains this and does not write a key.
+
+`BEDROCK_RUNTIME=openai` requires an https `BEDROCK_OPENAI_BASE_URL`. The key
+may be `BEDROCK_API_KEY` or `AWS_BEARER_TOKEN_BEDROCK` in the environment, or a
+keychain/temporary `BEDROCK_API_KEY`. The base URL is not an override that
+blocks a managed key. See [Bedrock](BEDROCK.md).
+
+## Azure OpenAI
+
+Set an https `AZURE_OPENAI_ENDPOINT` before saving a key. Optional
+`AZURE_OPENAI_API_VERSION` and `AZURE_OPENAI_DEPLOYMENTS` stay in the
+environment and are not written to the keychain. A managed
+`AZURE_OPENAI_API_KEY` is allowed together with that endpoint. Published
+`@zhivex-ai/azure-openai@0.7.8` accepts a token provider, and this route still
+stores and sends the API key. See [Azure OpenAI](AZURE_OPENAI.md).
+
 ## Qwen interactive setup
 
 Open `/credentials` → Qwen → save or temporary → Standard API or QwenCloud Token

package/docs/DURABLE_OPERATIONS.md

@@ -70,7 +70,7 @@ Loading a run reconstructs its complete state for compatibility with approvals,
 
 Logical backups contain hydrated history rather than database references, so restoration does not require the original artifact tables. Exports up to 64 MiB retain the legacy JSON format; larger exports use the versioned `ZHIVEX-STATE-SEGMENTS-1` transport with bounded frames, including split strings. RC13 reads both formats and verifies the same logical checksum before import. Older versions cannot read segmented exports. File I/O and checksum serialization are incremental; the public backup/import APIs still hydrate the complete logical bundle in memory. Segmented files have no aggregate 64 MiB ceiling. A state-limit failure records a bounded terminal diagnostic on the last durable checkpoint; the unsaved payload is not claimed as preserved. Use `/status` to inspect the failed run before `/continue`. Recovery retains tool journal receipts and never re-executes an operation itself.
 
-The current candidate pins Core 1.31.0 and Agents 1.11.0. New stores require no
+The current source pins Core 1.34.0 and Agents 1.11.0. New stores require no
 conversion. Before upgrading an existing shared SDK store, stop its workers and
 upgrade them together with a complete backup. Verified legacy runs retain their
 physical keys and remain readable; new runs use canonical keys that distinguish
@@ -277,3 +277,95 @@ approvals, and provider per-request limits remain enforced. Stored numeric token
 ceilings are inactive until `unlimitedTokens` is set back to `false`.
 
 Next-version [project memory](PROJECT_MEMORY.md) reuses the existing SDK memory table and state export records. Historical state is not harvested into curated memory. Forget/clear remove current memory content, while backups, run histories and SQLite WAL retention remain separate. Older importers reject the new reserved memory key safely.
+
+## Durable review groups (Beta)
+
+`runHarnessReviewGroup` retains its ephemeral v1 contract. Applications can opt in
+through `runHarnessDurableReviewGroup(harness, { groupId, prompt })`. The new API
+uses the Harness scope, an application-owned root and a fixed roster of at most
+two read-only explorer/reviewer members. This first implementation schedules
+members serially. It requires a store with atomic idempotency claims, CAS saves
+and fenced acquire/renew/release leases; the default SQLite backend supports them.
+Custom stores must honor these contracts. No database schema migration is needed.
+
+```ts
+import {
+  runHarnessDurableReviewGroup,
+  inspectHarnessReviewGroup,
+  cancelHarnessReviewGroup
+} from "@zhivex-ai/harness";
+
+const result = await runHarnessDurableReviewGroup(harness, {
+  groupId: "review-request-42",
+  prompt: "Inspect the public API boundary."
+});
+const snapshot = await inspectHarnessReviewGroup(harness, result.groupId);
+// Cancellation can be requested from another worker using the same scope/store.
+const cancellation = await cancelHarnessReviewGroup(harness, result.groupId);
+```
+
+A repeated ID must have the same prompt, ordered profiles, scope and member
+runtime bindings. A mismatch fails before a model request. Completed members
+replay their durable receipts; an interrupted group resumes the original member
+IDs. A concurrent caller receives a retryable state conflict while the group
+worker lease is held. After a worker dies, wait for lease expiry before retrying.
+Inspection reconstructs results without executing a member. Keep the complete
+state store when backing up or restoring; deleting a root or member is not a
+supported way to reset a request.
+
+Execution statuses include `blocked`, `partial`, `waiting_approval`, `suspended`,
+`timed_out`, `cancel_requested` and `cancelled`. `partial` means all members are
+terminal and some completed while others did not. Completion describes execution;
+existing evidence and acceptance contracts still determine acceptance. The root
+is visible to ordinary run inspection; its SDK status maps `partial` to `failed`,
+and `blocked` maps to `suspended`, with the richer value in `harnessReviewGroupStatusV1`. Use group inspection for
+the full result. Approvals are not automatically resumed by this API.
+
+Cancellation records intention under the same fenced root lease used for fresh
+member admission. Each admission is recorded before claiming a child checkpoint.
+Subsequent model requests also check the root before dispatch. Already admitted
+requests can finish late; cancellation does not roll back an external effect.
+Terminal children are preserved, and active children receive durable cancellation
+requests. Inactive queued, approval or suspended checkpoints become cancelled.
+Once the group worker sees an in-flight member return, a child left at
+`cancel_requested` is settled to `cancelled` before the root snapshot is saved.
+Inspection while that request is still in flight stays `cancel_requested`.
+Confirmation requires every admitted child to have a terminal checkpoint. A cut
+between recorded admission and child persistence remains `cancel_requested`
+because the claim is uncertain; this tranche does not provide an automatic
+reconciliation API for that cut. Repeated cancellation rechecks the fixed roster.
+
+Generic cancellation of the root also closes group admission, but callers should
+use the group cancellation API to preserve terminal member receipts; the SDK
+'s generic tree-cancellation semantics are unchanged.
+
+This fence applies to the opt-in application-owned review group. It does not fix
+the SDK's general parent/subagent admission and cancellation primitives. No
+exactly-once guarantee for external effects, distributed scheduling or research
+workflow acceptance is implied. Model tests use only offline mocks. Regressions
+in `tests/durable-review-group.test.ts` cover repeated identity, interruption,
+terminal preservation, concurrent callers and separate-process SQLite control.
+
+Terminal replay reconciles the root's persisted status, member summaries and richer
+group status before returning, including recovery after a cut following child
+completion. Cancellation also reconciles its reconstructed projection. Internal
+worker checkpoints are children of the group: they become `running` while leased,
+`suspended` after an interrupted or blocked attempt, and terminal only after the
+root's terminal projection is persisted. Recovery repairs an idle legacy worker
+without taking ownership from a live worker. Default terminal cleanup can collect
+finished groups and their workers; suspended coordination remains resumable.
+
+New member records include an optional `checkpointed` marker, saved after the SDK
+child claim and before request dispatch. If a previously persisted child disappears,
+recovery blocks before transport and requires the complete backup. Existing records
+without that marker remain readable; admitted members with missing receipts are
+conservatively blocked. Admission and model dispatch also recheck receipt presence
+under the root lock, so a stale caller snapshot cannot bypass the guard. Cleanup
+while a group is active can remove an older terminal child's receipt and leave the
+group blocked; it must not be used to reset or restart that child. Cancellation may
+remain uncertain in this case. Retention deleting the entire group expires its
+stored identity; no permanent deduplication beyond retained state is promised.
+
+Groups modified by the checkpoint-marker fix require a current artifact. Older
+artifacts with strict pre-marker schemas cannot read the additional marker;
+downgrades require restoring a complete pre-upgrade backup.

package/docs/ENGINE_API.md

@@ -1,7 +1,7 @@
 # Engine API and Code integration
 
-This checkout adds terminal-independent package entrypoints for
-Harness 1.3.0 (published and verified on `latest`). They are not present in the previously published Harness 1.2.0.
+The terminal-independent package entrypoints shipped in Harness 1.3.0 and remain
+in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.5.0, pending publication. They are not present in Harness 1.2.0.
 The protected workflow validated the exact stable tarball, live gates and
 registry integrity/provenance; local candidate smoke remains contributor evidence. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.
@@ -18,6 +18,7 @@ expect the new entrypoints to exist.
 | `@zhivex-ai/harness/code-support` | Named host helpers used by Code, including a read-only SQLite diagnostic projection | Node |
 | `@zhivex-ai/harness/models` | Beta catalog schemas, bundled metadata, model selection and display helpers; no host loading | Browser or Node |
 | `@zhivex-ai/harness/mcp/stdio/v1` | Experimental host admission, isolated MCP sessions, recovery and reconciliation; see [host flow](MCP_STDIO.md) | Node or Bun |
+| `@zhivex-ai/harness/audit` | Experimental audit pack export and HMAC verification; see [audit pack](AUDIT_PACK.md) | Node |
 | `@zhivex-ai/harness/desktop/v1/state` | Versioned host-only snapshot, validation, safe-file-read and lease handoff operations for Desktop updates | Node |
 
 [`contracts/engine-api.json`](../contracts/engine-api.json) enumerates every named
@@ -208,6 +209,8 @@ Publishing Code requires a compatible Harness release, authenticated scope/name
 verification and the release compatibility gates in
 [ADR 0001](https://github.com/Zhivex/zhivex-harness/blob/main/docs/adr/0001-harness-code-public-boundary.md).
 Local packing does not establish npm permissions or public availability.
+The additive [task projection v1](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73) exposes existing task evidence through the client/service without moving execution or judgment into a renderer. `/protocol` exports its bounded schema and pure snapshot reducer.
+
 ## Experimental task acceptance contracts
 
 `runHarness(host, input, { taskAcceptance })` accepts application-owned requirements

package/docs/EXTENSIBILITY.md

@@ -4,11 +4,11 @@ Zhivex Harness `0.11.x` combines governed external tools and bounded multi-agent
 
 ## Provider registry
 
-Built-in registrations are Meta, Qwen, OpenAI, and Gemini. Each registration owns its descriptor, default model, credential names, capability/support labels, factory, and declarative diagnostics. The registry never dynamically imports provider code or returns credential/endpoint values from diagnostics.
+Built-in registrations are Meta, Qwen, OpenAI, Gemini, Anthropic, Vertex, Amazon Bedrock, and Azure OpenAI. Bedrock and Azure OpenAI are provisional and are not part of the default live certification cohort. Each registration owns its descriptor, default model, credential names, capability/support labels, factory, and declarative diagnostics. The registry never dynamically imports provider code or returns credential/endpoint values from diagnostics.
 
 Library callers can use `DEFAULT_PROVIDER_REGISTRY`, `BUILTIN_PROVIDER_REGISTRATIONS`, `createProviderRegistry`, or `DEFAULT_PROVIDER_REGISTRY.extend(...)`, then pass the registry to `resolveHarnessConfig`, `createProviderModel`, provider diagnostics, or `createHarness({ providerRegistry })`. Registration IDs, environment-variable names, defaults, diagnostics, and factories are validated before they become selectable.
 
-The coordinated stable SDK batch pins `@zhivex-ai/agents@1.11.0`, `@zhivex-ai/core@1.31.0`, `@zhivex-ai/meta@0.2.9`, `@zhivex-ai/qwen@0.16.4`, `@zhivex-ai/openai@0.14.1`, `@zhivex-ai/gemini@0.13.0`, `@zhivex-ai/anthropic@0.13.2`, and `@zhivex-ai/vertex@1.2.4`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.31.0 satisfies the updated Agents, Anthropic, OpenAI and Vertex `^1.30.0` ranges and Qwen `^1.29.0` range. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
+The coordinated stable SDK batch pins `@zhivex-ai/agents@1.11.0`, `@zhivex-ai/core@1.34.0`, `@zhivex-ai/meta@0.2.9`, `@zhivex-ai/qwen@0.16.4`, `@zhivex-ai/openai@0.16.0`, `@zhivex-ai/gemini@0.13.0`, `@zhivex-ai/anthropic@0.14.0`, `@zhivex-ai/vertex@1.2.7`, `@zhivex-ai/bedrock@2.0.7`, and `@zhivex-ai/azure-openai@0.7.8`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.34.0 satisfies Agents, OpenAI and Vertex `^1.31.0`, Anthropic `^1.30.0`, Qwen `^1.29.0`, and the provisional Bedrock and Azure OpenAI `^1.34.0` ranges. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
 
 OpenAI is based on the GPT-5.6 family: `gpt-5.6-luna` is the default, with `gpt-5.6-terra` and `gpt-5.6-sol` available through `--model`. Availability remains organization-dependent while the upstream family is in limited preview, and the adapter uses the Responses API by default.
 
@@ -81,14 +81,18 @@ Library callers can inject a custom `McpClient`. Trusted read-only annotations a
 
 ## MCP result boundary
 
-MCP descriptions and results are untrusted. The harness:
+MCP descriptions and results are untrusted data, including text that looks like an identifier, digest, or configuration value. The harness:
 
 - bounds discovery pages, discovered tools, time, and response bytes;
 - validates declared input and structured-output schemas through the SDK MCP registry;
 - propagates abort signals, timeout intent, and idempotency keys;
 - rejects common prompt-injection directives before they enter model context;
 - records server permissions and risk in tool metadata;
-- promotes network, write, or external-side-effect calls to durable interrupt approval.
+- promotes network, write, or external-side-effect calls to durable interrupt approval;
+- removes exact secret values before a result is published;
+- when a server was admitted with secret references, flags known encodings of those secrets and other high-entropy encoded tokens in tool results.
+
+That flagging is optional and incomplete. Split, encrypted, or low-entropy encodings can still appear. Discovery schemas are rejected rather than rewritten when they contain an exact secret. Treat every MCP result as data, not as instructions and not as proof that a credential is absent.
 
 The injection filter is deliberately conservative and may reject legitimate security documentation containing imperative attack text. Use a separate trusted preprocessing boundary if that content must be analyzed; do not disable the harness boundary for an untrusted server.
 

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets stable `1.4.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.3.0 until that publication.
+This guide targets stable `1.5.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.4.1 until that publication.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.4.0
+npm install -g @zhivex-ai/harness@1.5.0
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.4.0
+bun add --global @zhivex-ai/harness@1.5.0
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.4.0 --version
-bunx @zhivex-ai/harness@1.4.0 --help
-bunx @zhivex-ai/harness@1.4.0 doctor
+bunx @zhivex-ai/harness@1.5.0 --version
+bunx @zhivex-ai/harness@1.5.0 --help
+bunx @zhivex-ai/harness@1.5.0 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/MINIMUM_TASK_AUTHORITY.md

@@ -52,10 +52,10 @@ dispatch/cap behavior, not provider billing guarantees or model quality.
 
 | Route | Direct guided task | Verified wire cap and dispatch boundary |
 | --- | --- | --- |
-| Built-in OpenAI (`@zhivex-ai/openai` 0.14.1) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
-| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.13.2) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
+| Built-in OpenAI (`@zhivex-ai/openai` 0.16.0) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
+| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.14.0) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
 | Built-in Gemini (`@zhivex-ai/gemini` 0.13.0) | Supported | `generationConfig.maxOutputTokens`; `maxRetries=0` |
-| Built-in Vertex (`@zhivex-ai/vertex` 1.2.4) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
+| Built-in Vertex (`@zhivex-ai/vertex` 1.2.7) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
 | Qwen (`@zhivex-ai/qwen` 0.16.4) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
 | Meta | Blocked | Harness continuation fetch can replay a 400 response outside SDK retry admission |
 | Injected/custom adapters, refreshable Anthropic OAuth | Blocked | No vetted transport provenance; OAuth transport can replay a 401 after refresh outside ordinary retry admission |

package/docs/PROJECT_MEMORY.md

@@ -7,7 +7,7 @@ generated automatically; hosts may submit a suggestion for operator review.
 
 ## CLI
 
-Use `zhx` or `zhivex-code` with Harness 1.4.0 (Code 0.3.0), pending publication. Commands
+Use `zhx` or `zhivex-code` with Harness 1.5.0 (Code 0.4.0), pending publication. Commands
 print bounded JSON, including the selected workspace/scope hashes. Quote content
 as one argument. Memory commands do not start a model or read credentials.
 

package/docs/PUBLIC_SECURITY.md

@@ -13,7 +13,9 @@ The repository is public. GitHub documents the following controls as available w
 - CodeQL code scanning on standard GitHub-hosted runners; and
 - standard GitHub-hosted Actions runners.
 
-The repository additionally uses a `main` ruleset with pull-request review, review-thread resolution, linear history, and required CI checks. Repository Actions default to read-only permissions; individual jobs must request any narrower write capability explicitly. The npm publication job is the only workflow path that requests `id-token: write`, and it uses the protected `npm` environment.
+The repository additionally uses a `main` ruleset with pull-request review, review-thread resolution, linear history, and required CI checks. Repository Actions default to read-only permissions; individual jobs must request any narrower write capability explicitly. CI lints `.github/workflows` with actionlint 1.7.12 and shellcheck. The checksum and the shellcheck exceptions for quoted node/bun programs are pinned in `.github/workflows/ci.yml`.
+
+Harness release, Code release, and live certification each call `.github/workflows/resolve-protected-release-ref.yml` from a job with empty permissions and no secrets. The call uses a relative `./` path, so GitHub loads that file from the same commit as the dispatched workflow. An off-main tag or branch can rewrite the resolver or omit the call. The resolver is defense in depth, not the trust boundary. The boundary is external: the `npm` and `live-certification` environments accept deployments only from the selected tag patterns below, and a tag ruleset lets only maintainers create matching tags and blocks updates and deletions. When the dispatched workflow still contains the resolver, it requires `GITHUB_REF` to be exactly `refs/tags/<tag>` for both Harness and Code. It then accepts only an annotated `vX.Y.Z`, `vX.Y.Z-rc.N`, `code-vX.Y.Z`, or `code-vX.Y.Z-rc.N` tag, peels it to a full commit SHA, and continues only when that commit is the workflow commit and an ancestor of `main`. Later jobs check out that SHA. `id-token: write` is requested only on those later jobs: Harness and Code publication on the `npm` environment, Code provenance generation, and Vertex workload identity on the `live-certification` environment. The environment still withholds that token unless the workflow ref is an allowed deployment tag. npm provenance, the Rekor HTTP 409 reuse for an identical DSSE entry, and the registry verification step are unchanged. Pinning `uses:` to a commit SHA in this repository or in another repository does not replace the environment rules or the tag ruleset: the workflow file selected by the dispatched ref still chooses the `uses:` value and can delete the call.
 
 References:
 
@@ -37,3 +39,14 @@ If the repository becomes private or internal, treat every security feature and
 The `live-certification` GitHub environment is the only workflow scope authorized to hold provider credentials. Whether credentials are currently configured is mutable repository state and is intentionally not asserted by this document; maintainers must verify it at dispatch time. Adding or rotating credentials transfers sensitive provider keys into GitHub and requires an explicit maintainer decision.
 
 The release workflow fails closed when those credentials are absent: npm publication depends on the base, orchestration, routing, and model-directed OCI live gates running against the exact annotated release tag and source commit. When credentials are configured, they are exposed only to the final provider-call step; checkout, runtime setup, dependency installation, tag verification, and deterministic OCI validation do not receive them. Local credentials are never copied to GitHub automatically.
+
+## Environment protection to confirm manually
+
+The workflow file cannot create GitHub environment rules or rulesets. Before the next npm publication or live certification, set these repository settings. They are the trust boundary.
+
+- `npm`: required reviewers. Deployment branches and tags must be **Selected tags** with patterns `v*` and `code-v*` only. Do not include `main`, all branches, or any other pattern. This environment remains the Trusted Publishing environment for `release.yml` and `release-code.yml`.
+- `live-certification`: required reviewers. Deployment branches and tags must be **Selected tags** with pattern `v*` only. Do not include `main`, any branch, or `code-v*`. Provider secrets and Vertex variables stay in this environment.
+- Tag ruleset for patterns `v*` and `code-v*`: enable **Restrict creations**, **Restrict updates**, and **Restrict deletions**. Put only the Maintain role on the bypass list, so only maintainers can create matching tags and nobody can update or delete them. Repository admins can still bypass a ruleset unless the organization disables bypass; do not add a broader bypass list.
+- Dispatch Harness release, Code release, and live certification from the exact tag ref (`refs/tags/vX.Y.Z`, `refs/tags/vX.Y.Z-rc.N`, `refs/tags/code-vX.Y.Z`, or `refs/tags/code-vX.Y.Z-rc.N`). A dispatch from `main` or any other ref is not a deployment tag, so these environments do not grant secrets or `id-token: write`. The resolver rejects that ref as well when the dispatched workflow still contains the check, including when the branch commit equals the tag.
+- Approve a deployment only after the resolve job log shows `resolved <tag> to <sha>` and that SHA equals the workflow commit (`github.sha`).
+- Environment patterns are coarse `fnmatch` globs. The resolver's regular expression is stricter, but it runs only when the workflow file on the dispatched ref still calls it. A ref the ruleset and the environment exclude never receives secrets or `id-token: write`, even if its workflow omits the resolver.

package/docs/README.md

@@ -9,6 +9,8 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 - [Usage reference](USAGE.md): scripts, providers and security boundaries.
 - [Model catalog administration](MODEL_CATALOG.md): shared CLI/Desktop recommendations and remote distribution.
 - [Anthropic direct API](ANTHROPIC.md): provisional setup and continuity contract.
+- [Amazon Bedrock](BEDROCK.md): provisional Converse and OpenAI-compatible routes.
+- [Azure OpenAI](AZURE_OPENAI.md): provisional endpoint, deployment, and API-key route.
 - [Credentials](CREDENTIALS.md): system keychain, temporary keys and automation.
 - [Project instructions and context](CONTEXT_ENGINEERING.md).
 - [Execution environments](EXECUTION_ENVIRONMENTS.md): isolated command execution.
@@ -23,9 +25,12 @@ Start with [First use](FIRST_USE.md). You only need `zhx` for everyday conversat
 - [CLI reference](CLI.md): command options, JSON/JSONL and exit codes.
 - [Extensibility](EXTENSIBILITY.md): providers, MCP, routing and subagents.
 - [API stability](STABILITY.md) and [deprecations](DEPRECATIONS.md).
-- [Local service](LOCAL_SERVICE.md) and [client protocol](CLIENT_PROTOCOL.md).
+- [Local service](LOCAL_SERVICE.md) and [client protocol](CLIENT_PROTOCOL.md), including the experimental [task evidence read](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73).
+- [Code web tasks](CODE_WEB_TASKS.md): operator review and explicit snapshot acceptance before continuation.
+- [Installed recovery laboratory](https://github.com/Zhivex/zhivex-harness/blob/main/docs/TASK_RECOVERY_LAB.md): contributor fixtures for the evidence read. The laboratory guide stays in the repository and is not part of the published package.
 - [Experimental ACP text sessions](ACP.md) and [workspace checkpoint restoration](WORKSPACE_CHECKPOINTS.md).
 - [Durable operations](DURABLE_OPERATIONS.md), [repository editing](REPOSITORY_EDITING.md) and [change envelopes](CHANGE_ENVELOPES.md).
+- [Audit pack](AUDIT_PACK.md): experimental signed export of one run or guided task.
 - [Threat model](THREAT_MODEL.md) and [public repository security](PUBLIC_SECURITY.md).
 
 ## Contribute and maintain

package/docs/REPOSITORY_EDITING.md

@@ -72,7 +72,7 @@ The terminal prints the complete `apply_patch` approval arguments rather than tr
 
 `quarantine_file` requires the current digest and moves the file into harness-owned state. The result includes a `quarantineId` used for recovery. The model has no permanent-delete tool.
 
-`restore_file` accepts a quarantine identifier and an optional workspace destination. Restore is conflict-safe: it never overwrites an existing destination, and an optional expected digest can bind the operation to the quarantined bytes the operator reviewed. A successful restore is recorded independently from the quarantine operation.
+`restore_file` requires a quarantine identifier, the destination path, and the expected digest of the quarantined bytes. It does not fall back to the original path or restore bytes the operator did not pin. Restore is conflict-safe: it never overwrites an existing destination. The approval preview shows that destination and the quarantined text for the pinned digest. A successful restore is recorded independently from the quarantine operation.
 
 Quarantine is a recovery boundary, not a backup system. Retention and permanent cleanup remain operator responsibilities. Do not manually edit quarantine manifests or payloads while a run is active.
 

package/docs/STABILITY.md

@@ -18,6 +18,8 @@ Beta APIs may change in a minor with changelog and migration guidance. Experimen
 
 The host-only `/mcp/stdio/v1` entry point and `CreateHarnessOptions.isolatedMcpSession` option are experimental additive capabilities. Workspace MCP configuration does not enable stdio; see [host admission and lifecycle](MCP_STDIO.md).
 
-The semantic compactor, compaction recommendations, declarative tool policy (including `toolPolicyFile` and `--tool-policy`), progress monitor, ACP text-session adapter, and workspace checkpoint restoration APIs are experimental. ACP implements the documented text-session subset; it does not claim full editor interoperability. Deterministic compaction and the existing client protocol remain available. See [tool policy semantics](TOOL_POLICY.md), [ACP limitations](ACP.md), [context behavior](CONTEXT_ENGINEERING.md), and [checkpoint constraints](WORKSPACE_CHECKPOINTS.md).
+The semantic compactor, compaction recommendations, declarative tool policy (including `toolPolicyFile` and `--tool-policy`), progress monitor, ACP text-session adapter, workspace checkpoint restoration APIs, and the `@zhivex-ai/harness/audit` subpath are experimental. `export-audit` and `verify-audit` are additive CLI commands. Their `--out` and `--signing-key-file` flags stay outside `CLI_OPTION_NAMES` and `CLI_COMMAND_OPTION_CONTRACTS`, so the stable option tuple and command-option declaration do not change. See [audit pack](AUDIT_PACK.md). ACP implements the documented text-session subset; it does not claim full editor interoperability. Deterministic compaction and the existing client protocol remain available. See [tool policy semantics](TOOL_POLICY.md), [ACP limitations](ACP.md), [context behavior](CONTEXT_ENGINEERING.md), and [checkpoint constraints](WORKSPACE_CHECKPOINTS.md).
+
+Task evidence reads (`task.get`, capability `task.projection.v1`) and operator task controls (`task.start`, `task.review`, `task.keep`, `task.revise`, `task.continue`, capability `task.control.v1`) are experimental additions on client protocol major 1. They do not change protocol version 1, existing command meanings, or the stable declaration signature baseline. The browser-safe projection schema and reducer are experimental exports of the existing `/protocol` entry. See [task projection](CLIENT_PROTOCOL.md#task-projection-v1-har-hu-73) and [task controls](CLIENT_PROTOCOL.md#task-controls-code-hu-05-experimental).
 
 Before `1.0.0-rc.1`, maintainers classified every current runtime and type export as stable, beta, or experimental. The gate rejects unreviewed additions, removals, omissions, and membership in more than one tier so future stability changes remain deliberate. Root aliases remain available during 1.x; any future beta subpath must be additive until the next major release.

package/docs/SUPPORT_MATRIX.md

@@ -10,7 +10,7 @@ The machine-readable source is [`support-matrix.json`](./support-matrix.json). `
 | OCI | Docker on Linux | — | Podman | managed remote sandbox |
 | Target package manager | npm | Bun | pnpm, Yarn | — |
 | MCP | bounded Streamable HTTP | — | broader remote implementations | stdio |
-| Provider | Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, OpenAI `gpt-5.6-luna` | — | Gemini, Anthropic, Vertex (ADC) | undocumented providers |
+| Provider | Meta `muse-spark-1.3-contributor`, Qwen `qwen3.8-flash`, OpenAI `gpt-6-luna` | — | Gemini, Anthropic, Vertex (ADC), Amazon Bedrock, Azure OpenAI | undocumented providers |
 
 Provider evidence is release-, account-, endpoint-, model-, and date-bound. A provider is supported for a release only when the exact candidate passes base, orchestration, routing, and model-directed execution gates. The table does not imply upstream feature parity.
 

package/docs/SUPPORT_MATRIX_1_1.md

@@ -10,7 +10,7 @@ The machine-readable source is [`support-matrix-1.1.json`](./support-matrix-1.1.
 | OCI | Docker on Linux | — | Podman | managed remote sandbox |
 | Target package manager | npm | Bun | pnpm, Yarn | — |
 | MCP | bounded Streamable HTTP | — | broader remote implementations | stdio |
-| Provider | Meta `muse-spark-1.3`, Qwen `qwen3.8-max`, OpenAI `gpt-6-luna` | — | Gemini | undocumented providers |
+| Provider | Meta `muse-spark-1.3`, Qwen `qwen3.8-max`, OpenAI `gpt-6-luna` | — | Gemini, Amazon Bedrock, Azure OpenAI | undocumented providers |
 
 Provider evidence is release-, account-, endpoint-, model-, and date-bound. A provider is supported for a release only when the exact candidate passes base, orchestration, routing, and model-directed execution gates. The table does not imply upstream feature parity.
 

package/docs/TOOL_POLICY.md

@@ -62,7 +62,10 @@ channels without compatible review evidence receive EXPLICIT_REVIEW_REQUIRED and
 leave the operation pending. The local CLI in ask mode displays a complete bounded
 payload and issues host evidence after explicit confirmation, without cached session
 grants. With this policy, `resume --approve` also requires interactive review;
-noninteractive invocation remains pending. Desktop accepts the operator-owned
+noninteractive invocation remains pending. `zhivex-code web --tool-policy` applies that file only when a single
+`--workspace` is set. More than one workspace with a shared policy is a usage
+error, so projects cannot inherit each other's approvals. `zhivex-code project add
+--tool-policy <path>` records a policy for that folder alone. Desktop accepts the operator-owned
 policy through its `--tool-policy` startup argument. Its main process consumes a
 bounded, expiring review ticket and sends the exact decision to the runtime through
 their private process channel. The renderer cannot issue review evidence, and the

package/docs/USAGE.md

@@ -149,8 +149,10 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 | Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · RC.10 default; fresh release-bound certification pending. |
 | OpenAI | `gpt-6-luna` | `OPENAI_API_KEY` · new default; fresh release-bound certification required |
 | Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
+| Amazon Bedrock | `anthropic.claude-haiku-5-5` | AWS credential chain plus `AWS_REGION` or `AWS_DEFAULT_REGION` · provisional; `BEDROCK_RUNTIME=openai` is a separate Tier A path and is not live-certified |
+| Azure OpenAI | `gpt-5.4` | `AZURE_OPENAI_API_KEY` and https `AZURE_OPENAI_ENDPOINT` · provisional until the harness live matrix passes |
 
-Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
+Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Bedrock also reads `AWS_REGION`, `AWS_DEFAULT_REGION`, `AWS_PROFILE`, `BEDROCK_RUNTIME`, and `BEDROCK_OPENAI_BASE_URL`. Azure OpenAI also reads `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_API_VERSION`, and `AZURE_OPENAI_DEPLOYMENTS`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
 The exact `v1.0.0` release passed protected base, delegation, routing and model-directed OCI gates for Meta, Qwen and OpenAI on 2026-09-20. The representative matrix passed 14/14 cases per provider on its authorized second attempt. Gemini remains provisional. See the [release evidence](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md#current-public-status) for artifact identity and the preserved first-attempt failure. Controlled and official-SDK MCP interoperability are separate transport evidence. Credential detection and deterministic tests do not replace real provider certification.
 

package/docs/VERTEX.md

@@ -44,7 +44,7 @@ Errors expose bounded categories for authentication, permission, unavailable
 model/route, rate limit and server failures. Raw Google payloads, token values,
 credential paths and service-account identities are not retained in errors.
 
-The integration pins `@zhivex-ai/vertex@1.1.2` with Core 1.26.0 and
-`google-auth-library@11.0.2`. Deterministic tests exercise the installed SDK's
+The integration pins `@zhivex-ai/vertex@1.2.7` with Core 1.34.0 and
+`google-auth-library@11.1.0`. Deterministic tests exercise the installed SDK's
 transport, streaming, signed continuation, approval/reopen and route mismatch.
 They are not evidence of a live project, renewable ADC or IAM authorization.

package/docs/WEB_LIMITS.md

@@ -3,8 +3,9 @@
 New interactive Web/terminal tasks have no accumulated spend, token, step,
 tool-call or duration cap unless configured. This change uses the published SDK contract from
 Zhivex/zhivex-ai-sdk PR 142 (Core/SDK 1.31.0, Agents 1.11.0). Direct Harness, Code
-and Web Core/Agents pins and the root Core override use those verified releases.
-Provider package pins, headless policies and release gates remain unchanged.
+and the root Core override now pin Core 1.34.0; Agents stays 1.11.0.
+Provider package pins are Anthropic 0.14.0, OpenAI 0.16.0 and Vertex 1.2.7.
+Headless policies and release gates remain unchanged.
 
 The Web header opens the approved gradual configuration modal. Next task settings
 override project settings once, including an empty override. Project settings
@@ -21,7 +22,7 @@ Unsupported pricing tiers and unaccounted auxiliary usage make the estimate
 unavailable. The price source is visible on the run. No money is reserved and this
 is not a guaranteed financial cap.
 
-**Avisar** records a notice and lets the run continue. **Detener** requests the
+**Notify** records a notice and lets the run continue. **Stop** requests the
 existing active-run cancellation once, after observing the threshold. An in-flight
 operation or final response can exceed it; completed work is not rolled back.
 Consumption and durable effects remain recorded. Cancellation produces a cancelled