@zhivex-ai/harness 1.5.0 → 1.6.3

package/docs/AUTO_APPROVE.md

@@ -0,0 +1,51 @@
+# Opt-in auto-approve
+
+Manual is the default. Nothing is applied until a person decides.
+
+| Mode | What can proceed without a prompt |
+| --- | --- |
+| `manual` | Nothing. This is today's review. |
+| `auto-edits` | File edits whose paths stay inside the workspace root. |
+| `auto-limits` | Those edits, plus commands whose executable is on the allowlist. |
+
+## Always ask
+
+These wait for a person in every mode, including when the command is allowlisted:
+
+- Network or egress, including `curl`, `wget`, `ssh`, and any command that carries an `http` or `https` URL.
+- Deletes outside the workspace.
+- Writes outside the workspace root.
+- Secret or credential files (`.env`, `credentials`, `.npmrc`, `.pypirc`, `.netrc`, `id_rsa`, `id_ed25519`, `*.pem`, `*.key`, and a `secrets` or `credentials` directory).
+- `git push`.
+- Package publish (`npm`, `pnpm`, `yarn`, `bun`, `cargo`).
+- Any operation once a spend or token limit is already reached.
+
+There is no flag that skips this list. A batch that mixes a safe edit with one of these stays on the review screen. `--approval-mode auto` and `--yes` are the older approve-all switch used by non-interactive runs. They are not this feature. Tool policy and explicit host review still apply.
+
+## Where it is set
+
+The workspace file is `.zhivex-harness/approval.json`. That directory is already protected from workspace tools.
+
+```json
+{
+  "mode": "auto-limits",
+  "commandAllowlist": ["bun", "git"]
+}
+```
+
+Allowlist entries are exact executable names. Wildcards and paths are rejected. `git` on the list still does not allow `git push`.
+
+The CLI flag and a session command override the file for this process:
+
+```sh
+zhivex-code --auto-approve auto-edits
+zhivex-code --auto-approve auto-limits --auto-approve-allow bun --auto-approve-allow git
+```
+
+In the terminal, `/auto-approve` shows the mode, `/auto-approve manual` changes this session, and `/auto-approve workspace manual` writes the file. `m` during a review, or `/manual`, returns to Manual without rewriting the file. The status line names the mode.
+
+In the web workspace the header chip shows the same mode. The dialog can save it for this session or this workspace. `m`, while you are not typing, returns to Manual for the session.
+
+## Audit and undo
+
+Each auto-approved operation is appended to `.zhivex-harness/auto-approvals.jsonl` with the mode, the reason, and a bounded snapshot of the previous file text (256 KiB of UTF-8). `/undo` restores the latest snapshot when every file still matches the approved text. The web Approvals dialog does the same per change. A later edit, a binary file, or a snapshot that was too large is not reverted.

package/docs/AZURE_OPENAI.md

@@ -4,14 +4,14 @@ Azure OpenAI is a separate provider (`azure-openai`). It does not reuse
 `OPENAI_API_KEY` or `OPENAI_BASE_URL`. No live Harness certification has been
 run for this route. Prices are not copied from the public OpenAI catalog.
 
-Published `@zhivex-ai/azure-openai@0.7.8` is the adapter pinned by this tree.
-It requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+Published `@zhivex-ai/azure-openai@0.8.0` is the adapter pinned by this tree.
+It requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.37.0`.
 Language models report Tier A. Hosted tool gates such as tool search follow
 the model id (`gpt-5.4` and `gpt-6-astra` in this adapter). An opaque
 deployment name does not receive those gates unless a deployment map names
 the base model.
 
-Published 0.7.8 accepts a deployments map and a token provider for Microsoft
+Published 0.8.0 accepts a deployments map and a token provider for Microsoft
 Entra ID. This route still authenticates with an API key and does not pass a
 token provider.
 
@@ -30,7 +30,7 @@ deployment name is not also sent as `model`. When it is omitted, requests use
 `AZURE_OPENAI_DEPLOYMENTS` is optional JSON, at most 8192 characters and 32
 entries. Each entry is `"name": "gpt-5.4"` or `"name": { "model": "gpt-5.4" }`.
 Deployment names and model ids are restricted to simple identifier characters.
-Harness passes the map to the adapter. Published 0.7.8 uses the base model for
+Harness passes the map to the adapter. Published 0.8.0 uses the base model for
 capabilities and request shape while the request still uses the deployment
 name. Harness also overlays those capability flags.
 

package/docs/BEDROCK.md

@@ -4,8 +4,8 @@ Bedrock is a separate provider (`bedrock`). It is not enabled by the Anthropic
 direct API route. No live Harness certification has been run for this route.
 Pricing and context limits are not inferred.
 
-Published `@zhivex-ai/bedrock@2.0.7` is the adapter pinned by this tree. It
-requires Core `^1.34.0`, and this checkout pins `@zhivex-ai/core@1.34.0`.
+Published `@zhivex-ai/bedrock@2.1.0` is the adapter pinned by this tree. It
+requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.37.0`.
 This integration reports the installed adapter's labels and does not relabel
 them.
 
@@ -14,7 +14,7 @@ them.
 `BEDROCK_RUNTIME` is optional. An empty value or `converse` selects the Converse
 API. `openai` selects the OpenAI-compatible runtime. Any other value is rejected.
 
-Converse reports Tier B on the published 2.0.7 adapter: reasoning is supported
+Converse reports Tier B on the published 2.1.0 adapter: reasoning is supported
 and `toolChoiceNone` is true. Approval requests stay false on that runtime.
 Harness reports that installed label.
 
@@ -28,7 +28,7 @@ not read `OPENAI_API_KEY` or `OPENAI_BASE_URL` for this route.
 Converse uses the AWS SDK default credential chain: instance roles, SSO,
 shared config, and environment credentials. Set `AWS_REGION` or
 `AWS_DEFAULT_REGION` to a region such as `us-east-1`. `AWS_PROFILE` is part of
-the transport fingerprint. Published 2.0.7 accepts a profile and static
+the transport fingerprint. Published 2.1.0 accepts a profile and static
 credentials on the adapter. This route does not pass `AWS_PROFILE`. When
 `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are both set, and no bearer
 token is set, Converse uses that static pair and an optional

package/docs/CLI.md

@@ -549,6 +549,19 @@ model with a small billable request. See [credentials](CREDENTIALS.md).
 `/approvals` opens the mode picker; `/approvals ask`, `/approvals auto`, and
 `/approvals restricted` switch directly. The composer and `/status` show the active
 mode. Auto approves gated actions within existing workspace and execution policies.
+
+Opt-in auto-approve is separate from `--yes`. `--auto-approve manual` is the default.
+`--auto-approve auto-edits` applies file edits inside the workspace root.
+`--auto-approve auto-limits` also runs commands whose executable is passed with
+repeatable `--auto-approve-allow`. The same choice can live in
+`.zhivex-harness/approval.json`, which tools cannot rewrite. A session choice from
+`/auto-approve` or the `m` key wins until the process exits and does not rewrite the
+file. Network or egress, deletes outside the workspace, writes outside the root,
+secret or credential files, `git push`, package publish, and any operation already
+over a spend or token limit always wait for a person. Allowlisting `git` or `npm`
+does not bypass those. Every auto-approved edit is appended to
+`.zhivex-harness/auto-approvals.jsonl`. `/undo` restores that edit when the file
+still matches the approved text. See [auto-approve](AUTO_APPROVE.md).
 Bounded dependency inspection runs without a separate approval in every mode.
 Restricted denies gated actions. Mode changes apply only to this CLI process and are blocked
 while work is active or awaiting approval; use `/pending`, `/approve`, or `/deny`

package/docs/CODE_RELEASE.md

@@ -1,5 +1,26 @@
 # Code release procedure
 
+## Prepared patch: Code 0.4.2
+
+Code `0.4.2` pins Harness `1.6.3` exactly and is pending publication to `latest`. Published Code `0.4.1` and Harness `1.6.2` remain unchanged. The private Web development dependency stays on the published Harness `1.6.2` so clean CI can install its frozen lockfile before the candidate exists in the registry; offline tests explicitly link the built `1.6.3` candidate.
+
+After Harness publication and registry/provenance verification, use annotated `code-v0.4.2` on the same reviewed main SHA, `channel=latest`, `mode=oidc`, and the protected `release-code.yml` workflow. The final Code gate must resolve the real published Harness dependency without candidate overrides, then verify retained-artifact installation and provenance. Local paired-artifact tests do not substitute for that registry gate. See [the preparation report](https://github.com/Zhivex/zhivex-harness/blob/main/docs/reports/RELEASE_1_6_3_CODE_0_4_2.md).
+
+## Published patch: Code 0.4.1
+
+Harness `1.6.2` is published on npm `latest`. `@zhivex-ai/code` `0.4.1` is
+published on `latest`, pinned exactly to Harness `1.6.2`. The engine bump is
+its only change. Published npm Code `0.4.0` remains pinned to
+Harness `1.5.0` and is not republished. Annotated `code-v0.4.1` on the reviewed
+main SHA, `channel=latest`, ran through the protected workflow and its
+environment approval.
+
+## Previous preparation: Harness 1.6.2 did not release Code
+
+Harness `1.6.2` was prepared while `@zhivex-ai/code` stayed version `0.4.0`,
+with its source pin on `1.6.2` for installed acceptance. No `code-v*` tag was
+created for that engine bump.
+
 ## Pending patch: 2026-10-16
 
 The source version is `1.5.0`, pending publication to `latest`. This checkout

package/docs/CREDENTIALS.md

@@ -86,7 +86,7 @@ Set an https `AZURE_OPENAI_ENDPOINT` before saving a key. Optional
 `AZURE_OPENAI_API_VERSION` and `AZURE_OPENAI_DEPLOYMENTS` stay in the
 environment and are not written to the keychain. A managed
 `AZURE_OPENAI_API_KEY` is allowed together with that endpoint. Published
-`@zhivex-ai/azure-openai@0.7.8` accepts a token provider, and this route still
+`@zhivex-ai/azure-openai@0.8.0` accepts a token provider, and this route still
 stores and sends the API key. See [Azure OpenAI](AZURE_OPENAI.md).
 
 ## Qwen interactive setup

package/docs/DURABLE_OPERATIONS.md

@@ -70,7 +70,7 @@ Loading a run reconstructs its complete state for compatibility with approvals,
 
 Logical backups contain hydrated history rather than database references, so restoration does not require the original artifact tables. Exports up to 64 MiB retain the legacy JSON format; larger exports use the versioned `ZHIVEX-STATE-SEGMENTS-1` transport with bounded frames, including split strings. RC13 reads both formats and verifies the same logical checksum before import. Older versions cannot read segmented exports. File I/O and checksum serialization are incremental; the public backup/import APIs still hydrate the complete logical bundle in memory. Segmented files have no aggregate 64 MiB ceiling. A state-limit failure records a bounded terminal diagnostic on the last durable checkpoint; the unsaved payload is not claimed as preserved. Use `/status` to inspect the failed run before `/continue`. Recovery retains tool journal receipts and never re-executes an operation itself.
 
-The current source pins Core 1.34.0 and Agents 1.11.0. New stores require no
+The current source pins Core 1.37.0 and Agents 1.12.0. New stores require no
 conversion. Before upgrading an existing shared SDK store, stop its workers and
 upgrade them together with a complete backup. Verified legacy runs retain their
 physical keys and remain readable; new runs use canonical keys that distinguish

package/docs/ENGINE_API.md

@@ -1,7 +1,7 @@
 # Engine API and Code integration
 
 The terminal-independent package entrypoints shipped in Harness 1.3.0 and remain
-in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.5.0, pending publication. They are not present in Harness 1.2.0.
+in Harness 1.6.2, published on npm `latest`. They are not present in Harness 1.2.0.
 The protected workflow validated the exact stable tarball, live gates and
 registry integrity/provenance; local candidate smoke remains contributor evidence. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.

package/docs/EXTENSIBILITY.md

@@ -8,7 +8,7 @@ Built-in registrations are Meta, Qwen, OpenAI, Gemini, Anthropic, Vertex, Amazon
 
 Library callers can use `DEFAULT_PROVIDER_REGISTRY`, `BUILTIN_PROVIDER_REGISTRATIONS`, `createProviderRegistry`, or `DEFAULT_PROVIDER_REGISTRY.extend(...)`, then pass the registry to `resolveHarnessConfig`, `createProviderModel`, provider diagnostics, or `createHarness({ providerRegistry })`. Registration IDs, environment-variable names, defaults, diagnostics, and factories are validated before they become selectable.
 
-The coordinated stable SDK batch pins `@zhivex-ai/agents@1.11.0`, `@zhivex-ai/core@1.34.0`, `@zhivex-ai/meta@0.2.9`, `@zhivex-ai/qwen@0.16.4`, `@zhivex-ai/openai@0.16.0`, `@zhivex-ai/gemini@0.13.0`, `@zhivex-ai/anthropic@0.14.0`, `@zhivex-ai/vertex@1.2.7`, `@zhivex-ai/bedrock@2.0.7`, and `@zhivex-ai/azure-openai@0.7.8`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.34.0 satisfies Agents, OpenAI and Vertex `^1.31.0`, Anthropic `^1.30.0`, Qwen `^1.29.0`, and the provisional Bedrock and Azure OpenAI `^1.34.0` ranges. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
+The coordinated stable SDK batch pins `@zhivex-ai/agents@1.12.0`, `@zhivex-ai/core@1.37.0`, `@zhivex-ai/meta@0.3.0`, `@zhivex-ai/qwen@0.18.1`, `@zhivex-ai/openai@0.17.0`, `@zhivex-ai/gemini@0.14.0`, `@zhivex-ai/anthropic@0.15.0`, `@zhivex-ai/vertex@1.3.0`, `@zhivex-ai/bedrock@2.1.0`, and `@zhivex-ai/azure-openai@0.8.0`. Qwen 0.18.1 depends on Core `^1.37.0` and rejects non-string portable-decision instructions. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.37.0 satisfies Agents `^1.34.0` and the provider adapters' `^1.36.0` floors. Vertex 1.3.0 requires OpenAI `^0.17.0`, Anthropic `^0.15.0`, and Gemini `^0.14.0`. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
 
 OpenAI is based on the GPT-5.6 family: `gpt-5.6-luna` is the default, with `gpt-5.6-terra` and `gpt-5.6-sol` available through `--model`. Availability remains organization-dependent while the upstream family is in limited preview, and the adapter uses the Responses API by default.
 

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets stable `1.5.0`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.4.1 until that publication.
+This guide targets source candidate `1.6.3`, pending publication. Registry commands below apply after publication; current npm `latest` remains `1.6.2`.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.5.0
+npm install -g @zhivex-ai/harness@1.6.3
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.5.0
+bun add --global @zhivex-ai/harness@1.6.3
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.5.0 --version
-bunx @zhivex-ai/harness@1.5.0 --help
-bunx @zhivex-ai/harness@1.5.0 doctor
+bunx @zhivex-ai/harness@1.6.3 --version
+bunx @zhivex-ai/harness@1.6.3 --help
+bunx @zhivex-ai/harness@1.6.3 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/MINIMUM_TASK_AUTHORITY.md

@@ -52,11 +52,11 @@ dispatch/cap behavior, not provider billing guarantees or model quality.
 
 | Route | Direct guided task | Verified wire cap and dispatch boundary |
 | --- | --- | --- |
-| Built-in OpenAI (`@zhivex-ai/openai` 0.16.0) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
-| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.14.0) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
-| Built-in Gemini (`@zhivex-ai/gemini` 0.13.0) | Supported | `generationConfig.maxOutputTokens`; `maxRetries=0` |
-| Built-in Vertex (`@zhivex-ai/vertex` 1.2.7) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
-| Qwen (`@zhivex-ai/qwen` 0.16.4) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
+| Built-in OpenAI (`@zhivex-ai/openai` 0.17.0) | Supported | Responses `max_output_tokens`; Chat `max_tokens` without reasoning or `max_completion_tokens` with reasoning; `maxRetries=0`, `maxProviderRequests=1` |
+| Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.15.0) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
+| Built-in Gemini (`@zhivex-ai/gemini` 0.14.0) | Supported | `generationConfig.maxOutputTokens`; `maxRetries=0` |
+| Built-in Vertex (`@zhivex-ai/vertex` 1.3.0) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
+| Qwen (`@zhivex-ai/qwen` 0.18.1) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
 | Meta | Blocked | Harness continuation fetch can replay a 400 response outside SDK retry admission |
 | Injected/custom adapters, refreshable Anthropic OAuth | Blocked | No vetted transport provenance; OAuth transport can replay a 401 after refresh outside ordinary retry admission |
 | Mock | Offline tests only | Synthetic usage is never billing evidence |

package/docs/PROJECT_MEMORY.md

@@ -7,7 +7,7 @@ generated automatically; hosts may submit a suggestion for operator review.
 
 ## CLI
 
-Use `zhx` or `zhivex-code` with Harness 1.5.0 (Code 0.4.0), pending publication. Commands
+Use `zhx` with Harness 1.6.2, published on `latest`. `zhivex-code` is Code 0.4.1, published on `latest` and pinned exactly to Harness 1.6.2. Commands
 print bounded JSON, including the selected workspace/scope hashes. Quote content
 as one argument. Memory commands do not start a model or read credentials.
 

package/docs/TOOL_POLICY.md

@@ -32,6 +32,9 @@ The strongest matching decision wins: deny, then ask_user, then allow. Allow
 does not grant filesystem permissions or remove an existing approval. ask_user
 uses the current approval mechanism, including its configured automatic mode;
 it does not independently require a human. Human-only review is separate work.
+Opt-in auto-approve (`manual`, `auto-edits`, `auto-limits`) never bypasses a deny,
+an explicit host review, or the always-ask list (network, secrets, git push,
+package publish, paths outside the workspace, and an already reached spend or token limit).
 
 Built-in file resolvers cover read_file, read_files, propose_edits, apply_patch,
 apply_reviewed_edits, apply_reviewed_replacement, move_file and quarantine_file.

package/docs/VERTEX.md

@@ -44,7 +44,7 @@ Errors expose bounded categories for authentication, permission, unavailable
 model/route, rate limit and server failures. Raw Google payloads, token values,
 credential paths and service-account identities are not retained in errors.
 
-The integration pins `@zhivex-ai/vertex@1.2.7` with Core 1.34.0 and
-`google-auth-library@11.1.0`. Deterministic tests exercise the installed SDK's
+The integration pins `@zhivex-ai/vertex@1.3.0` with Core 1.37.0 and
+`google-auth-library@11.3.1`. Deterministic tests exercise the installed SDK's
 transport, streaming, signed continuation, approval/reopen and route mismatch.
 They are not evidence of a live project, renewable ADC or IAM authorization.

package/docs/WEB_LIMITS.md

@@ -3,8 +3,8 @@
 New interactive Web/terminal tasks have no accumulated spend, token, step,
 tool-call or duration cap unless configured. This change uses the published SDK contract from
 Zhivex/zhivex-ai-sdk PR 142 (Core/SDK 1.31.0, Agents 1.11.0). Direct Harness, Code
-and the root Core override now pin Core 1.34.0; Agents stays 1.11.0.
-Provider package pins are Anthropic 0.14.0, OpenAI 0.16.0 and Vertex 1.2.7.
+and the root Core override now pin Core 1.37.0; Agents is 1.12.0.
+Provider package pins are Anthropic 0.15.0, OpenAI 0.17.0 and Vertex 1.3.0.
 Headless policies and release gates remain unchanged.
 
 The Web header opens the approved gradual configuration modal. Next task settings

package/docs/adr/0002-isolated-mcp-stdio.md

@@ -20,7 +20,7 @@ activate stdio, change configuration schema 1, or claim isolated execution passe
   options with abort, timeout/idempotency key, and an HTTP transport; no executable
   stdio factory was found in that dependency. The control-plane transport enum is
   not an executor.
-- The current pin is `@zhivex-ai/core` 1.34.0, which includes an experimental
+- The current pin is `@zhivex-ai/core` 1.37.0, which includes an experimental
   stdio client. Harness still does not treat that factory as the OCI boundary.
 
 MCP stdio uses UTF-8 newline-delimited JSON-RPC on stdin/stdout; stderr is a

package/evaluations/representative-assembly-matrix.json

@@ -64,7 +64,11 @@
     "v1.4.0-rc.8",
     "v1.4.0",
     "v1.4.1",
-    "v1.5.0"
+    "v1.5.0",
+    "v1.6.0",
+    "v1.6.1",
+    "v1.6.2",
+    "v1.6.3"
   ],
   "expectedModels": [
     {
@@ -570,6 +574,38 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.6.0",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.6.1",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.6.2",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
+    },
+    {
+      "releaseTag": "v1.6.3",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/examples/README.md

@@ -2,19 +2,19 @@
 
 ## Isolated Bun installation
 
-Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected stable publication, this installs the 1.5.0 artifact in a temporary consumer, without building the source checkout or changing global tools:
+Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After publication, this installs the 1.6.3 artifact in a temporary consumer, without building the source checkout or changing global tools:
 
 ```bash
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.5.0
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.6.3
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json
 ```
 
-Version must print `1.5.0`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
+Version must print `1.6.3`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
 
 To continue in your actual project, use the [global installation and credential setup](../README.md#quick-start), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.5.0",
+  "version": "1.6.3",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
@@ -100,6 +100,7 @@
     "LICENSE",
     "docs/CHANGE_ENVELOPES.md",
     "docs/CLI.md",
+    "docs/AUTO_APPROVE.md",
     "docs/WEB_LIMITS.md",
     "docs/CODE_RELEASE.md",
     "docs/CODE_WEB_TASKS.md",
@@ -216,26 +217,26 @@
     "smoke:mcp:installed": "bun run build && bun scripts/mcp-installed-smoke.ts"
   },
   "dependencies": {
-    "@zhivex-ai/agents": "1.11.0",
-    "@zhivex-ai/anthropic": "0.14.0",
-    "@zhivex-ai/azure-openai": "0.7.8",
-    "@zhivex-ai/bedrock": "2.0.7",
-    "@zhivex-ai/core": "1.34.0",
-    "@zhivex-ai/gemini": "0.13.0",
-    "@zhivex-ai/meta": "0.2.9",
-    "@zhivex-ai/openai": "0.16.0",
-    "@zhivex-ai/qwen": "0.16.4",
-    "@zhivex-ai/vertex": "1.2.7",
-    "google-auth-library": "11.1.0",
-    "zod": "4.6.5"
+    "@zhivex-ai/agents": "1.12.0",
+    "@zhivex-ai/anthropic": "0.15.0",
+    "@zhivex-ai/azure-openai": "0.8.0",
+    "@zhivex-ai/bedrock": "2.1.0",
+    "@zhivex-ai/core": "1.37.0",
+    "@zhivex-ai/gemini": "0.14.0",
+    "@zhivex-ai/meta": "0.3.0",
+    "@zhivex-ai/openai": "0.17.0",
+    "@zhivex-ai/qwen": "0.18.1",
+    "@zhivex-ai/vertex": "1.3.0",
+    "google-auth-library": "11.3.1",
+    "zod": "4.6.7"
   },
   "overrides": {
-    "@zhivex-ai/core": "1.34.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   "devDependencies": {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.2",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     "typescript": "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -246,6 +247,6 @@
   },
   "packageManager": "bun@1.4.0",
   "optionalDependencies": {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 }