@zhivex-ai/harness 1.6.2 → 1.6.3

package/CHANGELOG.md

@@ -6,6 +6,13 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 
 ## Unreleased
 
+## 1.6.3 - 2026-11-10
+
+- Prepare a maintenance patch for npm `latest`, paired with Code 0.4.2 and the private Desktop engine binding. Existing public APIs, storage formats, model defaults and provider tiers are unchanged. Publication and release-bound live certification are pending.
+- Include the keyring 2.1.2 update and dependency security maintenance for the private Web/Desktop clients.
+- Update the development dependency `@agentclientprotocol/sdk` from 1.8.0 to 2.1.0. SDK 2.1 removes `ClientSideConnection`; the Docker interoperability client now uses `client().connect(...)` and the same ACP v1 methods. `@modelcontextprotocol/server` stays at 2.3.1 because that peer is optional and this client does not import it. The Harness ACP server is unchanged.
+- Pin `@zhivex-ai/core` 1.37.0, including the root override, the Code and web package pins, and a web override so the published Harness dependency uses that same runtime, and `@zhivex-ai/qwen` 0.18.1. Qwen 0.18.1 depends on Core `^1.37.0`. Harness and CLI defaults are unchanged. The Qwen adapter rejects non-string portable-decision instructions and adds PixVerse V6 request shaping; Harness does not expose that video surface.
+
 ## 1.6.2 - 2026-10-24
 
 - Allow one continuity retry per provider in the release gate. Live certification of `v1.6.0` and `v1.6.1` (twice) failed only the multi-process continuity gate, each time on a different provider. A provider whose continuity run fails now gets one fresh retry of all phases and passes only if the retry passes. Every selected provider stays mandatory, and no other gate retries. The continuity evidence records which provider retried, the first attempt's sanitized cause, and the retry outcome. Runtime and CLI behavior and defaults are unchanged (#250).

package/README.md

@@ -159,6 +159,8 @@ Contracts, stability tiers, and the experimental ACP and MCP entry points are in
 
 ## Releases
 
-Version `1.5.0` is the current public npm release. The paired Code package on npm `latest` is `0.4.0`, pinned to that engine. This checkout prepares Version `1.6.2` for `latest`. Code stays version `0.4.0`, and its source pin is Harness `1.6.2` for installed acceptance. Published Code `0.4.0` stays on Harness `1.5.0`. That Harness publication is pending, so the quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
+Version `1.6.3` is the prepared source candidate, paired with Code `0.4.2`; publication and release-bound live certification are pending.
+
+Version `1.6.2` is the current public npm release. The Code package on npm `latest` is `0.4.1`, pinned exactly to Harness `1.6.2`. The quick start above follows the published `latest` tag. npm `next` is Harness `1.4.0-rc.8` and Code `0.3.0-rc.8`. Confirm dist-tags on the [Code versions](https://www.npmjs.com/package/@zhivex-ai/code?activeTab=versions) and [Harness versions](https://www.npmjs.com/package/@zhivex-ai/harness?activeTab=versions) pages before you install a prerelease.
 
 Release channels, publication, and certification records are in the [release procedure](https://github.com/Zhivex/zhivex-harness/blob/main/docs/RELEASE.md). Releases are verified with npm provenance. Source in this checkout can be newer than the public package. See the [changelog](CHANGELOG.md) and the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json).

package/SUPPORT.md

@@ -13,7 +13,7 @@ The 1.1 support scope is tracked in the [machine-readable support matrix](./docs
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.5.0 and Code 0.4.0 are the published stable packages. Code stays version 0.4.0. Its source pin is Harness 1.6.2 for installed acceptance, and published Code 0.4.0 remains pinned to Harness 1.5.0 until 1.6.2 completes verified publication. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
+Only the most recent published stable minor receives routine fixes. The exact `v1.3.0` tag passed the protected artifact, six-provider live and 42-case representative release jobs. Harness 1.5.0 and Code 0.4.0 are the published stable packages. Code 0.4.1, pinned exactly to Harness 1.6.2, is published on `latest`. Gemini, Anthropic and Vertex remain provisional despite the release-bound live gates; the representative repository matrix covers only Meta, Qwen and OpenAI. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](https://github.com/Zhivex/zhivex-harness/blob/main/docs/LIVE_CERTIFICATION.md).
 
 ## Installation diagnostics
 

package/dist/acp-cli.js

@@ -11,13 +11,13 @@ import {
 } from "./index-3ah1f369.js";
 import {
   createHarnessClientAdapter
-} from "./index-paf7z8kn.js";
+} from "./index-j466sekf.js";
 import"./index-4mn6m3bq.js";
 import {
   createHarness
-} from "./index-pf73y4gt.js";
+} from "./index-vn91b9z1.js";
 import"./index-amjttjaj.js";
-import"./index-2r4f0p4n.js";
+import"./index-hhrnrqfc.js";
 import"./index-w0m1nckc.js";
 import {
   HARNESS_REQUIRED_CAPABILITIES,
@@ -35,7 +35,7 @@ import"./index-bt2p8x7r.js";
 import {
   usagePricingSchema
 } from "./index-fqqz1yt8.js";
-import"./index-rz7wmp71.js";
+import"./index-3wwfn5n6.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,

package/dist/audit/index.js

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "../index-zrz4rs7p.js";
+} from "../index-5nmm0642.js";
 import"../index-yx52bt4a.js";
 import {
   APPROVAL_HISTORY_KEY,
@@ -17,7 +17,7 @@ import {
 } from "../index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "../index-rz7wmp71.js";
+} from "../index-3wwfn5n6.js";
 import {
   readRegularFileNoFollow
 } from "../index-6dxrbnxm.js";

package/dist/{audit-pack-fckpqfsb.js → audit-pack-s9n693by.js}

@@ -1,7 +1,7 @@
 import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema
-} from "./cli-entry-z1pbjrg4.js";
+} from "./cli-entry-1epvek01.js";
 import {
   APPROVAL_HISTORY_KEY,
   CliUsageError,
@@ -17,10 +17,10 @@ import {
   openHarnessPersistence,
   readRegularFileNoFollow,
   validateStateDirectory
-} from "./cli-entry-6amx4mcc.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   resolveHarnessConfig
 } from "./cli-entry-hdtfef27.js";

package/dist/{cli-entry-z1pbjrg4.js → cli-entry-1epvek01.js}

@@ -10,10 +10,10 @@ import {
   readTaskAcceptanceLedger,
   taskCheckReceiptSchema,
   verifyChangeEnvelope
-} from "./cli-entry-6amx4mcc.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 
 // src/persistence/governance-report.ts
 import { createHash as createHash2 } from "node:crypto";

package/dist/{cli-entry-10th5awp.js → cli-entry-mbcq96nx.js}

@@ -444,7 +444,7 @@ Use zhx help all for the full reference and exit codes.`;
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.6.2",
+  version: "1.6.3",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -665,22 +665,22 @@ var package_default = {
     "@zhivex-ai/anthropic": "0.15.0",
     "@zhivex-ai/azure-openai": "0.8.0",
     "@zhivex-ai/bedrock": "2.1.0",
-    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/core": "1.37.0",
     "@zhivex-ai/gemini": "0.14.0",
     "@zhivex-ai/meta": "0.3.0",
     "@zhivex-ai/openai": "0.17.0",
-    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/qwen": "0.18.1",
     "@zhivex-ai/vertex": "1.3.0",
     "google-auth-library": "11.3.1",
     zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.36.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   devDependencies: {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.3",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -691,7 +691,7 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   optionalDependencies: {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 };
 

package/dist/{cli-entry-6amx4mcc.js → cli-entry-nyzyvf24.js}

@@ -2,7 +2,7 @@ import {
   CLI_OPTION_DEFINITIONS,
   resolveHelpTopic,
   validateCliCommandOptions
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_EXECUTION_POLICY_VERSION,

package/dist/{cli-entry-4g2ewcnw.js → cli-entry-rsx0wpvs.js}

@@ -97,10 +97,10 @@ import {
   withWorkspaceMutation,
   workBudgetReached,
   workspaceFilePathSchema
-} from "./cli-entry-6amx4mcc.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_CONFIG_SCHEMA_VERSION,

package/dist/{cli-84en174d.js → cli-yxvq8qf1.js}

@@ -61,11 +61,11 @@ import {
   withTemporaryHarnessProfiles,
   workspaceCheckpointSchema,
   workspaceRestoreOperationSchema
-} from "./cli-entry-4g2ewcnw.js";
+} from "./cli-entry-rsx0wpvs.js";
 import {
   exportHarnessGovernanceReport,
   renderHarnessGovernanceMarkdown
-} from "./cli-entry-z1pbjrg4.js";
+} from "./cli-entry-1epvek01.js";
 import {
   BUDGET_LEDGER_NAMESPACE,
   BUDGET_OWNER_NAMESPACE_KEY,
@@ -125,14 +125,14 @@ import {
   updateCliProfile,
   validateStateDirectory,
   verifyChangeEnvelope
-} from "./cli-entry-6amx4mcc.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   formatCliHelp,
   shortCliHelp
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   DEFAULT_PROVIDER_REGISTRY,
   HARNESS_SUBAGENT_PROFILES,
@@ -4091,7 +4091,7 @@ var main = async (argv = process.argv.slice(2)) => {
     parsedOptions = { ...parsedOptions, prompt: await readStdinTask() };
   }
   if (parsedOptions.serviceFile) {
-    const { runServiceCli } = await import("./service-client-cli-pp5z4dmf.js");
+    const { runServiceCli } = await import("./service-client-cli-xbj7j5kj.js");
     await runServiceCli(parsedOptions, annotateCliStreamError);
     return;
   }
@@ -4156,7 +4156,7 @@ var main = async (argv = process.argv.slice(2)) => {
       return;
     case "export-audit":
     case "verify-audit": {
-      const { auditPackCli } = await import("./audit-pack-fckpqfsb.js");
+      const { auditPackCli } = await import("./audit-pack-s9n693by.js");
       await auditPackCli(options);
       return;
     }

package/dist/cli.js

@@ -3,7 +3,7 @@ import {
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -41,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-84en174d.js");
+  const { runCli } = await import("./cli-yxvq8qf1.js");
   await runCli(argv);
 }

package/dist/compat/code-support.js

@@ -13,13 +13,13 @@ import {
   readHarnessTaskDraft,
   requestHarnessTaskCancellation,
   runHarnessTask
-} from "../index-pf73y4gt.js";
+} from "../index-vn91b9z1.js";
 import {
   TASK_SOURCE_KEY,
   harnessToolExecution,
   taskSources
 } from "../index-amjttjaj.js";
-import"../index-2r4f0p4n.js";
+import"../index-hhrnrqfc.js";
 import {
   resolvePackageCheckCommand,
   resolvePackageManager,
@@ -47,7 +47,7 @@ import {
   inspectUsageLedger,
   usagePricingSchema
 } from "../index-fqqz1yt8.js";
-import"../index-rz7wmp71.js";
+import"../index-3wwfn5n6.js";
 import {
   FileChangedWhileReadingError,
   FileSizeLimitError,

package/dist/engine/acp.js

@@ -2,7 +2,7 @@ import {
   discardMcpWorkspaceSnapshot,
   launchDockerMcpGroup,
   prepareMcpWorkspaceSnapshot
-} from "../index-1pn0ecs4.js";
+} from "../index-nxmk6re7.js";
 import {
   createAcpConnection,
   issueAcpMcpSessionProvider,
@@ -10,20 +10,20 @@ import {
 } from "../index-3ah1f369.js";
 import {
   createHarnessClientAdapter
-} from "../index-paf7z8kn.js";
+} from "../index-j466sekf.js";
 import"../index-4mn6m3bq.js";
 import {
   createHarness
-} from "../index-pf73y4gt.js";
+} from "../index-vn91b9z1.js";
 import"../index-amjttjaj.js";
-import"../index-2r4f0p4n.js";
+import"../index-hhrnrqfc.js";
 import"../index-w0m1nckc.js";
 import"../index-1265j7t2.js";
 import"../index-c39197wq.js";
 import"../index-mzydbzp8.js";
 import"../index-bt2p8x7r.js";
 import"../index-fqqz1yt8.js";
-import"../index-rz7wmp71.js";
+import"../index-3wwfn5n6.js";
 import"../index-6dxrbnxm.js";
 import"../index-4gt045j0.js";
 import"../index-bpc596v3.js";

package/dist/engine/client.js

@@ -2,18 +2,18 @@ import {
   createHarnessClientAdapter,
   runResultDocument,
   terminalContinuationMessages
-} from "../index-paf7z8kn.js";
+} from "../index-j466sekf.js";
 import"../index-4mn6m3bq.js";
-import"../index-pf73y4gt.js";
+import"../index-vn91b9z1.js";
 import"../index-amjttjaj.js";
-import"../index-2r4f0p4n.js";
+import"../index-hhrnrqfc.js";
 import"../index-w0m1nckc.js";
 import"../index-1265j7t2.js";
 import"../index-c39197wq.js";
 import"../index-mzydbzp8.js";
 import"../index-bt2p8x7r.js";
 import"../index-fqqz1yt8.js";
-import"../index-rz7wmp71.js";
+import"../index-3wwfn5n6.js";
 import"../index-6dxrbnxm.js";
 import {
   HARNESS_CLIENT_PROTOCOL_VERSION,

package/dist/engine/index.js

@@ -73,7 +73,7 @@ import {
   exportHarnessGovernanceReport,
   harnessGovernanceReportSchema,
   renderHarnessGovernanceMarkdown
-} from "../index-zrz4rs7p.js";
+} from "../index-5nmm0642.js";
 import {
   CHANGE_ENVELOPE_DIGEST_ALGORITHM,
   CHANGE_ENVELOPE_SCHEMA_VERSION,
@@ -105,10 +105,10 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-74f9yhfh.js";
+} from "../index-2yyfg69h.js";
 import {
   createHarnessClientAdapter
-} from "../index-paf7z8kn.js";
+} from "../index-j466sekf.js";
 import {
   openWorkspaceCheckpointStore
 } from "../index-4mn6m3bq.js";
@@ -152,7 +152,7 @@ import {
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel
-} from "../index-pf73y4gt.js";
+} from "../index-vn91b9z1.js";
 import {
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_PROJECT_MEMORY_LIMITS,
@@ -174,7 +174,7 @@ import {
   createHttpMcpClient,
   loadHarnessMcpConfiguration,
   normalizeHarnessMcpConfiguration
-} from "../index-2r4f0p4n.js";
+} from "../index-hhrnrqfc.js";
 import {
   CliOciRuntimeAdapter,
   HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
@@ -235,7 +235,7 @@ import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE
-} from "../index-rz7wmp71.js";
+} from "../index-3wwfn5n6.js";
 import {
   EDIT_CONTRACT_SCHEMA_VERSION,
   EDIT_DIGEST_ALGORITHM,

package/dist/engine/mcp-stdio-v1.js

@@ -8,13 +8,13 @@ import {
   mcpResourcePlanSchema,
   prepareMcpWorkspaceSnapshot,
   recoverDockerMcpResources
-} from "../index-1pn0ecs4.js";
-import"../index-2r4f0p4n.js";
+} from "../index-nxmk6re7.js";
+import"../index-hhrnrqfc.js";
 import"../index-w0m1nckc.js";
 import"../index-1265j7t2.js";
 import"../index-c39197wq.js";
 import"../index-mzydbzp8.js";
-import"../index-rz7wmp71.js";
+import"../index-3wwfn5n6.js";
 import"../index-6dxrbnxm.js";
 import"../index-bpc596v3.js";
 import"../index-fm84men1.js";

package/dist/engine/service.js

@@ -5,19 +5,19 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "../index-74f9yhfh.js";
-import"../index-paf7z8kn.js";
+} from "../index-2yyfg69h.js";
+import"../index-j466sekf.js";
 import"../index-4mn6m3bq.js";
-import"../index-pf73y4gt.js";
+import"../index-vn91b9z1.js";
 import"../index-amjttjaj.js";
-import"../index-2r4f0p4n.js";
+import"../index-hhrnrqfc.js";
 import"../index-w0m1nckc.js";
 import"../index-1265j7t2.js";
 import"../index-c39197wq.js";
 import"../index-mzydbzp8.js";
 import"../index-bt2p8x7r.js";
 import"../index-fqqz1yt8.js";
-import"../index-rz7wmp71.js";
+import"../index-3wwfn5n6.js";
 import"../index-6dxrbnxm.js";
 import"../index-4gt045j0.js";
 import"../index-bpc596v3.js";

package/dist/hostile-repository-demo.js

@@ -14947,7 +14947,7 @@ import { z as z32 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.6.2",
+  version: "1.6.3",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -15168,22 +15168,22 @@ var package_default = {
     "@zhivex-ai/anthropic": "0.15.0",
     "@zhivex-ai/azure-openai": "0.8.0",
     "@zhivex-ai/bedrock": "2.1.0",
-    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/core": "1.37.0",
     "@zhivex-ai/gemini": "0.14.0",
     "@zhivex-ai/meta": "0.3.0",
     "@zhivex-ai/openai": "0.17.0",
-    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/qwen": "0.18.1",
     "@zhivex-ai/vertex": "1.3.0",
     "google-auth-library": "11.3.1",
     zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.36.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   devDependencies: {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.3",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -15194,7 +15194,7 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   optionalDependencies: {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 };
 

package/dist/{index-74f9yhfh.js → index-2yyfg69h.js}

@@ -1,6 +1,6 @@
 import {
   createHarnessClientAdapter
-} from "./index-paf7z8kn.js";
+} from "./index-j466sekf.js";
 import {
   harnessPolicyDecisionEventSchema
 } from "./index-bt2p8x7r.js";

package/dist/{index-rz7wmp71.js → index-3wwfn5n6.js}

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.6.2",
+  version: "1.6.3",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -222,22 +222,22 @@ var package_default = {
     "@zhivex-ai/anthropic": "0.15.0",
     "@zhivex-ai/azure-openai": "0.8.0",
     "@zhivex-ai/bedrock": "2.1.0",
-    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/core": "1.37.0",
     "@zhivex-ai/gemini": "0.14.0",
     "@zhivex-ai/meta": "0.3.0",
     "@zhivex-ai/openai": "0.17.0",
-    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/qwen": "0.18.1",
     "@zhivex-ai/vertex": "1.3.0",
     "google-auth-library": "11.3.1",
     zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.36.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   devDependencies: {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.3",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -248,7 +248,7 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   optionalDependencies: {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 };
 

package/dist/{index-zrz4rs7p.js → index-5nmm0642.js}

@@ -16,7 +16,7 @@ import {
 } from "./index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "./index-rz7wmp71.js";
+} from "./index-3wwfn5n6.js";
 import {
   taskCheckReceiptSchema
 } from "./index-6dxrbnxm.js";

package/dist/{index-2r4f0p4n.js → index-hhrnrqfc.js}

@@ -1,6 +1,6 @@
 import {
   HARNESS_VERSION
-} from "./index-rz7wmp71.js";
+} from "./index-3wwfn5n6.js";
 import {
   readRegularFileNoFollow
 } from "./index-6dxrbnxm.js";

package/dist/{index-paf7z8kn.js → index-j466sekf.js}

@@ -16,7 +16,7 @@ import {
   reviseHarnessTaskAcceptance,
   runHarness,
   runHarnessTask
-} from "./index-pf73y4gt.js";
+} from "./index-vn91b9z1.js";
 import {
   ASSISTANT_RESPONSE_KEY,
   TASK_SOURCE_KEY,

package/dist/{index-1pn0ecs4.js → index-nxmk6re7.js}

@@ -3,7 +3,7 @@ import {
   combineMcpHostSessions,
   createHarnessMcpTools,
   issueMcpHostSession
-} from "./index-2r4f0p4n.js";
+} from "./index-hhrnrqfc.js";
 import {
   collectSnapshotInventory,
   readSnapshotFile,

package/dist/{index-pf73y4gt.js → index-vn91b9z1.js}

@@ -29,7 +29,7 @@ import {
   mcpConfigurationFingerprintInput,
   normalizeHarnessMcpConfiguration,
   resolveMcpHostSession
-} from "./index-2r4f0p4n.js";
+} from "./index-hhrnrqfc.js";
 import {
   EnvironmentPatchDriftError,
   Workspace,
@@ -88,7 +88,7 @@ import {
 } from "./index-fqqz1yt8.js";
 import {
   HARNESS_VERSION
-} from "./index-rz7wmp71.js";
+} from "./index-3wwfn5n6.js";
 import {
   FileSizeLimitError,
   MAX_EDIT_CHANGES,

package/dist/index.js

@@ -109,10 +109,10 @@ import {
   recoverHarnessLocalService,
   requestHarnessLocalService,
   startHarnessLocalService
-} from "./index-74f9yhfh.js";
+} from "./index-2yyfg69h.js";
 import {
   createHarnessClientAdapter
-} from "./index-paf7z8kn.js";
+} from "./index-j466sekf.js";
 import {
   openWorkspaceCheckpointStore
 } from "./index-4mn6m3bq.js";
@@ -154,7 +154,7 @@ import {
   runHarness,
   runHarnessReviewGroup,
   selectHarnessModel
-} from "./index-pf73y4gt.js";
+} from "./index-vn91b9z1.js";
 import {
   HARNESS_OPERATIONS_SCHEMA_VERSION,
   HARNESS_SQLITE_FILE,
@@ -173,7 +173,7 @@ import {
   createHttpMcpClient,
   loadHarnessMcpConfiguration,
   normalizeHarnessMcpConfiguration
-} from "./index-2r4f0p4n.js";
+} from "./index-hhrnrqfc.js";
 import {
   CliOciRuntimeAdapter,
   HARNESS_EXECUTION_ARTIFACT_SCHEMA_VERSION,
@@ -231,7 +231,7 @@ import {
   BUN_ENGINE_RANGE,
   HARNESS_VERSION,
   NODE_ENGINE_RANGE
-} from "./index-rz7wmp71.js";
+} from "./index-3wwfn5n6.js";
 import {
   EDIT_CONTRACT_SCHEMA_VERSION,
   EDIT_DIGEST_ALGORITHM,

package/dist/service-cli.js

@@ -2,21 +2,21 @@
 import {
   recoverHarnessLocalService,
   startHarnessLocalService
-} from "./index-74f9yhfh.js";
-import"./index-paf7z8kn.js";
+} from "./index-2yyfg69h.js";
+import"./index-j466sekf.js";
 import"./index-4mn6m3bq.js";
 import {
   createHarness
-} from "./index-pf73y4gt.js";
+} from "./index-vn91b9z1.js";
 import"./index-amjttjaj.js";
-import"./index-2r4f0p4n.js";
+import"./index-hhrnrqfc.js";
 import"./index-w0m1nckc.js";
 import"./index-1265j7t2.js";
 import"./index-c39197wq.js";
 import"./index-mzydbzp8.js";
 import"./index-bt2p8x7r.js";
 import"./index-fqqz1yt8.js";
-import"./index-rz7wmp71.js";
+import"./index-3wwfn5n6.js";
 import"./index-6dxrbnxm.js";
 import"./index-4gt045j0.js";
 import"./index-bpc596v3.js";

package/dist/{service-client-cli-pp5z4dmf.js → service-client-cli-xbj7j5kj.js}

@@ -9,17 +9,17 @@ import {
   navigateConsole,
   printPolicyInspection,
   sanitizeTerminalText
-} from "./cli-entry-4g2ewcnw.js";
+} from "./cli-entry-rsx0wpvs.js";
 import {
   CLI_EVENT_SCHEMA_VERSION,
   CLI_JSON_SCHEMA_VERSION,
   changeEnvelopeSchema,
   harnessPolicyDecisionEventSchema,
   serializeStreamResult
-} from "./cli-entry-6amx4mcc.js";
+} from "./cli-entry-nyzyvf24.js";
 import {
   HARNESS_VERSION
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   HARNESS_ERROR_CODES,
   HARNESS_ERROR_SCHEMA_VERSION,

package/dist/verify-historical-migrations.js

@@ -15427,7 +15427,7 @@ import { z as z34 } from "zod";
 // package.json
 var package_default = {
   name: "@zhivex-ai/harness",
-  version: "1.6.2",
+  version: "1.6.3",
   description: "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   type: "module",
   license: "MIT",
@@ -15648,22 +15648,22 @@ var package_default = {
     "@zhivex-ai/anthropic": "0.15.0",
     "@zhivex-ai/azure-openai": "0.8.0",
     "@zhivex-ai/bedrock": "2.1.0",
-    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/core": "1.37.0",
     "@zhivex-ai/gemini": "0.14.0",
     "@zhivex-ai/meta": "0.3.0",
     "@zhivex-ai/openai": "0.17.0",
-    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/qwen": "0.18.1",
     "@zhivex-ai/vertex": "1.3.0",
     "google-auth-library": "11.3.1",
     zod: "4.6.7"
   },
   overrides: {
-    "@zhivex-ai/core": "1.36.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   devDependencies: {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.3",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     typescript: "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -15674,7 +15674,7 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   optionalDependencies: {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 };
 

package/dist/zhx.js

@@ -3,7 +3,7 @@ import {
   HARNESS_VERSION,
   NODE_ENGINE_RANGE,
   shortCliHelp
-} from "./cli-entry-10th5awp.js";
+} from "./cli-entry-mbcq96nx.js";
 import {
   __require
 } from "./cli-entry-1bx83sw4.js";
@@ -41,6 +41,6 @@ if (argv.length === 1 && ["--version", "-v", "version"].includes(argv[0])) {
   process.stdout.write(`${shortCliHelp(HARNESS_VERSION)}
 `);
 } else {
-  const { runCli } = await import("./cli-84en174d.js");
+  const { runCli } = await import("./cli-yxvq8qf1.js");
   await runCli(argv);
 }

package/docs/AZURE_OPENAI.md

@@ -5,7 +5,7 @@ Azure OpenAI is a separate provider (`azure-openai`). It does not reuse
 run for this route. Prices are not copied from the public OpenAI catalog.
 
 Published `@zhivex-ai/azure-openai@0.8.0` is the adapter pinned by this tree.
-It requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.36.0`.
+It requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.37.0`.
 Language models report Tier A. Hosted tool gates such as tool search follow
 the model id (`gpt-5.4` and `gpt-6-astra` in this adapter). An opaque
 deployment name does not receive those gates unless a deployment map names

package/docs/BEDROCK.md

@@ -5,7 +5,7 @@ direct API route. No live Harness certification has been run for this route.
 Pricing and context limits are not inferred.
 
 Published `@zhivex-ai/bedrock@2.1.0` is the adapter pinned by this tree. It
-requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.36.0`.
+requires Core `^1.36.0`, and this checkout pins `@zhivex-ai/core@1.37.0`.
 This integration reports the installed adapter's labels and does not relabel
 them.
 

package/docs/CODE_RELEASE.md

@@ -1,12 +1,25 @@
 # Code release procedure
 
-## Harness 1.6.2 does not release Code
+## Prepared patch: Code 0.4.2
 
-Harness source is `1.6.2`, pending publication to `latest`. Installed
-acceptance requires the Code source pin to equal that candidate, so
-`@zhivex-ai/code` stays version `0.4.0` and pins `@zhivex-ai/harness` to
-`1.6.2`. Published npm Code `0.4.0` remains pinned to Harness `1.5.0`. Do not
-republish `0.4.0` and do not create a `code-v*` tag for this engine bump.
+Code `0.4.2` pins Harness `1.6.3` exactly and is pending publication to `latest`. Published Code `0.4.1` and Harness `1.6.2` remain unchanged. The private Web development dependency stays on the published Harness `1.6.2` so clean CI can install its frozen lockfile before the candidate exists in the registry; offline tests explicitly link the built `1.6.3` candidate.
+
+After Harness publication and registry/provenance verification, use annotated `code-v0.4.2` on the same reviewed main SHA, `channel=latest`, `mode=oidc`, and the protected `release-code.yml` workflow. The final Code gate must resolve the real published Harness dependency without candidate overrides, then verify retained-artifact installation and provenance. Local paired-artifact tests do not substitute for that registry gate. See [the preparation report](https://github.com/Zhivex/zhivex-harness/blob/main/docs/reports/RELEASE_1_6_3_CODE_0_4_2.md).
+
+## Published patch: Code 0.4.1
+
+Harness `1.6.2` is published on npm `latest`. `@zhivex-ai/code` `0.4.1` is
+published on `latest`, pinned exactly to Harness `1.6.2`. The engine bump is
+its only change. Published npm Code `0.4.0` remains pinned to
+Harness `1.5.0` and is not republished. Annotated `code-v0.4.1` on the reviewed
+main SHA, `channel=latest`, ran through the protected workflow and its
+environment approval.
+
+## Previous preparation: Harness 1.6.2 did not release Code
+
+Harness `1.6.2` was prepared while `@zhivex-ai/code` stayed version `0.4.0`,
+with its source pin on `1.6.2` for installed acceptance. No `code-v*` tag was
+created for that engine bump.
 
 ## Pending patch: 2026-10-16
 

package/docs/DURABLE_OPERATIONS.md

@@ -70,7 +70,7 @@ Loading a run reconstructs its complete state for compatibility with approvals,
 
 Logical backups contain hydrated history rather than database references, so restoration does not require the original artifact tables. Exports up to 64 MiB retain the legacy JSON format; larger exports use the versioned `ZHIVEX-STATE-SEGMENTS-1` transport with bounded frames, including split strings. RC13 reads both formats and verifies the same logical checksum before import. Older versions cannot read segmented exports. File I/O and checksum serialization are incremental; the public backup/import APIs still hydrate the complete logical bundle in memory. Segmented files have no aggregate 64 MiB ceiling. A state-limit failure records a bounded terminal diagnostic on the last durable checkpoint; the unsaved payload is not claimed as preserved. Use `/status` to inspect the failed run before `/continue`. Recovery retains tool journal receipts and never re-executes an operation itself.
 
-The current source pins Core 1.36.0 and Agents 1.12.0. New stores require no
+The current source pins Core 1.37.0 and Agents 1.12.0. New stores require no
 conversion. Before upgrading an existing shared SDK store, stop its workers and
 upgrade them together with a complete backup. Verified legacy runs retain their
 physical keys and remain readable; new runs use canonical keys that distinguish

package/docs/ENGINE_API.md

@@ -1,7 +1,7 @@
 # Engine API and Code integration
 
 The terminal-independent package entrypoints shipped in Harness 1.3.0 and remain
-in published Harness 1.4.0 (npm `latest`). This checkout is Harness 1.6.2, pending publication. They are not present in Harness 1.2.0.
+in Harness 1.6.2, published on npm `latest`. They are not present in Harness 1.2.0.
 The protected workflow validated the exact stable tarball, live gates and
 registry integrity/provenance; local candidate smoke remains contributor evidence. Do not install registry 1.2.0 and
 expect the new entrypoints to exist.

package/docs/EXTENSIBILITY.md

@@ -8,7 +8,7 @@ Built-in registrations are Meta, Qwen, OpenAI, Gemini, Anthropic, Vertex, Amazon
 
 Library callers can use `DEFAULT_PROVIDER_REGISTRY`, `BUILTIN_PROVIDER_REGISTRATIONS`, `createProviderRegistry`, or `DEFAULT_PROVIDER_REGISTRY.extend(...)`, then pass the registry to `resolveHarnessConfig`, `createProviderModel`, provider diagnostics, or `createHarness({ providerRegistry })`. Registration IDs, environment-variable names, defaults, diagnostics, and factories are validated before they become selectable.
 
-The coordinated stable SDK batch pins `@zhivex-ai/agents@1.12.0`, `@zhivex-ai/core@1.36.0`, `@zhivex-ai/meta@0.3.0`, `@zhivex-ai/qwen@0.18.0`, `@zhivex-ai/openai@0.17.0`, `@zhivex-ai/gemini@0.14.0`, `@zhivex-ai/anthropic@0.15.0`, `@zhivex-ai/vertex@1.3.0`, `@zhivex-ai/bedrock@2.1.0`, and `@zhivex-ai/azure-openai@0.8.0`. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.36.0 satisfies Agents `^1.34.0` and the provider adapters' `^1.36.0` floors. Vertex 1.3.0 requires OpenAI `^0.17.0`, Anthropic `^0.15.0`, and Gemini `^0.14.0`. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
+The coordinated stable SDK batch pins `@zhivex-ai/agents@1.12.0`, `@zhivex-ai/core@1.37.0`, `@zhivex-ai/meta@0.3.0`, `@zhivex-ai/qwen@0.18.1`, `@zhivex-ai/openai@0.17.0`, `@zhivex-ai/gemini@0.14.0`, `@zhivex-ai/anthropic@0.15.0`, `@zhivex-ai/vertex@1.3.0`, `@zhivex-ai/bedrock@2.1.0`, and `@zhivex-ai/azure-openai@0.8.0`. Qwen 0.18.1 depends on Core `^1.37.0` and rejects non-string portable-decision instructions. Qwen 0.16.2 types malformed Responses tool arguments and malformed SSE events; Core 1.37.0 satisfies Agents `^1.34.0` and the provider adapters' `^1.36.0` floors. Vertex 1.3.0 requires OpenAI `^0.17.0`, Anthropic `^0.15.0`, and Gemini `^0.14.0`. These exact versions are pinned in the lockfile. Stable SDK publication does not replace Harness release-bound certification. Qwen `0.11.x` normalizes missing, placeholder, and continuation tool-call identifiers inside the adapter; Harness retains its deterministic provider-boundary normalizer as defense in depth until the exact candidate passes the complete release-bound representative matrix. A Core override keeps one runtime contract identity across every adapter, while Core `1.13.0` corrects compaction usage accounting and interaction-group retention. OpenAI `0.11.2` preserves synthetic assistant history in Responses, so the harness no longer requires its compaction transport or accounting workarounds.
 
 OpenAI is based on the GPT-5.6 family: `gpt-5.6-luna` is the default, with `gpt-5.6-terra` and `gpt-5.6-sol` available through `--model`. Availability remains organization-dependent while the upstream family is in limited preview, and the adapter uses the Responses API by default.
 

package/docs/FIRST_USE.md

@@ -1,13 +1,13 @@
 # First use
 
-This guide targets stable `1.6.2`, pending publication to npm `latest`. The versioned install commands below become available only after protected publication. npm `latest` remains stable 1.5.0 until that publication.
+This guide targets source candidate `1.6.3`, pending publication. Registry commands below apply after publication; current npm `latest` remains `1.6.2`.
 
 ## Install and start
 
 Install Node.js 22.13.0 or newer and Git. Then:
 
 ```sh
-npm install -g @zhivex-ai/harness@1.6.2
+npm install -g @zhivex-ai/harness@1.6.3
 cd /path/to/your/project
 zhx
 ```
@@ -82,16 +82,16 @@ For command execution, configure [OCI isolation](EXECUTION_ENVIRONMENTS.md).
 With Bun 1.4.0 or newer and a supported Node runtime:
 
 ```sh
-bun add --global @zhivex-ai/harness@1.6.2
+bun add --global @zhivex-ai/harness@1.6.3
 zhx
 ```
 
 For a disposable version/help/environment check without a global installation:
 
 ```sh
-bunx @zhivex-ai/harness@1.6.2 --version
-bunx @zhivex-ai/harness@1.6.2 --help
-bunx @zhivex-ai/harness@1.6.2 doctor
+bunx @zhivex-ai/harness@1.6.3 --version
+bunx @zhivex-ai/harness@1.6.3 --help
+bunx @zhivex-ai/harness@1.6.3 doctor
 ```
 
 For source development, use the [contributor guide](https://github.com/Zhivex/zhivex-harness/blob/main/CONTRIBUTING.md).

package/docs/MINIMUM_TASK_AUTHORITY.md

@@ -56,7 +56,7 @@ dispatch/cap behavior, not provider billing guarantees or model quality.
 | Built-in Anthropic API key (`@zhivex-ai/anthropic` 0.15.0) | Supported | Messages `max_tokens`; non-refreshable built-in credentials; `maxRetries=0` |
 | Built-in Gemini (`@zhivex-ai/gemini` 0.14.0) | Supported | `generationConfig.maxOutputTokens`; `maxRetries=0` |
 | Built-in Vertex (`@zhivex-ai/vertex` 1.3.0) | Supported | `generationConfig.maxOutputTokens`; real ADC callback, synthetic credential source in tests; `maxRetries=0` |
-| Qwen (`@zhivex-ai/qwen` 0.18.0) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
+| Qwen (`@zhivex-ai/qwen` 0.18.1) | Blocked as Code primary | Explicit Chat-mode middleware tested with capped `max_tokens`; Code has no explicit mode selector and Responses rejects `maxTokens` |
 | Meta | Blocked | Harness continuation fetch can replay a 400 response outside SDK retry admission |
 | Injected/custom adapters, refreshable Anthropic OAuth | Blocked | No vetted transport provenance; OAuth transport can replay a 401 after refresh outside ordinary retry admission |
 | Mock | Offline tests only | Synthetic usage is never billing evidence |

package/docs/PROJECT_MEMORY.md

@@ -7,7 +7,7 @@ generated automatically; hosts may submit a suggestion for operator review.
 
 ## CLI
 
-Use `zhx` with Harness 1.6.2, pending publication. `zhivex-code` stays on Code 0.4.0. Its source pin is Harness 1.6.2; published Code 0.4.0 remains pinned to Harness 1.5.0. Commands
+Use `zhx` with Harness 1.6.2, published on `latest`. `zhivex-code` is Code 0.4.1, published on `latest` and pinned exactly to Harness 1.6.2. Commands
 print bounded JSON, including the selected workspace/scope hashes. Quote content
 as one argument. Memory commands do not start a model or read credentials.
 

package/docs/VERTEX.md

@@ -44,7 +44,7 @@ Errors expose bounded categories for authentication, permission, unavailable
 model/route, rate limit and server failures. Raw Google payloads, token values,
 credential paths and service-account identities are not retained in errors.
 
-The integration pins `@zhivex-ai/vertex@1.3.0` with Core 1.36.0 and
+The integration pins `@zhivex-ai/vertex@1.3.0` with Core 1.37.0 and
 `google-auth-library@11.3.1`. Deterministic tests exercise the installed SDK's
 transport, streaming, signed continuation, approval/reopen and route mismatch.
 They are not evidence of a live project, renewable ADC or IAM authorization.

package/docs/WEB_LIMITS.md

@@ -3,7 +3,7 @@
 New interactive Web/terminal tasks have no accumulated spend, token, step,
 tool-call or duration cap unless configured. This change uses the published SDK contract from
 Zhivex/zhivex-ai-sdk PR 142 (Core/SDK 1.31.0, Agents 1.11.0). Direct Harness, Code
-and the root Core override now pin Core 1.36.0; Agents is 1.12.0.
+and the root Core override now pin Core 1.37.0; Agents is 1.12.0.
 Provider package pins are Anthropic 0.15.0, OpenAI 0.17.0 and Vertex 1.3.0.
 Headless policies and release gates remain unchanged.
 

package/docs/adr/0002-isolated-mcp-stdio.md

@@ -20,7 +20,7 @@ activate stdio, change configuration schema 1, or claim isolated execution passe
   options with abort, timeout/idempotency key, and an HTTP transport; no executable
   stdio factory was found in that dependency. The control-plane transport enum is
   not an executor.
-- The current pin is `@zhivex-ai/core` 1.36.0, which includes an experimental
+- The current pin is `@zhivex-ai/core` 1.37.0, which includes an experimental
   stdio client. Harness still does not treat that factory as the OCI boundary.
 
 MCP stdio uses UTF-8 newline-delimited JSON-RPC on stdin/stdout; stderr is a

package/evaluations/representative-assembly-matrix.json

@@ -67,7 +67,8 @@
     "v1.5.0",
     "v1.6.0",
     "v1.6.1",
-    "v1.6.2"
+    "v1.6.2",
+    "v1.6.3"
   ],
   "expectedModels": [
     {
@@ -597,6 +598,14 @@
         "qwen": "qwen3.8-flash",
         "openai": "gpt-6-luna"
       }
+    },
+    {
+      "releaseTag": "v1.6.3",
+      "models": {
+        "meta": "muse-spark-1.3-contributor",
+        "qwen": "qwen3.8-flash",
+        "openai": "gpt-6-luna"
+      }
     }
   ],
   "expectedCases": [

package/examples/README.md

@@ -2,19 +2,19 @@
 
 ## Isolated Bun installation
 
-Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After protected stable publication, this installs the 1.6.2 artifact in a temporary consumer, without building the source checkout or changing global tools:
+Requirements: Bun 1.4.0+, Node.js 22.13.0+, and Git on macOS or Linux. After publication, this installs the 1.6.3 artifact in a temporary consumer, without building the source checkout or changing global tools:
 
 ```bash
 harness_demo_dir=$(mktemp -d)
 cd "$harness_demo_dir"
 printf '{"name":"harness-first-run","private":true}\n' > package.json
-bun add --exact --ignore-scripts @zhivex-ai/harness@1.6.2
+bun add --exact --ignore-scripts @zhivex-ai/harness@1.6.3
 ./node_modules/.bin/zhx --version
 ./node_modules/.bin/zhx --help
 ./node_modules/.bin/zhx doctor --provider openai --json
 ```
 
-Version must print `1.6.2`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
+Version must print `1.6.3`; help lists commands. Doctor does not contact a provider. Without `OPENAI_API_KEY`, it reports the missing credential and exits with code `3`; inspect the JSON checks before proceeding. A directory without Git initialization can also produce a diagnostic warning. No paid model call is required for these checks. Both `zhx` and `zhivex-harness` are installed aliases; Bun manages installation, and their shebang runs Node.
 
 To continue in your actual project, use the [global installation and credential setup](../README.md#quick-start), then `zhx init --profile daily --provider openai` and `zhx doctor --profile daily`. Real tasks require the selected provider credential in the process environment. Profiles store provider/model choices, never credentials. See [CLI](../docs/CLI.md) and [support](../SUPPORT.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
@@ -221,22 +221,22 @@
     "@zhivex-ai/anthropic": "0.15.0",
     "@zhivex-ai/azure-openai": "0.8.0",
     "@zhivex-ai/bedrock": "2.1.0",
-    "@zhivex-ai/core": "1.36.0",
+    "@zhivex-ai/core": "1.37.0",
     "@zhivex-ai/gemini": "0.14.0",
     "@zhivex-ai/meta": "0.3.0",
     "@zhivex-ai/openai": "0.17.0",
-    "@zhivex-ai/qwen": "0.18.0",
+    "@zhivex-ai/qwen": "0.18.1",
     "@zhivex-ai/vertex": "1.3.0",
     "google-auth-library": "11.3.1",
     "zod": "4.6.7"
   },
   "overrides": {
-    "@zhivex-ai/core": "1.36.0"
+    "@zhivex-ai/core": "1.37.0"
   },
   "devDependencies": {
-    "@agentclientprotocol/sdk": "1.8.0",
+    "@agentclientprotocol/sdk": "2.1.0",
     "@modelcontextprotocol/server": "2.3.1",
-    "@types/bun": "1.4.3",
+    "@types/bun": "1.4.4",
     "@types/node": "^26.6.5",
     "typescript": "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3"
@@ -247,6 +247,6 @@
   },
   "packageManager": "bun@1.4.0",
   "optionalDependencies": {
-    "@napi-rs/keyring": "2.1.1"
+    "@napi-rs/keyring": "2.1.2"
   }
 }