johns-harness 2026.9.28 → 2026.9.30

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026.9.30
+
+- Family 77: weekly official six-provider audit. DeepSeek V4 Flash/Pro now transmit native low for minimal/low instead of silently using high. Meta Standard Muse 1.2/1.3 preserve provider-default effort when the caller omits it instead of forcing minimal. Gemini 3.8 Flash and 3.5 Flash-Lite omit deprecated/ignored sampling temperature. Preserve all aliases, saved model IDs, owner context caps and default selections.
+- Astra native Responses max, Fable 5.1 max and Grok 4.6 xhigh were already correct and were independently wire-verified. Meta inference remains account-dependent; no configured account was available for this audit. New Gemini Live/Interactions models are not mislabeled as working generateContent chat models.
+- Exact preimage/postimage replay, three actual-adapter regression surfaces and installed-artifact verification. See `docs/PROVIDER-AUDIT-2026-09-20.md`. Roll back with `npm i -g johns-harness@2026.9.29`; focused adapter installs use their recorded pre-patch backups.
+
+## 2026.9.29
+
+- Family 76.1: the registration-safe reload worker waits for `launchctl bootout` teardown to finish before bootstrapping the staged plist. A gateway that shuts down gracefully on SIGTERM stays registered for a moment after `bootout`; 2026.9.28 mistook that lingering registration for the replacement, skipped `bootstrap`, and reported `Service removed while waiting for health` with the job left unloaded (observed on the first live fleet reload). The wait is bounded at 30 seconds and a timeout is a retryable worker error, not an advanced checkpoint. Ordinary `kickstart -k` restarts were unaffected. The real macOS self-restart fixture now exits gracefully so the reload cases reproduce the race; two unit cases cover the wait and the timeout.
+
 ## 2026.9.28
 
 - Family 76: `johnness gateway restart` from inside a gateway's own launchd process group no longer unregisters its supervisor. The old `bootout -> wait -> bootstrap` sequence killed the caller before it could bootstrap, which caused a multi-hour outage when a cron issued the restart. All three service implementations, both internal restart bundles and both updater bundles now share `dist/launchd-lifecycle.js`: a loaded service restarts with `kickstart -k` only (no bootout, unload or bootstrap fallback), a missing service may bootstrap its explicitly selected plist, and real plist replacement (`gateway install --force`) stages validated bytes and hands off to an independently registered, durably armed completer with an fsynced phase journal, retry under launchd, and prior-plist restore after five failed bootstraps. Explicit stop/uninstall cancels any pending completer. Updaters snapshot the helper before npm replaces the installed tree. Success requires a changed launchd-owned PID and, when a port is declared, `/healthz` plus listener ownership by that PID; receipts live in `<stateDir>/lifecycle/<uuid>/`. Ten browser timeout messages now suggest a non-browser alternative instead of a whole-gateway restart. Covered by lifecycle unit, fault-injection, replay and packed-artifact tests plus five real disposable LaunchAgent self-restart/reload cases (`JOHNNESS_TEST_LAUNCHD=1`); verifier check 76.1.

package/README.md

@@ -85,7 +85,7 @@ node johnness.mjs --help
 ### Verify
 
 ```bash
-npm test                        # 990 tests against the installed dependency tree
+npm test                        # 992 tests against the installed dependency tree
 bash scripts/verify-patches.sh  # 468 checks across every patch family
 ```
 
@@ -199,7 +199,7 @@ The log is a [`RULES.md`](RULES.md) workspace convention enforced through the ac
 
 ## Patch families
 
-The runtime carries 76 patch families plus the 65.1 safe-update amendment. Each is a production fix applied at the source with a regression test, a durable patch marker, and an explicit recovery path. A verifier runs 468 checks against the package tree and installed dependencies, and 990 tests run against the installed dependency tree.
+The runtime carries 76 patch families plus the 65.1 safe-update amendment. Each is a production fix applied at the source with a regression test, a durable patch marker, and an explicit recovery path. A verifier runs 468 checks against the package tree and installed dependencies, and 992 tests run against the installed dependency tree.
 
 Every family follows the same six steps: reproduce the failure, trace the exact runtime path, make the smallest source-level change that restores the invariant, add a regression test and a patch marker, run the verifier, and retain rollback artifacts. The full index: [`docs/PATCHES.md`](docs/PATCHES.md).
 

package/dist/launchd-lifecycle.js

@@ -169,6 +169,17 @@ async function healthy(p, current, deps) {
   if (!pids.length || !pids.every((pid) => descendant(pid, current.pid))) return false;
   try { return (await fetch(`http://127.0.0.1:${p.port}/healthz`, { signal: AbortSignal.timeout(2000) })).ok; } catch { return false; }
 }
+/** After bootout, launchd finishes SIGTERM teardown asynchronously; only the previous pid can
+ * still be registered here. A different registered pid means the plist was already re-bootstrapped. */
+async function unloaded(run, p, deps) {
+  const deadline = Date.now() + (deps.unloadTimeoutMs ?? 30000);
+  for (;;) {
+    const current = runtime(run, p.target);
+    if (!current.loaded || (current.pid && p.previousPid && current.pid !== p.previousPid)) return current;
+    if (Date.now() >= deadline) throw new Error("Previous process still registered after bootout; independent worker will retry");
+    await (deps.pause || pause)(200);
+  }
+}
 /** Restartable state machine. Checkpoints precede effects; real supervisor state
  * reconciles a missing effect acknowledgement after SIGKILL. Exported for fault tests. */
 export async function executeLaunchdOperation(p, receiptFile, deps = {}) {
@@ -195,6 +206,11 @@ export async function executeLaunchdOperation(p, receiptFile, deps = {}) {
       const r = effect(["bootout", p.target]);
       if (r.code && !missing(r)) throw new Error(`launchctl bootout failed (${r.code})`);
     }
+    // bootout is asynchronous for a job that handles SIGTERM: launchd keeps it registered (old pid)
+    // until graceful shutdown completes. Wait for the teardown before recording the intent to
+    // bootstrap, or the still-registered job would be mistaken for the replacement and later
+    // vanish, producing "Service removed while waiting for health" with no gateway loaded.
+    await unloaded(run, p, deps);
     save("bootstrap-intent"); receipt = read(receiptFile);
     current = runtime(run, p.target);
   }
@@ -220,6 +236,8 @@ export async function executeLaunchdOperation(p, receiptFile, deps = {}) {
     save("health-pending", { rolledBack: true, healthStartedAt: Date.now() }); receipt = read(receiptFile);
   }
   if (receipt.status === "bootstrap-intent") {
+    // Resume after a crash between bootout and this checkpoint: the old job may still be tearing down.
+    if (p.mode === "reload") await unloaded(run, p, deps);
     current = runtime(run, p.target);
     if (!current.loaded) {
       const r = effect(["bootstrap", p.domain, p.plistPath]);

package/docs/PATCHES.md

@@ -2741,6 +2741,18 @@ self-restart can disappear; the independent receipt is the source of truth.
 Ten browser error copies now report a browser blocker and suggest a non-browser
 alternative, never a whole-gateway restart. Exec process-group behavior is unchanged.
 
+**76.1 (2026.9.29), graceful unload before bootstrap.** The first live reload of a real
+gateway (Trisha, `gateway install --force` semantics) failed with `Service removed while
+waiting for health` and left the job unloaded. `launchctl bootout` returns before a job
+that handles SIGTERM has exited; the worker's next `print` still saw the old registered
+PID, treated the job as loaded, skipped `bootstrap`, and then watched launchd finish the
+teardown. The worker now waits after `bootout` (and again on resume at `bootstrap-intent`)
+until the target is unregistered or a different PID is registered, with a 30 s bound that
+surfaces as a retryable worker error instead of an advanced checkpoint. The real macOS
+fixture now performs a 700 ms graceful SIGTERM shutdown so the reload cases exercise the
+race; two unit cases cover the wait and the timeout. `kickstart -k` restarts were never
+affected.
+
 **Verification:** `tests/launchd-safe-restart.test.mjs` covers lifecycle phases,
 fault injection, error classification, scoping, all copies and exact patch replay.
 `JOHNNESS_TEST_LAUNCHD=1 node --test --test-concurrency=1 tests/launchd-self-restart.macos.test.mjs`
@@ -2761,3 +2773,30 @@ restart` uses the safe worker. For a real plist change, use the new version's
 `gateway install --force`, which stages the change before handoff. Rolling back to
 2026.9.27 or earlier restores the old restart defect; if necessary install it externally and
 use kickstart, never its gateway restart CLI from a gateway child.
+
+
+## 77. Weekly provider reasoning corrections (2026-09-20)
+
+The six-provider audit changes only the DeepSeek, Meta Responses and Gemini adapters.
+Both DeepSeek V4 models now send native `low` for harness `minimal`/`low`, rather
+than silently spending at `high`. The existing `xhigh` to `max` compatibility
+mapping, explicit off, server-default omission, limits and aliases are preserved.
+Meta Standard Muse 1.2/1.3 now omit `reasoning.effort` when the caller omits it,
+instead of forcing `minimal`; explicit efforts, validation, encrypted replay and
+`store: false` are unchanged. Meta account access was not available for live inference.
+
+`patches/provider-audit-20260920/changes.json` owns the exact three adapter pre/post
+images plus Meta's historical replay snapshot. Gemini 3.8 Flash and 3.5 Flash-Lite also omit deprecated/ignored temperature.
+The patcher preflights every target
+before writing, refuses drift, supports alternate roots and a dependency-only
+focused refresh. Family 67 reverses only these exact edits during historical hash
+validation. Both the modern and old Meta replay tests remain byte-identical.
+
+No model IDs, aliases, config, credentials, default model or owner context caps
+change. Astra Responses already supports native `max`; Grok native `xhigh` and
+modern Claude native `max` were already correct. The global `/think max` synonym
+still means harness `xhigh`; it is not a new distinct UI level in this patch.
+
+Evidence and official sources: [weekly audit](PROVIDER-AUDIT-2026-09-20.md).
+Tests: `tests/provider-audit-20260920.test.mjs`, provider catalog, Muse transport
+and historical replay; verifier 77.1 checks installed adapter hashes exactly.

package/docs/PROVIDER-AUDIT-2026-09-20.md

@@ -0,0 +1,120 @@
+# Six-provider official API audit: 2026-09-20
+
+This weekly audit builds on the successful September 13 catalog release, not on
+upstream OpenClaw. Registry IDs, aliases, saved-session IDs, owner context caps,
+credentials and the selected default are unchanged. Family 77 is a focused
+provider-parameter patch, released as `johns-harness@2026.9.30`.
+
+## Changes
+
+1. **DeepSeek:** `minimal`/`low` now serialize as native `low` on `deepseek-flash`
+   and `deepseek-v4-pro`, rather than silently increasing effort to `high`.
+   Omission remains omitted; explicit low-level off disables thinking. Preserve
+   the existing harness `xhigh`/`max` -> native `max` compatibility mapping for
+   saved sessions. DeepSeek's own raw `xhigh` synonym maps to `high`; that is not
+   a reason to silently lower the harness's established highest-effort behavior.
+2. **Meta Muse:** omitted effort stays absent instead of forcing `minimal`.
+   Explicit effort validation, `store:false`, encrypted reasoning replay and
+   tool commentary phases are unchanged. No Contributor/training-consent models.
+3. **Gemini:** omit deprecated/ignored temperature for `gemini-3.8-flash` and
+   `gemini-3.5-flash-lite`. Older model behavior is unchanged. The live API still
+   accepts this field, but the official migration guide says to remove it and
+   warns that future models reject it. No topP/topK are generated by this adapter.
+
+No new supported general-purpose model ID was identified since the prior audit.
+No model was removed and no alias was upgraded to a preview.
+
+## Independent provider results
+
+| Provider | Official/account result | Decision |
+|---|---|---|
+| DeepSeek | `/models` HTTP 200, two IDs: `deepseek-flash`, `deepseek-v4-pro`. Latest changelog release September 10, V4.1 Flash. Native low/high/max documented. Flash omission/low/high/xhigh/max and Pro low each HTTP 200. | Correct low serialization; retain all limits and prices. |
+| Meta | Official Standard API confirms Muse 1.3 and retained 1.2 on `https://api.meta.ai/v1/responses`; 1.3 adds native max. No configured Meta credential. | Correct omission from official schema/reasoning docs and actual offline adapter tests; do not claim authenticated inference. |
+| Google | Native model listing HTTP 200 (62 records); 3.8 Flash and 3.5 Flash-Lite confirmed, each 1,048,576 input / 65,536 output. 3.8 minimal smoke HTTP 200. | Omit deprecated temperature; preserve thinking-level mapping. New September 15 Live audio models require a Live adapter, not generateContent chat registration. September 17 Antigravity preview is an agent/Interactions API, not a drop-in model. |
+| OpenAI | Native `/models` HTTP 200. Astra Responses omission/xhigh/max HTTP 200; none HTTP 400 explicitly reports supported low/medium/high/xhigh/max. | Existing native Responses max support is correct. Do not import another application's Chat Completions limitations. No catalog change. |
+| Anthropic | Native `/v1/models` HTTP 200 (10 records) confirms Fable 5.1, Opus 5 and Sonnet 5. Fable adaptive thinking + output_config.effort=max HTTP 200. | Native max was already preserved by the adapter; no change. Account-gated models are not inferred from announcements. |
+| xAI | Native `/v1/models` HTTP 200 (34 records) includes Grok 4.6. Omitted effort and xhigh Chat Completions requests HTTP 200. | xhigh was already supported. Keep exactly 200K owner context cap, 64K output, existing aliases. |
+
+The model listing counts are account/time-specific, not availability promises.
+No API list had an unconsumed pagination indicator. No 429 occurred and no
+credential was printed or persisted in evidence. Minimal inference probes used
+synthetic "Reply with OK only" prompts and at most 64 output tokens. Successful
+HTTP parameter acceptance is not a long-output, all-modality or full tool-loop
+inference certification. Offline existing tests separately cover streaming,
+reasoning/signature/encrypted replay, tool calls and errors.
+
+## Metadata and compatibility
+
+- DeepSeek Flash is V4.1 Flash (text/image), Pro is V4 Pro 0813 (text).
+  Both have 1,048,576 context / 393,216 maximum output. Native default is
+  thinking enabled/high. Nonthinking default max output is 8K; thinking high is
+  64K and max is 128K. Temperature has no effect in thinking mode and remains
+  omitted. The adapter sends `max_tokens`, not `max_completion_tokens`, and
+  does not invent developer-role, store, or strict-tool support.
+- Meta Standard 1.3/1.2 retain 1,048,576 context / 131,072 output and text/image
+  input in the harness. Models always reason. Omission lets the model choose
+  effort; none/off are invalid. Max is exclusive to Standard 1.3. Standard
+  pricing remains $1.25 input / $4.25 output / $0.15 cached input per million.
+- Google current Flash/Lite use native thinking levels rather than a synthetic
+  budget. 3.8 MINIMAL remains mapped to LOW by the previously verified adapter;
+  3.5 Lite supports MINIMAL. Omission stays omitted. Native API supports more
+  media than the pinned text/image agent interface; this patch does not claim
+  Live audio, Interactions, image/video output or unrelated tool adapters.
+- OpenAI native context is 1,050,000 with 128K max output; conservative existing
+  harness budgets remain unchanged. Astra cannot disable reasoning. The native
+  Responses adapter already passes max exactly. The global `/think max` spelling
+  still normalizes to harness xhigh; adding a separate UI enum is not this patch.
+- Modern Claude native effort levels include distinct xhigh and max. Adaptive
+  thinking omits manual budgets and sampling. Fable/Opus retain 300K owner caps;
+  Sonnet's conservative existing budget remains untouched.
+- Grok 4.6 documents 500K native context / 64K output; the harness deliberately
+  retains 200K. Its reasoning_effort xhigh is transmitted exactly. Prices remain
+  $2 input / $6 output / $0.50 cached input per million; native long-prompt
+  multipliers are not represented by the basic catalog cost estimator.
+
+Prices/limits not changed in this release remain at their last verified values;
+there is no blanket claim of re-pricing every legacy registry entry. DeepSeek
+current pricing and Meta Standard pricing were independently rechecked. No price,
+context or output-limit diff was required on the changed entries.
+
+## First-party sources checked
+
+- DeepSeek: [catalog/pricing](https://api-docs.deepseek.com/quick_start/pricing/),
+  [thinking](https://api-docs.deepseek.com/guides/thinking_mode/),
+  [complete Chat Completions reference](https://api-docs.deepseek.com/api/create-chat-completion/),
+  [changelog](https://api-docs.deepseek.com/updates).
+- Meta: [models](https://ai.developer.meta.com/docs/models.md),
+  [reasoning](https://ai.developer.meta.com/docs/reasoning.md),
+  [Responses protocol](https://ai.developer.meta.com/docs/protocols/responses.md),
+  [create response](https://ai.developer.meta.com/docs/api-reference/responses/create-response.md),
+  [pricing](https://ai.developer.meta.com/docs/pricing-rate-limits.md).
+  HTML indexes intermittently returned HTTP 500; official `.md` pages succeeded.
+- Google: [model catalog](https://ai.google.dev/gemini-api/docs/models),
+  [thinking](https://ai.google.dev/gemini-api/docs/thinking.md.txt),
+  [latest-model migration](https://ai.google.dev/gemini-api/docs/generate-content/latest-model),
+  [changelog](https://ai.google.dev/gemini-api/docs/changelog).
+  Some index requests redirected repeatedly; native model listing and direct
+  content fetch supplied the data. Locale variants do not alter exact API IDs.
+- OpenAI: [catalog](https://developers.openai.com/api/docs/models/),
+  [Astra model reference](https://developers.openai.com/api/docs/models/gpt-6-astra.md).
+- Anthropic: [overview](https://platform.claude.com/docs/en/models/overview),
+  [Fable 5.1](https://platform.claude.com/docs/en/models/fable-5-1/overview),
+  [effort](https://platform.claude.com/docs/en/build-with-claude/effort).
+- xAI: [catalog](https://docs.x.ai/developers/models),
+  [Grok 4.6](https://docs.x.ai/developers/models/grok-4.6).
+
+## Verification and recovery
+
+Family 77 has exact preimage/postimage hashes, all-file preflight before writes,
+read-only checks, alternate-root and dependency-only modes, and idempotent replay.
+Family 67 validates its historical surface after reversing only the exact new
+edits. Meta's Family 53 snapshot is synchronized. Payload tests exercise actual
+installed adapters, not string-only fixtures. Existing alias contract tests and
+all prior catalog/transport replay tests remain part of the release gates.
+
+The release is a three-adapter patch on 2026.9.29. Roll back a standard package
+installation to `johns-harness@2026.9.29`; focused installations must restore their
+recorded pre-patch adapter files, not overwrite state or migrate directories.
+A running gateway caches provider modules. Disk validation is not activation:
+coordinate a safe restart after active work finishes, never interrupt jobs merely
+to report a refreshed version.

package/docs/PROVIDER-CATALOG.md

@@ -1,4 +1,4 @@
-# Current provider catalog — checked 2026-09-13
+# Current provider catalog — checked 2026-09-20
 
 Family 67 audits general-purpose agent models against first-party documentation and
 provider-authenticated model lists. It is a targeted registry/adapter refresh on the
@@ -31,7 +31,7 @@ Registry presence does not promise account entitlement.
 
 - **DeepSeek V4:** omitted effort leaves `thinking` and `reasoning_effort` absent,
   preserving the server's default enabled/high. Explicit low-level `off`/`none`
-  sets `thinking: {type: "disabled"}`. Minimal/low/medium/high map to native `high`;
+  sets `thinking: {type: "disabled"}`. Minimal/low map to native `low`; medium/high map to native `high`;
   xhigh/max map to native `max`. Unknown efforts fail before HTTP. Disabled thinking
   must not carry `reasoning_effort`. In enabled/default mode temperature is omitted
   because the API ignores sampling controls. Use `max_tokens`, not
@@ -43,10 +43,12 @@ Registry presence does not promise account entitlement.
   reasoning replay, and tool-loop commentary `phase`. Always-reasoning;
   minimal/low/medium/high/xhigh, with native max only on Standard 1.3. The pinned
   high-level `/think max` spelling still normalizes to xhigh, not a new global enum.
+  Omitted effort stays absent and provider-controlled rather than forcing minimal.
 - **Gemini:** Flash-Lite now enters the native thinking-level branch instead of
   the legacy thinking-budget branch. It supports MINIMAL/LOW/MEDIUM/HIGH; omission
   preserves its native minimal default. 3.8 Flash still maps minimal to LOW because
   the live API rejects MINIMAL (Family 50). No synthetic thinkingBudget is sent.
+  Deprecated/ignored temperature is omitted on 3.8 Flash and 3.5 Flash-Lite.
 - **Claude:** current Fable 5/5.1, Opus 5 and Sonnet 5 preserve native xhigh rather
   than silently downgrading it to high or promoting it to max. Low-level max remains
   distinct. Minimal maps to low. Adaptive thinking has no manual token budget.
@@ -60,7 +62,7 @@ Registry presence does not promise account entitlement.
   public thinking enum still tops out at xhigh. Transport token ceilings are not
   raised merely because the provider advertises a larger native window.
 - **Grok:** existing native effort mapping and 200K owner cap retained; live low
-  effort request accepted by `grok-4.6`.
+  and xhigh effort requests accepted by `grok-4.6`.
 
 The pinned high-level API represents `/think off` as an absent reasoning option on
 some routes. Consequently omission and explicit off cannot be distinguished there;
@@ -96,7 +98,8 @@ Subscription cost entries remain zero (subscription-billed), not API-price estim
 
 ## Evidence and sources
 
-Checked 2026-09-13; first-party direct pages unless noted. Credential-bearing API
+Baseline sources checked 2026-09-13; six-provider re-audit 2026-09-20 is in
+[the dated audit](PROVIDER-AUDIT-2026-09-20.md). First-party pages unless noted. Credential-bearing API
 requests were sent only to the relevant official host, with redirects disabled.
 
 - DeepSeek: <https://api-docs.deepseek.com/quick_start/pricing/>,

package/node_modules/@mariozechner/pi-ai/dist/providers/google.js

@@ -252,7 +252,8 @@ function createClient(model, apiKey, optionsHeaders) {
 function buildParams(model, context, options = {}) {
     const contents = convertMessages(model, context);
     const generationConfig = {};
-    if (options.temperature !== undefined) {
+    // JOHNNESS_PATCH_PROVIDER_AUDIT_77: sampling is deprecated/ignored on these models.
+    if (options.temperature !== undefined && !["gemini-3.8-flash", "gemini-3.5-flash-lite"].includes(model.id)) {
         generationConfig.temperature = options.temperature;
     }
     if (options.maxTokens !== undefined) {

package/node_modules/@mariozechner/pi-ai/dist/providers/openai-completions.js

@@ -364,7 +364,10 @@ function buildParams(model, context, options) {
         } else {
             if (effort !== undefined) {
                 params.thinking = { type: "enabled" };
-                params.reasoning_effort = ["xhigh", "max"].includes(effort) ? "max" : "high";
+                // JOHNNESS_PATCH_PROVIDER_AUDIT_77: low is native on both V4 routes (2026-09-20).
+                // Preserve the harness's existing xhigh -> max compatibility mapping.
+                params.reasoning_effort = ["minimal", "low"].includes(effort) ? "low"
+                    : ["xhigh", "max"].includes(effort) ? "max" : "high";
             }
             // Sampling controls have no effect in thinking mode; never imply they do.
             delete params.temperature;

package/node_modules/@mariozechner/pi-ai/dist/providers/openai-responses.js

@@ -176,11 +176,12 @@ function buildParams(model, context, options) {
     }
     // JOHNNESS_PATCH_MUSE_SPARK: always-reasoning, stateless encrypted replay.
     if (model.provider === "meta") {
-        const effort = options?.reasoningEffort || "minimal";
-        const allowed = ["minimal", "low", "medium", "high", "xhigh"];
+        // JOHNNESS_PATCH_PROVIDER_AUDIT_77: omission keeps Meta's model-selected effort.
+        const effort = options?.reasoningEffort;
+        const allowed = [undefined, "minimal", "low", "medium", "high", "xhigh"];
         if (model.id === "muse-spark-1.3") allowed.push("max");
         if (!allowed.includes(effort)) throw new Error("Muse Spark always reasons. Use minimal, low, medium, high or xhigh (max only on Standard 1.3); none/off is not supported.");
-        params.reasoning = { effort, summary: options?.reasoningSummary || "auto" };
+        params.reasoning = { ...(effort === undefined ? {} : { effort }), summary: options?.reasoningSummary || "auto" };
         params.include = ["reasoning.encrypted_content"];
         params.store = false;
         // Avoid inventing Meta pricing multipliers from OpenAI service tiers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "johns-harness",
-  "version": "2026.9.28",
+  "version": "2026.9.30",
   "description": "John's Harness: a production agent harness that runs autonomous coding agents as one cooperative swarm.",
   "keywords": [
     "ai-agents",

package/vendor/patched-deps/@mariozechner/pi-ai/dist/providers/google.js

@@ -252,7 +252,8 @@ function createClient(model, apiKey, optionsHeaders) {
 function buildParams(model, context, options = {}) {
     const contents = convertMessages(model, context);
     const generationConfig = {};
-    if (options.temperature !== undefined) {
+    // JOHNNESS_PATCH_PROVIDER_AUDIT_77: sampling is deprecated/ignored on these models.
+    if (options.temperature !== undefined && !["gemini-3.8-flash", "gemini-3.5-flash-lite"].includes(model.id)) {
         generationConfig.temperature = options.temperature;
     }
     if (options.maxTokens !== undefined) {

package/vendor/patched-deps/@mariozechner/pi-ai/dist/providers/openai-completions.js

@@ -364,7 +364,10 @@ function buildParams(model, context, options) {
         } else {
             if (effort !== undefined) {
                 params.thinking = { type: "enabled" };
-                params.reasoning_effort = ["xhigh", "max"].includes(effort) ? "max" : "high";
+                // JOHNNESS_PATCH_PROVIDER_AUDIT_77: low is native on both V4 routes (2026-09-20).
+                // Preserve the harness's existing xhigh -> max compatibility mapping.
+                params.reasoning_effort = ["minimal", "low"].includes(effort) ? "low"
+                    : ["xhigh", "max"].includes(effort) ? "max" : "high";
             }
             // Sampling controls have no effect in thinking mode; never imply they do.
             delete params.temperature;

package/vendor/patched-deps/@mariozechner/pi-ai/dist/providers/openai-responses.js

@@ -176,11 +176,12 @@ function buildParams(model, context, options) {
     }
     // JOHNNESS_PATCH_MUSE_SPARK: always-reasoning, stateless encrypted replay.
     if (model.provider === "meta") {
-        const effort = options?.reasoningEffort || "minimal";
-        const allowed = ["minimal", "low", "medium", "high", "xhigh"];
+        // JOHNNESS_PATCH_PROVIDER_AUDIT_77: omission keeps Meta's model-selected effort.
+        const effort = options?.reasoningEffort;
+        const allowed = [undefined, "minimal", "low", "medium", "high", "xhigh"];
         if (model.id === "muse-spark-1.3") allowed.push("max");
         if (!allowed.includes(effort)) throw new Error("Muse Spark always reasons. Use minimal, low, medium, high or xhigh (max only on Standard 1.3); none/off is not supported.");
-        params.reasoning = { effort, summary: options?.reasoningSummary || "auto" };
+        params.reasoning = { ...(effort === undefined ? {} : { effort }), summary: options?.reasoningSummary || "auto" };
         params.include = ["reasoning.encrypted_content"];
         params.store = false;
         // Avoid inventing Meta pricing multipliers from OpenAI service tiers.