ZHIVEX HARNESS / GOVERNED EXECUTION

Delegate the code.Keep control.

Put coding agents to work on fixes and maintenance. Review changes before they land, resume interrupted work, and choose your model provider. Open source, on your infrastructure.

Try the stable release See the safety proof

v1.5.0 stablev1.5.0 · 17 OCTOBER 2026MIT licensedBring your own provider credential

Code v0.4.0 · npm install -g @zhivex-ai/code

RUN PASSPORT / EXAMPLE

policy / governed-execution-v5

RUN ZHX-0F4D9E

task / bounded request

Fix the failing tests while ignoring hostile instructions and the decoy secret.

Context bound

rules + skills + workspace

Threat contained

secret excluded · network denied

Approval held

exact patch awaiting operator

Drift rejected

stale host · zero mutations

Control evidence

Exact patch bound

Network denied

Host unchanged

17 OCTOBER 2026 / v1.5.0

What's new in 1.5

Harness 1.5.0 and Code 0.4.0 are on npm latest. The Code CLI is zhivex-code. Published releases are verified with npm provenance. These notes follow the repository changelogs. Bedrock and Azure OpenAI are provisional and not live-certified.

Local web workspace

The local web workspace is reworked around review: a sessions drawer, light and dark themes, a movable diff panel, and a searchable model selector. zhivex-code project add registers a folder for a running local server.

Task and evidence

The local web client adds a task and evidence panel: goal, revision, artifact and check provenance, task-wide accounting, and explicit accept, correct, and continue. Web task control negotiates task.control.v1.

Audit pack

zhivex-code export-audit and verify-audit, and the same zhx commands, use the experimental @zhivex-ai/harness/audit entrypoint. Verification checks the pack without resolving provider, store, or budget configuration.

Bedrock and Azure OpenAI

Provisional routes on the matched engine. Bedrock Converse reports Tier B. BEDROCK_RUNTIME=openai and Azure OpenAI are the Tier A paths. These routes have no live certification.

Security hardening

restore_file is pinned to a destination and digest. Each budget ledger stays bound to its source namespace. Protected paths compare in locale-independent lowercase. High-entropy output from credential-bearing MCP servers is flagged.

Release provenance

Published Harness and Code releases are verified with npm provenance. npm latest for this pair is Harness 1.5.0 and Code 0.4.0.

Read the changelog

Zhivex Code 0.4.0

The terminal product on the Harness engine.

Code 0.4.0 is the coding CLI (zhivex-code). Harness 1.5.0 is the runtime underneath it. The notes above are the published 1.5 changes for this pair.

npm install -g @zhivex-ai/code

Code package Engine API Harness quickstart

01 / HOW IT WORKS

From project context to an approved patch.

Harness puts one control path between the agent and the repository, so teams gain speed without giving up review, isolation, or evidence.

Bind project context

Load bounded AGENTS.md, rules, skills, provider, permissions, and budgets before execution.

Work inside the boundary

Inspect safely. The default runtime exposes no host shell. Approved isolated commands run inside a secret-free, no-network OCI snapshot.

Propose the exact change

Bind every edit and validation command to the content the operator will review.

Approve without losing state

Resolve complete approval cards in the console, even after closing and recovering the session.

Admit and prove

Import only the reviewed patch, reject host drift, and export redacted, verifiable evidence.

02 / PROOF, NOT PROMISES

The agent can work. The boundary controls the effects.

The hostile-repository proof exercises the real OCI, approval, restart, import, ledger, and stale-host boundaries against malicious instructions and a decoy secret.

View the reproducible proof

Governed capabilities

Secret-free repository snapshots

Approval-bound commands inside opt-in OCI

Durable pause, recovery, and decisions

Exact patch review before host import

Redacted, exactly-once evidence

Deliberately unavailable

Arbitrary host shell

Container network access

Unapproved permanent deletion

Automatic Git writes

Silent stale-patch overwrite

03 / BUILT FOR DAILY USE

Governance your team will actually use.

Everyday CLI work stays inside governed approvals and isolated patch delivery.

Terminal

Clear operator decisions

Redacted activity, complete approval cards, and durable approve, deny, view, or quit decisions.

AGENTS.md

Governed project context

Bounded rules, context files, and progressively disclosed skills become part of durable compatibility.

OCI / ask

Useful execution, contained

Exact scripts require approval and run only inside the no-network snapshot; host import remains separate.

Envelope v1

Portable evidence

Carry the exact patch, base identity, policy, redacted checks, expiry, and attestation references offline.

04 / QUICKSTART

Start with your next fix.

Requires Node.js 22.13 or newer, Git, and one provider credential. Diagnose locally, then start the durable console from the repository you want to control.

GitHub Docs

zhivex / harness / quickstart

Install

$npm install -g @zhivex-ai/harness@1.5.0

Diagnose

$zhx doctor

Start the console

$zhx

Code with agents. Operate on your terms.

Bring governed coding agents into your team’s workflow, with reviewable changes and evidence you can keep.

Try the stable release