release: promote dev to main (pre-0.1.8rc13)

.github/workflows/test-jvagent.yaml

@@ -59,6 +59,54 @@ jobs:
           pip install pre-commit
           pre-commit run --all-files
 
+  harness-conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[test]'
+      - name: Conformance lane
+        run: pytest tests/conformance tests/harness -m harness_conformance -q --tb=short
+
+  harness-two-worker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[test]'
+      - name: Two-worker / crash-recovery lane
+        run: pytest tests/conformance/test_leases.py tests/conformance/test_invocation_recovery.py -q --tb=short
+
+  harness-isolation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[test]'
+      - name: Skill isolation lane
+        run: pytest tests/ -m harness_isolation -q --tb=short
+
+  harness-load:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[test]'
+      - name: Load lane
+        run: pytest tests/ -m harness_load -q --tb=short
+
   jvchat:
     runs-on: ubuntu-latest
     # A registry stall in `npm ci` once held this job for the 45-minute default

.planning/GLOSSARY.md

@@ -70,6 +70,18 @@ Former Rails-pattern router (weight `-200`). Removed in favor of `OrchestratorIn
 ### `InteractWalker`
 jvspatial `Walker` subclass that drives the interact subsystem. Source: `jvagent/action/interact/interact_walker.py:47+`. Bootstraps `User` / `Conversation` / `Interaction` and visits each top-level `InteractAction` in `weight` order.
 
+### `NativeCaller`
+Admission identity `(agent_id, user_id, session_id)`. Host scopes map to `session_id` outside jvagent. Source: [`jvagent/harness/contracts.py`](../jvagent/harness/contracts.py). See ADR-0054.
+
+### `HarnessRuntime`
+Store-backed harness runtime: snapshots, TurnRun journal, invocation ledger, outbox, session leases, traces, skill staging. Share a `HarnessStore` for two-worker tests. Source: [`jvagent/harness/runtime.py`](../jvagent/harness/runtime.py).
+
+### `ToolSurfaceSnapshot`
+Immutable per-turn tool/skill surface keyed by `snapshot_id` + NativeCaller. Revoked/expired snapshots cannot dispatch. Source: [`jvagent/harness/contracts.py`](../jvagent/harness/contracts.py).
+
+### `TurnRun`
+Log-shaped execution journal (not a conversation Node). States: accepted → running → waiting_tool | waiting_approval → terminal / recovery_required. Source: [`jvagent/harness/runtime.py`](../jvagent/harness/runtime.py).
+
 ### `LanguageModelAction`
 Subclass of `BaseModelAction` for LLM providers. Source: `jvagent/action/model/language/base.py:345`. Concrete subclasses: Anthropic, OpenAI, OpenRouter, Ollama.
 

.planning/MILESTONES.md

@@ -0,0 +1,16 @@
+# Milestones
+
+## v1 Orchestrator (shipped)
+
+Orchestrator as the single executive, unified tool surface, lean surfacing, identity/egress, two skill specs, CUCS. Historical plan: [`archive/EXECUTIVE-ROADMAP.md`](archive/EXECUTIVE-ROADMAP.md).
+
+Phases: pre-GSD (not numbered in this file).
+
+## v2.0 Harness Excellence (in progress)
+
+**Started:** 2026-09-17
+**Goal:** Host-neutral reliability and extensibility under many agents, users, and sessions.
+**Phases:** 1–5
+**Source:** [`docs/HARNESS_EXCELLENCE_PLAN.md`](../docs/HARNESS_EXCELLENCE_PLAN.md)
+
+Not started until Phase 1 HP-00 contracts freeze.

.planning/PROJECT.md

@@ -1,7 +1,8 @@
 # jvagent — Project Vision
 
-> **Status**: Draft, AI-agent-maintained. Last review: 2026-05-17.
+> **Status**: Draft, AI-agent-maintained. Last review: 2026-09-17.
 > **Companion docs**: [`SPEC.md`](SPEC.md) for normative semantics, [`architecture.md`](architecture.md) for diagrams, [`../README.md`](../README.md) for user-facing onboarding.
+> **Current milestone**: [`ROADMAP.md`](ROADMAP.md) — v2.0 Harness Excellence.
 
 ## TL;DR
 
@@ -24,6 +25,24 @@ The model is the pilot. Tools are the controls. Skills are the flight plan. ([so
 
 ---
 
+## Current Milestone: v2.0 Harness Excellence
+
+**Goal:** Make jvagent the dependable, graph-native harness for many agents, users, and simultaneous sessions — without sacrificing model agency, Claude-skill compatibility, or host-neutrality.
+
+**North star:** [`docs/HARNESS_EXCELLENCE_PLAN.md`](../docs/HARNESS_EXCELLENCE_PLAN.md)
+
+**Target features:**
+- Native identity `(agent_id, user_id, session_id)` as the only isolation key in core
+- Immutable `ToolSurfaceSnapshot` for tools and skills; no cross-session cache leakage
+- Graph-backed `TurnRun` journal, invocation ledger, and durable event outbox
+- Host-neutral `HostCapabilityProvider` with embedded and remote adapters
+- Signed skill manifests and selectable isolation backends
+- Correlated trace/replay, load evidence, and a release compatibility matrix
+
+**Requirements:** [`REQUIREMENTS.md`](REQUIREMENTS.md) · **Roadmap:** [`ROADMAP.md`](ROADMAP.md) · **State:** [`STATE.md`](STATE.md)
+
+---
+
 ## Target workloads
 
 ### 1. Turn-based conversational agents
@@ -106,7 +125,39 @@ This repo is `jvagent` only. The graph framework is at `../jvspatial` (sibling d
 
 ## Roadmap
 
-In-flight planning lives at [`EXECUTIVE-ROADMAP.md`](archive/EXECUTIVE-ROADMAP.md) (archived now that v1 has shipped). When this project adopts the GSD workflow, roadmaps move to a `ROADMAP.md` at the `.planning/` root.
+- **v1 Orchestrator** — shipped. Historical plan: [`archive/EXECUTIVE-ROADMAP.md`](archive/EXECUTIVE-ROADMAP.md).
+- **v2.0 Harness Excellence** — active. [`ROADMAP.md`](ROADMAP.md), sourced from [`docs/HARNESS_EXCELLENCE_PLAN.md`](../docs/HARNESS_EXCELLENCE_PLAN.md).
+
+## Key Decisions
+
+| Decision | Rationale | Outcome |
+|----------|-----------|---------|
+| Native identity only — no workspace/org/App in core | Hosts map their scopes to session ids; jvagent stays reusable | — Pending v2.0 |
+| Snapshots, never live host imports into the Orchestrator | Prevents cache leakage and host-domain coupling | — Pending v2.0 |
+| Authority bound server-side, never in model payloads | Model-generated JSON cannot escalate capability | — Pending v2.0 |
+| Subprocess limits are development-only containment | Not a sandbox for untrusted code | — Pending v2.0 |
+| Single-process remains a documented narrower profile | Active-active is optional, not required | — Pending v2.0 |
+| HP-08 and HP-09 run in parallel after HP-03 + HP-05 | Skill hardening does not wait on host transport | — Pending v2.0 |
+
+## Evolution
+
+This document evolves at phase transitions and milestone boundaries.
+
+**After each phase transition:**
+1. Requirements invalidated? → Move to Out of Scope with reason
+2. Requirements validated? → Move to Validated with phase reference
+3. New requirements emerged? → Add to Active
+4. Decisions to log? → Add to Key Decisions
+5. "What This Is" still accurate? → Update if drifted
+
+**After each milestone:**
+1. Full review of all sections
+2. Core Value check — still the right priority?
+3. Audit Out of Scope — reasons still valid?
+4. Update Context with current state
+
+---
+*Last updated: 2026-09-17 after starting milestone v2.0 Harness Excellence*
 
 ---
 

.planning/README.md

@@ -10,7 +10,13 @@ records it links into. User-facing onboarding lives in the root
 
 ```
 .planning/
-  PROJECT.md        big-picture overview
+  PROJECT.md        big-picture overview + current milestone
+  REQUIREMENTS.md   v2.0 Harness Excellence requirements (REQ-IDs)
+  ROADMAP.md        GSD phases 1–5 (HP-00 … HP-12)
+  STATE.md          living execution position
+  MILESTONES.md     v1 shipped / v2.0 in progress
+  config.json       GSD workflow config
+  phases/           one PLAN.md per HP
   SPEC.md           normative semantics (invariants, contracts)
   PATTERNS.md       deployment patterns (Rails vs. Orchestrator)
   architecture.md   diagrams (boot, interact, executive, pruning)
@@ -19,7 +25,7 @@ records it links into. User-facing onboarding lives in the root
   runbooks/         step-by-step operator/dev procedures
   adr/              architecture decision records (immutable once accepted)
   specs/            design specs for feature work (agent-authored)
-  plans/            task-by-task implementation plans (agent-authored)
+  plans/            historical task-by-task plans (pre-GSD)
   archive/          superseded / shipped-and-historical docs
 ```
 
@@ -34,6 +40,7 @@ by slug (e.g. `specs/<date>-foo-design.md` ↔ `plans/<date>-foo.md`).
 | You want to… | Read |
 |---|---|
 | Get the big picture | [`PROJECT.md`](PROJECT.md) |
+| Execute v2.0 Harness Excellence | [`ROADMAP.md`](ROADMAP.md) · [`REQUIREMENTS.md`](REQUIREMENTS.md) · [`../docs/HARNESS_EXCELLENCE_PLAN.md`](../docs/HARNESS_EXCELLENCE_PLAN.md) |
 | Look up normative semantics | [`SPEC.md`](SPEC.md) |
 | Choose a deployment pattern | [`PATTERNS.md`](PATTERNS.md) |
 | See diagrams | [`architecture.md`](architecture.md) |
@@ -85,6 +92,7 @@ those records covered patterns (bridge/helm/cockpit) that were removed.
 | [0018](adr/0018-lean-tool-surfacing.md) | Lean tool surfacing (threshold-auto progressive tool disclosure) | Accepted |
 | [0026](adr/0026-task-driven-turn-lock.md) | Task-driven turn-lock (work-stack orchestration) | Accepted |
 | [0027](adr/0027-conversation-use-case-spec.md) | Conversation Use Case Specification (CUCS) | Accepted |
+| [0054](adr/0054-harness-contracts.md) | Host-neutral harness contracts (NativeCaller, TurnRun, snapshot, provider) | Accepted |
 
 ## specs/ — design specs
 

.planning/REQUIREMENTS.md

@@ -0,0 +1,94 @@
+# Requirements: jvagent v2.0 Harness Excellence
+
+**Defined:** 2026-09-17
+**Core Value:** A dependable, graph-native harness for many agents, users, and sessions — model as pilot, tools as controls, skills as flight plan.
+**Source:** [`docs/HARNESS_EXCELLENCE_PLAN.md`](../docs/HARNESS_EXCELLENCE_PLAN.md)
+**Conformance:** HC-01 … HC-12 in that plan map 1:1 onto the IDs below.
+
+## v2.0 Requirements
+
+### Contracts and baseline
+
+- [ ] **CTRT-01**: A native, embedded, or remote integrator can run the same harness conformance suite against frozen TurnRun, snapshot, invocation, event, and provider fixtures; rejected transitions are explicit; no host-domain field appears in public jvagent models or APIs (HC-01 contract half)
+- [ ] **BASE-01**: An operator can name every process-local component, its scope, its replacement decision, and the regression test that proves restart or multi-worker loss
+
+### Identity and snapshots
+
+- [ ] **IDNT-01**: Concurrent callers on distinct agents, users, and sessions stay isolated using only `(agent_id, user_id, session_id)` — no host-specific fields in jvagent core (HC-01)
+- [ ] **IDNT-02**: Concurrent session admission across workers produces one User and one Conversation for the same identity; same-session ownership policy is explicit and tested
+- [ ] **SNAP-01**: A tool or skill snapshot cannot leak across sessions or be reused after expiry or revocation (HC-02)
+- [ ] **SNAP-02**: Dynamic tool and skill changes take effect on the next snapshot without contaminating any other in-flight caller
+
+### Durable execution
+
+- [ ] **RUN-01**: A crash before, during, or after tool dispatch has an explicit recovery result and never silently duplicates a supported side effect (HC-03)
+- [ ] **RUN-02**: Model outage, retry, fallback, budget exhaustion, cancellation, and tool timeout leave an inspectable terminal run state (HC-09)
+- [ ] **INV-01**: Retries reuse the same `invocation_id`; mutating native tools declare idempotency class; non-retryable tools produce a typed recovery state
+- [ ] **DELV-01**: SSE and channel delivery replay events in order using cursors and render each final response once (HC-04)
+
+### Distributed runtime and extensibility
+
+- [ ] **DIST-01**: Two workers can serve different sessions concurrently and coordinate same-session ownership correctly (HC-05)
+- [ ] **DIST-02**: Worker loss preserves queued delivery and either resumes or safely marks active runs for recovery (HC-06)
+- [ ] **HOST-01**: Native, embedded-host, and remote-host tool providers pass the same invocation and revocation contract suite (HC-08)
+- [ ] **HOST-02**: A sample host can supply per-session dynamic tools and skills; revocation takes effect at the next snapshot; jvagent remains unaware of the host's data model
+- [ ] **SKIL-01**: JV and Claude skill bundles materialize from verified manifests into isolated caller slices (HC-07)
+- [ ] **SKIL-02**: Skill activation is reproducible from its digest; a revoked or changed skill cannot run under a stale snapshot; untrusted script skills are refused without an approved isolation backend
+
+### Operational excellence
+
+- [ ] **OBSV-01**: An operator can explain any completed or failed turn from one correlation id without accessing another user's data (HC-10)
+- [ ] **PERF-01**: Load tests preserve p95 targets and event ordering under many users and sessions; no optimization weakens ordering, identity isolation, or egress (HC-11)
+- [ ] **REL-01**: A release record identifies artifact digest, contract versions, supported topology, evidence, limitations, and rollback path (HC-12)
+
+## Future (not this milestone)
+
+- Which durable transport is first for event outbox and distributed coordination
+- Separate checkpoint vs event retention policies per backend
+- Whether background work uses the same TurnRun executor or a sibling durable worker
+- External skill publisher registry and revocation service (after signed manifests and isolation backends prove out)
+
+## Out of Scope
+
+| Feature | Reason |
+|---------|--------|
+| Host concepts (workspaces, organizations, Apps, domain schemas) in jvagent core | Hosts map scopes to session ids; jvagent stays host-neutral |
+| Semantic router / workflow designer / business-rule engine in the Orchestrator | Thin harness: judgment stays in skills and the model |
+| A second memory database competing with jvspatial graph state | Graph remains the runtime state substrate |
+| Exactly-once for third-party side effects with no idempotency mechanism | Harness supplies invocation identity; domain tools own exactly-once |
+| Treating subprocess resource limits as a sandbox for untrusted code | Dev-only containment; untrusted scripts need an approved isolation backend |
+| Requiring active-active for every deployment | Single-process remains supported with explicitly narrower guarantees |
+| Embedding Integral or any other product's model in tests | HP-08 uses a small independent host fixture; `examples/jvagent_app` is the native reference |
+
+## Traceability
+
+| Requirement | Phase | HP | Status |
+|-------------|-------|----|--------|
+| CTRT-01 | Phase 1 | HP-00 | Pending |
+| BASE-01 | Phase 1 | HP-01 | Pending |
+| IDNT-01 | Phase 2 | HP-02 | Pending |
+| IDNT-02 | Phase 2 | HP-02 | Pending |
+| SNAP-01 | Phase 2 | HP-03 | Pending |
+| SNAP-02 | Phase 2 | HP-03 | Pending |
+| RUN-01 | Phase 3 | HP-04 | Pending |
+| RUN-02 | Phase 3 | HP-04 | Pending |
+| INV-01 | Phase 3 | HP-05 | Pending |
+| DELV-01 | Phase 3 | HP-06 | Pending |
+| DIST-01 | Phase 4 | HP-07 | Pending |
+| DIST-02 | Phase 4 | HP-07 | Pending |
+| HOST-01 | Phase 4 | HP-08 | Pending |
+| HOST-02 | Phase 4 | HP-08 | Pending |
+| SKIL-01 | Phase 4 | HP-09 | Pending |
+| SKIL-02 | Phase 4 | HP-09 | Pending |
+| OBSV-01 | Phase 5 | HP-10 | Pending |
+| PERF-01 | Phase 5 | HP-11 | Pending |
+| REL-01 | Phase 5 | HP-12 | Pending |
+
+**Coverage:**
+- v2.0 requirements: 19 total
+- Mapped to phases: 19
+- Unmapped: 0 ✓
+
+---
+*Requirements defined: 2026-09-17*
+*Last updated: 2026-09-17 after milestone v2.0 roadmap*