agent harness v0.9.1

v0.9.1

Memory lifecycle reporting can revoke or expire a previously recalled identity after its host
deletes the text, including when prompt recall is disabled. Optional host lifecycle callbacks
carry only id, digest, kind and terminal state. Both runtimes validate complete answers atomically,
preserve concurrent proposals, refuse identity rewrites, contradictory recall and resurrection,
and retain the existing checkpoint/report shape and per-run prompt text.

Fixed API request allowance

Hosts may set TypeScript context.requestCap or Go Input.RequestCap to an integer from 1
through 20. It is captured before setup and persisted as optional checkpoint.requestCap.
An explicit cap, including 20, is fixed: extension and inconsistent resume identity refuse.
Omitting it preserves legacy defaults and bounded grants. Native invocation counts do not accept
an API cap. Delegated API children receive their cap before initialization; zero remaining
allowance cannot create a child.

Capped checkpoints require compatible readers: an older open-record reader can ignore the
member and mistake a cap of 20 for an extendable allowance. Hosts must select the newest durable
checkpoint, supply the same independently trusted cap on resume, serialize admission and account
for transport retries. A durable claim precedes handoff; this does not promise globally exactly-once
delivery. Caught or ignored invalid LimitTo calls permanently refuse the context.

Breaking input migrations

• adversarialReview (native Run.Review) is refused on presence, including false. Use critic
  / Critic with on, off or auto, or nested policy.critic.default.
• The flat budget.json policy-layer reader is retired. Move bounds under policy.budget,
  criticDefault to policy.critic.default, and criticReasoningFloor to policy.critic.reasoningFloor.
  Retired root members also refuse alongside canonical replacements.
• Bare-text memory answers, including empty text and native MemoryForFunc, are refused. Return
  closed Memory[] / use MemoryRecordsForFunc; null/nil/undefined supplies nothing.

Request-builder and checkpoint-controller source APIs also change. TypeScript request
builders read admitted values through session.values, select roles with forRole and
admitted model names with withModel; controller state reads are detached snapshots,
and updates use controller.mutate. Go request builders use the RequestSession getters
such as ModelID, Family, AgentCapability, PolicyBinding, ResolvedCapabilities,
RuntimeTools and OfferedHostTools. Go execution State() reads are detached; replace
writes through their returned values with MutateCheckpoint. These are source migrations;
these source migrations preserve wire and checkpoint member shapes; the fixed-cap option below
adds an optional checkpoint member.

Upgrade

The Go module is github.com/Judgment-Pack/judgment-pack-agent/go. The release workflow
will create go/v0.9.1 on the release commit. After publication, pin the module with
go get github.com/Judgment-Pack/judgment-pack-agent/go@v0.9.1 and commit go.sum.

Migrate all three retired inputs before upgrading. Existing hosts without a lifecycle callback
remain compatible once those inputs are migrated. To report forgotten memory across resume,
implement optional memoryLifecycle / MemoryLifecycleFunc using retained canonical metadata;
do not retain deleted prose or modify checkpoint rows.

Dependency updates

The direct Zod pin and repository lock move from 4.4.3 to 4.6.7 for
GHSA-mrhx-c7xc-m3w5 (#176). Artifact integrity
and provenance, bounded regressions and packed consumers passed focused checks. The correction
covers leading declared collection-size bounds, not arbitrary unconstrained validation. See the
Zod assessment and consumer refresh evidence.

The repository lock resolves body-parser 2.4.0 through the existing MCP SDK/Express dependency
path for GHSA-27r3-jxmh-p828 (#178). This updates
the transitive lock selection without adding a direct dependency or override. Actual artifact
integrity, compressed-body completion/error lifecycle and affected SDK consumers were checked;
see the body-parser assessment.

The Undici lock selections move to compatible fixed 7.30.1 (provider-utils runtime) and 8.12.2
(jsdom development) for GHSA-4qv8-2p9j-2685 and
GHSA-f72v-6w45-q472 (#185). This also corrects the
prior incompatible 8.x resolution of provider-utils' 7.x requirement. Artifact/source verification,
bounded EventSource/SRI regressions and affected consumers were checked; see the
Undici assessment. No direct dependency or override is added.

The Go build/CI toolchain moves to 1.26.10, and the root Go module selects jsonparser 1.1.2 and
x/sys 0.47.0 with matching dependency allow-list pins (#188). The public go 1.25.0 minimum is
retained. Compatible graph-only x/mod 0.40.0, x/text 0.41.0 and yaml.v2 2.2.8 selections
address their recorded advisories. Compatible x/crypto 0.55.0 and x/net 0.58.0 selections reduce
the remaining graph findings while retaining Go 1.25.0; they select x/sys 0.47.0. Official artifact
checks and a malformed-JSON regression cover this bounded update;
Windows-only runtime behavior was not executed on Linux. Broader Go graph dispositions remain
open, and this update does not establish a clean release audit. See the
Go assessment and remaining decision.

Existing-lock consumers retained affected shared SDK/engine dependencies after the harness
upgrade. Explicit consumer refreshes resolved the tested paths; inspect and audit the consuming
application's graph rather than assuming a library pin or repository lock repairs it. The
implementing pull request records current live-audit, complete-checklist, CI and review results.
#161 remains undated upstream
follow-up outside v0.9.1.