Token Harness 0.1.28 — Startup, Windows hooks and optimizer guidance

Token Harness 0.1.28 — Startup, Windows hooks and optimizer guidance

0.1.28 keeps automatic update checks from blocking dashboard actions, repairs reviewed Windows
hook paths, exposes read-only efficiency decisions and explains optimizer projects and benchmarks.

Installation

npm install --global token-harness@0.1.28
token-harness --version
token-harness

The version must be 0.1.28. These commands also work in PowerShell. Restart an already running
dashboard to load the updated interface.

What changed

• Startup update checks are passive and coalesced. They preserve existing approval tickets and
  discard results collected across a concurrent operation. Reviewing an update still creates an
  exact-version approval before installation.
• Native routing admits the reviewed Codex 0.146.0 hook format. Codex hook trust remains an explicit
  native step; setup alone does not establish callback execution.
• On Windows, setup can transactionally repair a missing or non-file standard HarnessTrim hook
  executable. Custom commands stay under manual review. RTK's Codex launcher pins observed paths
  and records to the agent's own database while preserving native command arguments.
• optimize exposes advisory efficiency decisions with source-tagged evidence and exact-policy
  capacity receipt references. Unavailable attempt and allowance budgets remain unknown.
• handoff accepts repeatable --acceptance and --fact fields. Review caught and fixed a minimum
  byte-budget regression: omission markers now compact before they can displace the mandatory
  objective and next action. Per-section omission counts remain available in JSON.
• Setup links each optimizer's source project and explains useful workloads, mechanisms and
  limitations. Project-reported benchmark figures retain their scope and methodology and stay
  separate from local measured results. The catalog remains available without a detected agent.
• Routing explanations cover suitable delegation, the main agent's responsibility, native trust
  and paired quality gates. Responsive disclosures support keyboard use and survive refresh.
• RFC 0009 reconciles historical compatibility recordings with the shipped live-assignability
  gates. No runtime guard or measurement gate is relaxed.

Verification scope

Local integration verification passed 2,395 tests with nine expected skips. Regression tests cover
mandatory checkpoint state and valid Unicode at the 256-byte minimum, update-check concurrency,
approval preservation and the reviewed hook repairs. The Windows launcher fixture exercises a PATH
containing Node alone and paths with shell-sensitive characters. UI interaction coverage checks
project links, claim isolation, the catalog without agents and disclosure persistence.

Publication requires the combined release candidate's Windows, macOS and Linux CI, exact-tag build,
guided real-runtime smoke, package installation checks, provenance/SBOM attestations, npm Trusted
Publishing and npm-latest verification.

The Windows audit and
six-pair pilot retain their pre-release scope, including
failed Codex workspace-write RTK commands, negative token/latency outcomes and excluded shared-account
quota. Package checks do not establish new runtime callbacks, marginal routing savings, successful
sandbox activation or broad promotion readiness. Issues #255, #359 and #360 retain their evidence gates.