stackrox · robbycochran · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
@@ -50,7 +50,7 @@ make test-suite
 ```
 
 This includes config parsing and rendering, CLI behavior, structured output,
-and v1alpha1 plan coverage. Some gateway-dependent checks are expected
+and version 1 plan coverage. Some gateway-dependent checks are expected
 to skip when no gateway is reachable.
 
 ### 3. Canonical Kind integration
@@ -62,7 +62,7 @@ and a working Docker or Podman daemon.
 CI=true CONTAINER_CLI=docker make test-kind
 ```
 
-CI mode is the credential-free, canonical v1alpha1 SDK create/exec/delete
+CI mode is the credential-free, canonical version 1 SDK create/exec/delete
 lifecycle used by pull-request CI. Substitute `podman` only when its machine is
 running. Confirm the temporary cluster is removed unless `KEEP=1` was requested.
 

@@ -23,7 +23,7 @@ reviews:
         provisioning are external platform responsibilities.
 
         Key architecture:
-        - internal/config/: strict harness.openshell.dev/v1alpha1 model
+        - internal/config/: strict version 1 flat workflow model
         - cmd/workflow_apply.go: apply orchestration and request construction
         - internal/run/: SDK-native sandbox lifecycle
         - internal/openshell/: credential-free SDK boundary
@@ -32,7 +32,7 @@ reviews:
         - Correct error handling (wrap with context, don't swallow)
         - Credential handling (never log secrets, never pass via CLI args if avoidable)
         - SDK firewall usage (credential material must not cross internal/openshell)
-        - Strict v1alpha1 parsing and flag > env > config target precedence
+        - Strict version 1 parsing and flag > env > config target precedence
         - repo clone (happens outside sandbox, git creds never enter unless needed)
     - path: "README.md"
       instructions: |
@@ -46,7 +46,7 @@ reviews:
         instructions, and upstream references are current.
     - path: "profiles/harness-*.yaml"
       instructions: |
-        Canonical workflow scaffolds. Check strict v1alpha1 schema compliance.
+        Canonical workflow scaffolds. Check strict version 1 schema compliance.
     - path: "profiles/providers/**"
       instructions: |
         OpenShell provider profile examples consumed by platform bootstrap.

@@ -47,4 +47,4 @@ jobs:
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - uses: golangci/golangci-lint-action@v8
+      - uses: golangci/golangci-lint-action@v9.3.0
@@ -62,7 +62,7 @@ jobs:
           install_only: true
 
       - name: Install helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5.0.1
 
       - name: Run kind integration
         run: make test-kind

@@ -53,17 +53,15 @@ jobs:
           ref: ${{ inputs.harness-ref }}
           path: harness
           persist-credentials: false
-      - name: Prepare default review skill
-        working-directory: harness
-        run: install -D -m 0644 examples/github-pr-reviewer/skills/pr-review/SKILL.md skills/pr-review/SKILL.md
       - name: Install caller skill
         if: inputs.skill-path != ''
         env:
           SKILL_PATH: ${{ inputs.skill-path }}
         run: |
           [[ "$SKILL_PATH" != /* && "$SKILL_PATH" != *..* ]] || exit 1
           test -f "caller/$SKILL_PATH"
-          install -D -m 0644 "caller/$SKILL_PATH" harness/skills/pr-review/SKILL.md
+          install -D -m 0644 "caller/$SKILL_PATH" harness/examples/github-pr-reviewer/skills/pr-review/SKILL.md
+          cmp -s "caller/$SKILL_PATH" harness/examples/github-pr-reviewer/skills/pr-review/SKILL.md
       - uses: actions/setup-go@v7
         with:
           go-version-file: harness/go.mod

@@ -89,10 +89,12 @@ policy format. A policy written for the harness should be byte-compatible with
 what `openshell-image-builder` generates.
 
 ### Provider abstraction
-`kind: provider` is an abstraction layer, not a thin wrapper around
-`openshell provider create`. The backend may change to gateway.toml entries
-(#1886) or K8s CRDs (#1719) as upstream settles. Implement the imperative
-CLI backend today. Do not hard-code the execution strategy.
+Workflow provider fields are reference-only. Harness verifies that
+`inference.provider` and `sandbox.providers` already exist, but never creates,
+updates, deletes, stores, or serializes provider credentials. Providers and
+their masked proxy configuration are owned by OpenShell or trusted platform
+bootstrap. Do not reintroduce a `kind: provider` document or an imperative
+provider-management backend.
 
 ### Plugin compatibility
 The binary may eventually be discoverable as an OpenShell plugin via

@@ -3,15 +3,18 @@
 ## [Unreleased]
 
 ### Changed
-- `harness apply` now accepts only strict `harness.openshell.dev/v1alpha1`
-  workflows and executes every sandbox lifecycle through the OpenShell Go SDK,
-  including uploads, policy, interactive TTY, and cleanup. Local image build
-  contexts are rejected; use a registry image reference.
-- `harness init` and `harness doctor` use the canonical workflow model. Doctor
-  verifies gateway provider registration and no longer requires local provider
-  credentials or an OpenShell executable for direct SDK/OIDC targets.
-- `apply -o yaml|json` redacts interpolated values and values in provider config
-  and sandbox environment maps.
+- `harness workflow apply` now accepts the strict version 1 workflow format and
+  executes every sandbox lifecycle through the OpenShell Go SDK, including
+  uploads, policy, interactive TTY, and cleanup. Local image build contexts are
+  rejected; use a registry image reference.
+- Workflow documents are flat (`version`, `name`, and workflow fields); the
+  Kubernetes-style `kind`, `apiVersion`, `metadata`, and `spec` envelope was
+  removed.
+- Provider references now come from `inference.provider` and
+  `sandbox.providers`; the redundant top-level `providers` list was removed.
+- Sandboxes are deleted by default; omit `sandbox.keep` for normal runs and set
+  it to `true` only when debugging a retained sandbox.
+- `apply -o yaml|json` redacts interpolated values and sandbox environment maps.
 - Cloned repos now use URL-hashed bare mirrors (`~/.cache/harness-openshell/mirrors/`)
   plus per-run, self-contained checkouts (`~/.cache/harness-openshell/checkouts/`)
   instead of the basename-keyed `repos/` cache. Distinct repositories that share a
@@ -22,8 +25,8 @@
   manually.
 
 ### Removed
-- The unused `spec.agent.model` field. Select inference models with
-  `spec.inference.model` and pass agent-specific model flags in `spec.agent.args`.
+- The unused `agent.model` field. Select inference models with
+  `inference.model` and pass agent-specific model flags in `agent.args`.
 - The unversioned agent config model, compatibility adapter, `migrate` command,
   legacy task/agent flags, CLI sandbox execution bridge, and harness-owned
   credentialed-provider bootstrap were removed in a hard cutover. Providers