Typed pre-spawn health checks for harnesses: spec lint, provider-credential matrix, channel boot-gate env refs, MCP secret-ref dry-run, port availability, bundle freshness, and durability warnings

The Hangar manager's local HTTP server: token-gated loopback API over the machine-wide harness registry — fleet rows with cached rollups, per-harness detail/spec/preflight/sessions/evals/memory/cost views, registry CRUD, and the M2 driver surface (supervi

Typed error hierarchy shared across factory layers

The harness process layer: runfiles + adoption, per-shape spawn contracts, exit classification and restart policy, durable log capture with a TraceEvent pump, port ledger, and the mutating-job queue

Structured logger shared across factory layers

Machine-wide harness registry (harnesses.json v2) — stable hrn_ ids, groups/tags/pins, scan roots, missing-dir stamping, and watchme registry interop behind the harness manager

Per-tenant storage rebase + cross-tenant guard for the managed-daemon target

The Hangar web console's static UI — zero-build, dependency-free browser ES modules embedded as text assets for the single-binary CLI to hand to the hangar server

Managed-as-a-service composite recipe: target-managed + helm-chart Kustomize overlay + Terraform module for GKE/EKS/AKS provisioning (Section 32)

Canonical typed intermediate representation

Embedding provider — openai/voyage/cohere/local/mock backends with prefix-grammar selector

Per-run identity, abort signal, and logger threaded through the runtime

Compiler core: parse → validate → lower → emit

User-facing spec schema (Zod) + YAML parser

buildTool() factory with fail-closed safety defaults

Containerised exec environment with docker/podman/noop backends; production safety floor

Common low-level helpers shared across factory (string, args, exhaustiveness)

Token estimation heuristic + running budget tracker

Pillar-3 chokepoint — classify content crossing every trust boundary (MCP / sub-agent / channel / federation / skill / compaction / tool) with origin metadata and a content-hash LRU cache

ToolDefinition interface, RegisteredTool, and ToolCatalog registry