What is qualified

• claude-code-cli-macos: qualified — runtime claude-code, provider anthropic
• claude-code-vscode-macos: unqualified — runtime claude-code, provider anthropic
• claude-code-cli-linux: qualified — runtime claude-code, provider anthropic
• claude-code-plugin-marketplace: unqualified — runtime claude-code, provider anthropic
• codex-cli-macos: unqualified — runtime codex, provider openai
• codex-vscode-macos: unqualified — runtime codex, provider openai
• codex-desktop-macos: unqualified — runtime codex, provider openai
• codex-cli-linux: unqualified — runtime codex, provider openai
• cursor: planned — runtime cursor, provider multiple
• grok: planned — runtime undecided, provider xai

Claude Code Auto Mode depends on native runtime and provider access; model unavailability is a visible limitation, not a passing qualification result.

Direct native Codex role defaults can inherit parent permissions; constrained harness roles use isolated CLI workers instead.

Planner publication is mediated by the harness after constrained workers return result data.

The architecture-viewer integration is a preview for a separately installed implementation. A local protocol 1 candidate passed process-level harness acceptance; no viewer is bundled, and native viewer interaction and distribution/license clearance remain unverified.

The usage feed is a Claude Code capability: Codex raises none of UserPromptSubmit, SubagentStart or SubagentStop, so turn spend, the fresh-session nudge, in-flight width and finished-subagent spend are not fed back there and no such event is registered.

Cursor and Grok integration, hosted agents and native memory merging are planned or deferred.

BMad review confinement is requested in the routed layer text rather than enforced at the spawn hook: a client can run a review layer as an unnamed native subagent, unconfined, and still report a result. Observed on Claude Code; a confined run writes isolated-worker state. Tracked in #291.

On Codex, output-filter rewrites are never applied: a rewrite travels only with an allow, and the filtered commands are not auto-allowed. Tracked in #292.

Under Codex auto permissions an isolated role worker launched from inside a sandboxed turn has no network access and stalls until its deadline; it completes under an acknowledged bypass. Tracked in #293.

harness sync links user-level stance selections only; a HARNESS_STANCE_ variable or a project selection changes what harness stances and the hooks resolve, not the linked stance text, and harness diff does not report it as drift. From 0.14.0 the session-start hook injects a differing selected variant's text, within the always-loaded budget (#276); the sync scope is by design (#294).

The 0.11.1 spawn guards refuse a constrained role's brief re-issued verbatim under another name, or carrying a `harness-role:` line; a client that paraphrases the brief and names no role is not caught, so BMad review confinement still depends on the client following the routed instructions. Tracked in #291 and #300.

No third-party framework's own workflow is exercised natively in a release qualification round. Framework layering is qualified through a synthetic recipe driven at the spawn hook; that a given framework's workflow completes on a given client is not claimed by a release. The BMad Method integration is exercised by an optional suite whose last result is recorded separately, at the harness version, framework version and client stated there.

Constrained-role confinement is enforced at the spawn hook only for a framework a declared descriptor covers. From 0.13.0 the hook classifies a spawn against the descriptors in policy/integrations/, so a covered recipe layer is refused whatever the client named it, and the two entries above describe 0.11.1 through 0.12.0 and stop applying at that release. What remains: recognition needs one of the framework's own layer names as the spawn type, or two sentences of its prompt text, or one of those sentences beside a path out of its routed text, or a sentence directing the subagent to follow or apply one of those paths, so a brief with none of that, or a framework or a release no descriptor covers, still runs as an unnamed native subagent, unconfined, and can still report a result. Observed on the Claude Code CLI on Linux, where one confined run required five attempts; a confined run writes isolated-worker state. Tracked in #291.

Codex CLI is not in the 0.13.0 or 0.13.1 stable contract: FR-12 admits it only once a scripted qualification round agrees with a hand-driven one, and the acceptance runner cannot drive Codex until #612; codex-cli-macos carries hand evidence only (#700).

gate-invalidation, in the 0.13.0, 0.13.1 and 0.14.0 qualifications of both Claude Code CLI targets, delivered its Stop events to the harness coordinator directly, not through client turns: no client turn ran the trusted gate's pass, reuse, rerun or block-then-release loop. The only Stop event observed from a client turn is hook-composition's untrusted skip.

No Codex client ran in the 0.13.0, 0.13.1 or 0.14.0 qualifications of the two Claude Code CLI targets. The Claude to Codex continuation was not observed, because a Claude session read a Claude save, and the Codex to Claude record was written by `harness task save --runtime codex`; step 7's re-established permissions were observed in neither direction. The Codex targets are not required for this release, so no round covers these.

The v0.14.0 release qualifies the two required Claude Code CLI targets from complete scripted records. The owner explicitly approved shipping without the independent hand comparisons owed by #741 because the available Claude subscription could not support that additional round; the records therefore make scripted claims only. permission-controls retains its 0.13.0 hand comparison, while the other eleven cases on macOS and the three agreed Linux gap cases remain hand-unconfirmed and move to v0.15.0.

The v0.14.1 release reran all twelve scripted cases on both required Claude Code CLI targets at the frozen source. It retains v0.14.0's narrower scripted-only claim: #741's independent hand comparisons remain scheduled for v0.15.0 and are not claimed here.

The v0.14.2 release reran all twelve scripted cases on both required Claude Code CLI targets at the frozen source. It retains v0.14.0's narrower scripted-only claim: #741's independent hand comparisons remain scheduled for v0.15.0 and are not claimed here.

In the 0.14.0 role-confinement case, confinement was evidenced by the isolated worker's init event exposing only Read, Grep and Glob, by the absence of a write-tool call, and by checking that no requested probe file landed. The case did not independently attempt a filesystem or shell escape outside that exposed tool surface.

In the 0.13.0 and 0.13.1 qualifications a band worker's effort was read from the installed worker definition, not from the subagent's transcript; its model, the budget sentence in its brief, the usage feed and the usage row were observed from the run.

With a token-only login (`CLAUDE_CODE_OAUTH_TOKEN`, as in CI and containers, including the Linux target image), an isolated role worker that a Claude Code session launches cannot authenticate: the client strips the token from its tool subprocesses, and the worker reports that it is not logged in. A client whose confined layers cannot run may then do their work in its own context, unconfined, as the 0.13.0 BMad integration suite observed. Qualification rounds launch their workers from the runner rather than from a client session, so they do not exercise this path. Tracked in #759.

In the 0.13.0 and 0.13.1 qualifications cost-posture compared each role the cost variant does not change by its content, byte for byte, rather than by its link, so a role replaced by an identical copy would also pass; step 8 asks that every other role keeps its link. Tracked in #742.

The v0.15.0 release reran all twelve scripted cases on both required Claude Code CLI targets at the frozen source. It retains v0.14.0's narrower scripted-only claim: #741's independent hand comparisons were moved to v0.16.0 and are not claimed here. On Linux the first full run recorded stance-switch as unverified: the delegation and voice links moved as required, but the client answered the voice comparison prompt with a table under both variants, so the replies could not tell them apart. A second full run at the same source passed all twelve cases and is the linked evidence.

Qualified means native acceptance evidence for the exact release and client. Unqualified means evidence is incomplete. Planned means an integration is still to come.

Native permissions take precedence. A custom stance is a harness policy primitive, not a promise of identical model behavior.