diff --git a/.codex/environments/environment.toml b/.codex/environments/environment.toml
index 4cc62ad..98f94d1 100644
--- a/.codex/environments/environment.toml
+++ b/.codex/environments/environment.toml
@@ -1,182 +1,629 @@
 # THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
 version = 1
-name = "rsearch local environment"
+name = "harness local environment"
 
 [setup]
 script = '''
 set -euo pipefail
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-printf '%s\n' "[codex] setup: $REPO_ROOT"
-
-init_env_paths() {
-export PATH="/opt/homebrew/bin:/usr/local/bin:$HOME/.local/share/mise/shims:$HOME/.local/bin:$PATH"
+for candidate in "$HOME/.local/share/mise/shims" "$HOME/.local/bin" "/opt/homebrew/bin" "/opt/homebrew/sbin" "/usr/local/bin" "/usr/sbin" "/sbin"; do
+  if [[ -d "$candidate" && ":$PATH:" != *":$candidate:"* ]]; then
+    PATH="$candidate:$PATH"
+  fi
+done
+export PATH
 
 if command -v mise >/dev/null 2>&1; then
-  eval "$(mise activate bash)" >/dev/null 2>&1 || true
+  mise trust --yes .mise.toml || true
+  mise install
 fi
-}
-
-init_env_paths
-
-missing_tools=0
-
-require_tool() {
-  local cmd="$1"
-  local hint="$2"
-  if ! command -v "$cmd" >/dev/null 2>&1; then
-    echo "[codex] missing required tool: ${cmd} (${hint})"
-    missing_tools=1
-  fi
-}
-
-require_tool git "install Git and ensure it is on PATH"
-require_tool rg "install ripgrep (rg)"
-require_tool jq "install jq"
-if ! command -v fd >/dev/null 2>&1 && ! command -v fdfind >/dev/null 2>&1; then
-  echo "[codex] missing required tool: fd (or fdfind)"
-  missing_tools=1
-fi
-require_tool node "install Node.js runtime"
-if ! command -v pnpm >/dev/null 2>&1 && ! command -v corepack >/dev/null 2>&1 && [ ! -x /opt/homebrew/bin/pnpm ]; then
-  echo "[codex] missing required tool: pnpm (or corepack with pnpm support)"
-  missing_tools=1
+if [[ -f scripts/prepare-worktree.sh ]]; then
+  bash scripts/prepare-worktree.sh
+else
+  npm install
 fi
-require_tool python3 "install Python 3 runtime"
-require_tool uv "install uv package manager"
-require_tool rustup "install rustup toolchain manager"
-require_tool rustc "install Rust compiler (rustc)"
-require_tool cargo "install Rust toolchain (cargo)"
-require_tool npm "install npm and ensure it is on PATH"
-
-if [ "$missing_tools" -ne 0 ]; then
-  echo "[codex] tooling check failed; install missing tools from tooling.md / mise before continuing."
-  exit 1
-fi
-bootstrap_node_tools() {
-init_env_paths
-}
-
-run_node_pm() {
-  bootstrap_node_tools
-  npm "$@"
-}
-
-run_node_pm ci || run_node_pm install
 '''
 
 [[actions]]
 name = "Tools"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+for candidate in "$HOME/.local/share/mise/shims" "$HOME/.local/bin" "/opt/homebrew/bin" "/opt/homebrew/sbin" "/usr/local/bin" "/usr/sbin" "/sbin"; do
+  if [[ -d "$candidate" && ":$PATH:" != *":$candidate:"* ]]; then
+    PATH="$candidate:$PATH"
+  fi
+done
+export PATH
+
+if command -v mise >/dev/null 2>&1; then
+  mise trust --yes .mise.toml || true
+  mise install
+fi
+if [[ -f scripts/prepare-worktree.sh ]]; then
+  bash scripts/prepare-worktree.sh
+else
+  npm install
+fi
+'''
 
 [[actions]]
 name = "Run"
 icon = "run"
+command = '''
+set -euo pipefail
+
+npm run 'dev'
+'''
 
 [[actions]]
 name = "Debug"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'lint'
+'''
 
 [[actions]]
 name = "Test"
 icon = "test"
+command = '''
+set -euo pipefail
+
+npm run 'test'
+'''
 
 [[actions]]
 name = "Prek"
 icon = "test"
+command = '''
+set -euo pipefail
+
+command -v prek >/dev/null 2>&1
+prek --version
+'''
+
+[[actions]]
+name = "Release Finalize"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+release_branch="${1:-}"
+if [ -z "$release_branch" ]; then
+  echo "Usage: Release Finalize <release-branch>"
+  echo "Example: Release Finalize codex/release-0.12.1-coherence"
+  exit 2
+fi
+
+case "$release_branch" in
+  codex/release-*|release-*) ;;
+  *)
+    echo "Expected a release branch matching codex/release-* or release-*"
+    exit 2
+    ;;
+esac
+
+git fetch --prune origin main "$release_branch"
+git checkout main
+local_main_ahead_count="$(git rev-list --count origin/main..HEAD)"
+if [ "$local_main_ahead_count" -ne 0 ]; then
+  echo "Local main is ahead of origin/main; aborting."
+  echo "Reconcile local commits before running Release Finalize."
+  exit 2
+fi
+
+git pull --ff-only origin main
+pull_status=$?
+if [ "$pull_status" -ne 0 ]; then
+  local_main_ahead_count="$(git rev-list --count origin/main..HEAD 2>/dev/null || echo 0)"
+  if [ "$local_main_ahead_count" -ne 0 ]; then
+    echo "Local main is ahead of origin/main; aborting."
+    echo "Reconcile local commits before running Release Finalize."
+    exit 2
+  fi
+  exit "$pull_status"
+fi
+
+git merge --ff-only "origin/$release_branch"
+git push origin main
+
+echo "Merged $release_branch into main and pushed origin/main."
+echo "Optional PR follow-up:"
+echo "  gh pr list --state open --head \"$release_branch\" --json number,url"
+echo "  gh pr comment <number> --body \"Published to npm and merged into main.\""
+echo "  gh pr close <number> --delete-branch=false"
+'''
 
 [[actions]]
 name = "Diagram"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v diagram >/dev/null 2>&1
+diagram --help
+'''
 
 [[actions]]
 name = "Ralph"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v ralph >/dev/null 2>&1
+ralph --help
+'''
 
 [[actions]]
 name = "Mise"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v mise >/dev/null 2>&1
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  current_branch="$(git symbolic-ref --short -q HEAD || true)"
+  if [ -z "$current_branch" ]; then
+    repo_slug="$(basename "$PWD" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//')"
+    if [ -z "$repo_slug" ]; then
+      repo_slug="worktree"
+    fi
+    short_sha="$(git rev-parse --short HEAD)"
+    branch_base="jscraik/feature/$repo_slug-worktree-$short_sha"
+    branch_name="$branch_base"
+    suffix=1
+    while git show-ref --verify --quiet "refs/heads/$branch_name"; do
+      branch_name="$branch_base-$suffix"
+      suffix=$((suffix + 1))
+    done
+    echo "[codex] detached HEAD detected; creating branch $branch_name"
+    git switch -c "$branch_name"
+    if git show-ref --verify --quiet "refs/remotes/origin/main"; then
+      git branch --set-upstream-to=origin/main "$branch_name" >/dev/null 2>&1 || true
+      echo "[codex] tracking origin/main for $branch_name"
+      echo "[codex] fast-forwarding $branch_name with origin/main"
+      git pull --ff-only origin main
+    fi
+  fi
+fi
+mise trust --yes .mise.toml || true
+mise install
+'''
 
 [[actions]]
 name = "Vale"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v vale >/dev/null 2>&1
+vale --version
+'''
 
 [[actions]]
 name = "Argos"
 icon = "test"
+command = '''
+set -euo pipefail
+
+command -v argos >/dev/null 2>&1
+argos --help
+'''
 
 [[actions]]
 name = "Cosign"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v cosign >/dev/null 2>&1
+cosign version
+'''
 
 [[actions]]
 name = "Cloudflared"
 icon = "run"
+command = '''
+set -euo pipefail
+
+command -v cloudflared >/dev/null 2>&1
+cloudflared --version
+'''
 
 [[actions]]
 name = "Vitest"
 icon = "test"
+command = '''
+set -euo pipefail
+
+command -v vitest >/dev/null 2>&1
+vitest --version
+'''
 
 [[actions]]
 name = "Ruff"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v ruff >/dev/null 2>&1
+ruff --version
+'''
 
 [[actions]]
 name = "ESLint"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v eslint >/dev/null 2>&1
+eslint --version
+'''
 
 [[actions]]
 name = "Agent Browser"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v agent-browser >/dev/null 2>&1
+agent-browser --help
+'''
 
 [[actions]]
 name = "Agentation"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v agentation-mcp >/dev/null 2>&1
+agentation-mcp --help
+'''
 
 [[actions]]
 name = "Mermaid CLI"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v mmdc >/dev/null 2>&1
+mmdc --help
+'''
 
 [[actions]]
 name = "MarkdownLint"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v markdownlint-cli2 >/dev/null 2>&1
+markdownlint-cli2 --help
+'''
 
 [[actions]]
 name = "Wrangler"
 icon = "run"
+command = '''
+set -euo pipefail
+
+command -v wrangler >/dev/null 2>&1
+wrangler --help
+'''
 
 [[actions]]
 name = "1Password"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v op >/dev/null 2>&1
+op --help
+'''
 
 [[actions]]
 name = "Beautiful Mermaid"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v beautiful-mermaid >/dev/null 2>&1
+beautiful-mermaid --help
+'''
 
 [[actions]]
 name = "Auth0"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v auth0 >/dev/null 2>&1
+auth0 --help
+'''
 
 [[actions]]
 name = "Semgrep"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v semgrep >/dev/null 2>&1
+semgrep --help
+'''
 
 [[actions]]
 name = "Semver"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v semver >/dev/null 2>&1
+semver --help
+'''
 
 [[actions]]
 name = "Trivy"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v trivy >/dev/null 2>&1
+trivy --help
+'''
 
 [[actions]]
 name = "Gitleaks"
 icon = "debug"
+command = '''
+set -euo pipefail
+
+command -v gitleaks >/dev/null 2>&1
+gitleaks --help
+'''
 
 [[actions]]
 name = "Research"
 icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v rsearch >/dev/null 2>&1
+rsearch --help
+'''
 
 [[actions]]
 name = "WSearch"
-icon = "tool"
\ No newline at end of file
+icon = "tool"
+command = '''
+set -euo pipefail
+
+command -v wsearch >/dev/null 2>&1
+wsearch --help
+'''
+
+[[actions]]
+name = "Script: build"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'build'
+'''
+
+[[actions]]
+name = "Script: postbuild"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'postbuild'
+'''
+
+[[actions]]
+name = "Script: dev"
+icon = "run"
+command = '''
+set -euo pipefail
+
+npm run 'dev'
+'''
+
+[[actions]]
+name = "Script: lint"
+icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'lint'
+'''
+
+[[actions]]
+name = "Script: typecheck"
+icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'typecheck'
+'''
+
+[[actions]]
+name = "Script: lint:types"
+icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'lint:types'
+'''
+
+[[actions]]
+name = "Script: test"
+icon = "test"
+command = '''
+set -euo pipefail
+
+npm run 'test'
+'''
+
+[[actions]]
+name = "Script: docs:lint"
+icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'docs:lint'
+'''
+
+[[actions]]
+name = "Script: fmt"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'fmt'
+'''
+
+[[actions]]
+name = "Script: check"
+icon = "debug"
+command = '''
+set -euo pipefail
+
+npm run 'check'
+'''
+
+[[actions]]
+name = "Script: audit"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'audit'
+'''
+
+[[actions]]
+name = "Script: ci"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'ci'
+'''
+
+[[actions]]
+name = "Script: secrets:staged"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'secrets:staged'
+'''
+
+[[actions]]
+name = "Script: docs:style:changed"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'docs:style:changed'
+'''
+
+[[actions]]
+name = "Script: test:related"
+icon = "test"
+command = '''
+set -euo pipefail
+
+npm run 'test:related'
+'''
+
+[[actions]]
+name = "Script: semgrep:changed"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'semgrep:changed'
+'''
+
+[[actions]]
+name = "Script: docs:check-links"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'docs:check-links'
+'''
+
+[[actions]]
+name = "Script: docs:api"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'docs:api'
+'''
+
+[[actions]]
+name = "Script: prepublishOnly"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'prepublishOnly'
+'''
+
+[[actions]]
+name = "Script: preversion"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'preversion'
+'''
+
+[[actions]]
+name = "Script: version"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'version'
+'''
+
+[[actions]]
+name = "Script: postversion"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'postversion'
+'''
+
+[[actions]]
+name = "Script: changelog:update"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'changelog:update'
+'''
+
+[[actions]]
+name = "Script: prepack"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'prepack'
+'''
+
+[[actions]]
+name = "Script: commit"
+icon = "tool"
+command = '''
+set -euo pipefail
+
+npm run 'commit'
+'''
diff --git a/package-lock.json b/package-lock.json
index 727b013..9a19073 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28,8 +28,8 @@
         "typedoc": "^0.28.17",
         "typedoc-plugin-markdown": "^4.10.0",
         "typescript": "^5.9.3",
-        "vite": "^8.0.8",
-        "vitest": "^4.1.2"
+        "vite": "^8.0.5",
+        "vitest": "^4.1.4"
       },
       "engines": {
         "node": ">=20.18.1"
@@ -2176,9 +2176,9 @@
       }
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.5.tgz",
-      "integrity": "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
       "funding": [
         {
           "type": "github",
@@ -2187,7 +2187,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "path-expression-matcher": "^1.1.3"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
     "node_modules/fast-xml-parser": {
@@ -4133,30 +4134,6 @@
         "queue-microtask": "^1.2.2"
       }
     },
-    "node_modules/run-parallel": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "queue-microtask": "^1.2.2"
-      }
-    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -4728,6 +4705,21 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
+      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/xmlbuilder2": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz",
diff --git a/scripts/validate-commit-msg.js b/scripts/validate-commit-msg.js
index a2c694c..6fb8adf 100755
--- a/scripts/validate-commit-msg.js
+++ b/scripts/validate-commit-msg.js
@@ -114,4 +114,3 @@ function getBranchName() {
 }
 
 main();
-