docs(harnessx-removal): the plane replaces HarnessX in README, docs and specs (task 8)

README: "Configuring the HarnessX agentic plane" becomes "The agentic
plane (ax)" (ousast plane run|status|doctor|remember, per-task Model,
budget and egress, pointer to ops/ax/README.md, one tagged retirement
line); "The HarnessX self-improving cycle" becomes "The self-improving
cycle", and its MetaAgent paragraph is replaced by the memory proposer
(`ousast improve --memory`, provenance, train-on-test guard). The fusion
panel_model/decider_model lines and the [harnessx] spend caps are gone.
The README reference test now passes without its strict xfail.

docs/examples.md section 6 runs the plane; docs/threat-model.md describes
the per-task EgressPolicy, the usd/calls budgets and the start-request
credential path. RELEASE_NOTES.md gets an Unreleased entry: HarnessX
removed, the retired keys and their errors, the silent loss of the
second hunter for users who set [models] hunter, and the plane as the
agentic path.

Dated retirement notes (2026-09-30) head the requirements, design and
brief of harnessx-self-improving-rulesets, learning-harness,
three-stage-scan and openrouter-sast-harness, and follow the spec table
in steering/overview.md; history is unchanged. All tasks are checked, so
spec.json moves to implementation-complete.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

docs/examples.md

@@ -57,30 +57,28 @@ uv run ousast improve benchmarks/manifests/java-spring-boot-vulnerable.toml
 # which the next scan/benchmark of that target loads automatically.
 ```
 
-## 6. Standard mode with the HarnessX agentic plane (OpenAI)
+## 6. Running the agentic plane
+
+Model work over whole repositories runs as a Run manifest on ax, one isolated actor
+per task (bring-up: [ops/ax/README.md](../ops/ax/README.md)). The provider key is
+read from the environment (or `.env`) by `ousast` and sent only in each task's start
+request.
 
 ```bash
-uv sync --extra harnessx
-export OPENAI_API_KEY=sk-...
-cat > openultrasast.toml <<'TOML'
-[models]
-hunter   = "gpt-4o"
-verifier = "gpt-4o"
-[harnessx]
-provider        = "openai"
-max_cost_usd    = 2.0
-token_threshold = 120000
-[fusion]
-panel_model = "gpt-4o"   # two-panel adjudication on triggered findings
-[hardening]
-redact_secrets = true
-max_findings   = 0
-TOML
-uv run ousast scan /path/to/code --mode standard --config openultrasast.toml
-jq '.degradations' "$run/manifest.json"   # null = HarnessX ran; entries = it fell back
-jq '.fusion'       "$run/manifest.json"   # per-finding dispositions
+uv run ousast plane doctor                               # kind, Agent Substrate, ax controller, runner image
+uv run ousast plane run plane/runs/validation-46.yaml    # repo-facts, verify a/b(/c), agree, remember per case
+uv run ousast plane status validation-46                 # per-task status and token attribution
+uv run ousast plane remember validation-46               # re-ingest the run's memory rows (OUSAST_MEMORY)
+
+# Feed the stored rows back into the ruleset loop (same validator and gate)
+uv run ousast improve benchmarks/manifests/java-spring-boot-vulnerable.toml --dry-run --memory
 ```
 
+Each task in the Run carries its own Model and `budget: {usd, calls}`; a task that
+reaches its ceiling stops as `unfinished` and resumes on a rerun with a larger
+budget. A local `ousast scan --mode standard` stays deterministic apart from the
+optional `[models] hunter` tool hunter.
+
 ## 7. Drive it from an MCP client (OpenCode / IDE)
 
 ```jsonc

docs/threat-model.md

@@ -15,9 +15,12 @@ it does not, and the controls that keep a scan safe to run in CI and safe to sha
   flip rule *status* and tune score constants but can never edit pattern text or the
   authoritative 0–5 severity. See the self-improving cycle in the README.
 - **Provider credentials are the operator's.** The zero-dependency core makes no network
-  calls. The optional HarnessX agentic plane sends source excerpts to the configured LLM
-  provider only when a model is set in `[models]`; keys are read from the provider's
-  standard env var (`OPENAI_API_KEY` / `ANTHROPIC_API_KEY`), never written to artifacts.
+  calls. A local scan calls a model only for the optional `[models] hunter` tool hunter
+  in standard mode. Agentic work runs on the plane (`ousast plane run`): `ousast` reads
+  the variable a task's Model names (`secretKey.key`) from the operator's environment or
+  `.env` and sends the key only in that task's start request, through Agent Substrate's
+  router to that task's actor. It is not baked into an image or task template, and it is
+  never logged or written to artifacts.
 
 ## Controls
 
@@ -28,10 +31,21 @@ tokens, URL-embedded credentials, PEM private keys, and `key = value` assignment
 sensitive names) before traces (`trace/events.jsonl`) and the markdown report are
 written. On by default; disable with `[hardening] redact_secrets = false`.
 
+### Plane egress
+Each plane task runs in its own actor behind Agent Substrate's egress gateway, which
+denies by default. The task's EgressPolicy (`src/openultrasast/plane/egress.py`) allows exactly three
+things: plain HTTP to the artifact receiver, and TLS passthrough to the Git hosts of the
+task's bound Workspaces and to the hosts its bound Model declares
+(`openultrasast.io/egress-hosts`). There are no wildcards, no IP addresses and no TLS
+interception. The policy is deleted with the actor.
+
 ### Cost & CI budgets
-- **Agentic spend** is bounded per task by `[harnessx] max_cost_usd` and
-  `token_threshold` (enforced inside the HarnessX run loop) and by the per-tier hunter
-  budgets.
+- **Agentic spend** is bounded per plane task by the Run's `budget: {usd, calls}`. The
+  metered client refuses the next call once either ceiling is reached (the task is
+  `unfinished` and resumes on a rerun with a larger budget). A usd budget on a Model
+  without prices is refused rather than metered as zero, and an account or
+  authentication error fails the task and starts nothing further. The standard-mode tool
+  hunter is bounded by the per-tier hunter budgets.
 - **Output size** is bounded by `[hardening] max_findings` (0 = unlimited). Truncation is
   severity-ordered and disclosed as a `budget` degradation in the manifest.