@buddhilive/dsh-invariants 0.1.2-alpha.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/runtime-diagnostics/invariants/README.md
+README.md: 72bb74cf5b9b367d0a29cb942370c4fa3d86e84c
+README.zh.md: b7cffce5cf988bdfedce6b7b5de41d224182e086

package/README.md

@@ -0,0 +1,166 @@
+---
+description: "Runtime invariant checks for live compositions: the registry service that runs package-owned checks, for users and maintainers choosing, configuring, or debugging them."
+kind: "package-reference"
+---
+
+# @buddhilive/dsh-invariants
+
+English | [中文](README.zh.md)
+
+## Summary
+
+`dsh-invariants` runs package-owned runtime checks — invariants — inside a DeepSeek Harness composition: any package can ship a `./invariant` companion that verifies its own durable relationships (authoritative event streams and mutable snapshots) while the composition runs. Checks run automatically, and a failed check reports an `InvariantError` attributed to the package that owns the violated relationship. Choose it for compositions that want self-checking diagnostics with a global switch and package-name filters; the standard agent composition already mounts it with the four core companions, and loading the service alone installs no checks.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Mount the registry when a composition should verify its own runtime contracts, then decide which packages' checks run. The service exposes `ctx.invariants`; companions register checks under their package's exact npm name, and every failure carries the owning package name.
+
+### When to use it
+
+Use the registry for compositions that want live diagnostics. The standard agent composition in [`agent-spine-demo`](../../../packages/examples/agent-spine-demo/README.md) already mounts it with the four core stateful companions — `dsh-session`, `dsh-agent`, `dsh-scope`, and `dsh-agent-loop`. Custom compositions mount the registry and add companions for any other loaded package whose contracts they want checked. Loading the registry alone installs no checks: it ships no product checks of its own, so a composition that never mounts a companion observes no diagnostic behavior.
+
+### Enabling checks and selecting packages
+
+The registry is enabled by default and checks every registered package unless filters say otherwise. Use `enabled` as a global switch, `package_allowlist` to admit only named packages, and `package_blocklist` to exclude packages after allowlist matching — a blocklist match overrides an allowlist match. Patterns are case-sensitive JavaScript regular-expression sources (unanchored unless they supply `^` and `$`), and an invalid, blank, or duplicate entry fails service startup instead of being skipped.
+
+```yaml
+- name: '@buddhilive/dsh-invariants'
+  config:
+    enabled: true
+    package_allowlist:
+      - '^@buddhilive/dsh-'
+```
+
+| Field | Default | Meaning |
+|---|---|---|
+| `enabled` | `true` | Global switch for all registered checks |
+| `package_allowlist` | `[]` | Regex sources admitting package names; empty admits all |
+| `package_blocklist` | `[]` | Regex sources excluding package names after allowlist matching |
+
+The generated [configuration catalog](../../../docs/config-catalog.md#buddhilivedsh-invariants) is the exhaustive source for every accepted field and its JSDoc.
+
+### Which checks run
+
+Each companion protects relationships its package owns, and a companion installs a check only for an observable event or mutable-data relationship — never for a service or method presence. The shipped executable companions cover:
+
+| Companion | Checks |
+|---|---|
+| `dsh-session`, `dsh-agent`, `dsh-scope`, `dsh-agent-loop` | Session log enclosure and call/result trace, agent-status transitions, scope-filtered dispatch subjects, loop-built request reconstruction |
+| `dsh-llm`, `dsh-llm-retry`, `dsh-tools`, `dsh-system-prompt` | LLM stream grammar, retry-failure shape, tool-pipeline stage pairing and frozen results, prompt-assembly section names |
+| `dsh-compaction`, `dsh-hook-protocol`, `dsh-sandbox-policy` | Compaction stream pairing, hook invocation/result pairing, sandbox mode values |
+| `dsh-fs`, `dsh-subagent`, `dsh-workflow`, `dsh-tool-workflow` | Filesystem event identity, subagent provider and start/end pairing, workflow lifecycle identity, workflow record shape |
+| `dsh-goal`, `dsh-goal-round-driver` | Durable goal-stream folds and reconstructed continuation prompts |
+| `dsh-permission-presets`, `dsh-user-approval`, `dsh-commands` | Preset references to live presets, approval asked/decided pairing, command run/done pairing |
+| `dsh-jobs`, `dsh-tool-todo`, `dsh-time-context` | Job snapshot field relationships, whole-list todo shape, durable clock readings |
+| `dsh-credentials`, `dsh-settings`, `dsh-storage-domain`, `dsh-workspace` | Commit events against the live service or memory state, entity-cache mirroring |
+| `dsh-agent-presets`, `dsh-session-title`, `dsh-plan-mode`, `dsh-schedule`, `dsh-webserver` | Preset mount placement, title source citation, plan-mode payload, schedule stream, route disposer symmetry |
+| `dsh-client-hmr`, `dsh-client-modules`, `dsh-client-runtime` | Browser/node-half stat-watcher lifecycle, boot entry graph, slot mutation versioning |
+
+Every other workspace package publishes an empty companion with a `No runtime invariant:` explanation of why nothing is checkable.
+
+### Adding a companion to a custom composition
+
+A companion is a normal plugin you mount beside the registry. It declares any services it needs and registers under its package's exact npm name; the registry joins its setup before the registration completes.
+
+```ts
+import type { Context } from '@deepseek-ai/cordis'
+import InvariantRegistry from '@buddhilive/dsh-invariants'
+import * as SessionInvariant from '@buddhilive/dsh-session/invariant'
+
+declare const ctx: Context
+
+ctx.plugin(InvariantRegistry, { enabled: true })
+ctx.plugin(SessionInvariant)
+```
+
+### When a check fails
+
+A violation throws an `InvariantError` from the context that reported it: it carries the stable code `INVARIANT`, the full npm `packageName` of the owning package, and a message prefixed `invariant violated by "<package>": …`. The failure is therefore attributable to a package without the registry importing any product code. A companion whose installer itself fails is disposed and its registration rolled back, so a broken check cannot leave partial listeners behind.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+This section explains the design behind the registry; the observable behavior is covered in [Use this package](#use-this-package). The full decision rationale lives in the [invariant-service Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-owned-invariant-service.md).
+
+### Design philosophy
+
+- **Product-independent registry.** The service imports no session, agent, scope, or agent-loop package and contains none of their checks; companions carry checks next to their owners.
+- **Real relationships, not synthetic assertions.** A companion checks an event-stream or mutable-data relationship its package owns; confirming a method, plugin name, injection, or fixed pure result is a type, load, or unit-test concern, never a runtime invariant.
+- **Registration reserves ownership.** A package name is reserved even when filters keep its installer inactive, so two plugins can never silently claim the same name.
+- **Exhaustive wiring, mechanically enforced.** `pnpm run verify-package-invariants` rejects generated markers, unexplained empty installers, non-empty installers that omit or ignore the reporter, wrong registration names, and incomplete export, publication, dependency, or bundle wiring ([contracts note](../../../.agents/notes/implemented/architecture/2026-07-19-package-invariant-runtime-contracts.md)).
+
+### Source map
+
+| File | Role |
+|---|---|
+| [`src/index.ts`](src/index.ts) | Plugin entry: `Config` schema, `InvariantRegistry` service, selection, registration, `InvariantError` |
+| [`src/invariant.ts`](src/invariant.ts) | This package's own companion: an empty installer explaining that registration ownership is the service's own mutation boundary |
+
+### Selection and registration lifecycle
+
+`register(packageName, installer)` reserves the full npm name and returns an effect-scoped disposer. An enabled installer runs in a dedicated child fiber; `installer.inject` declares the services that fiber may access, and synchronous or asynchronous completion is joined before registration succeeds. Failure disposes the child and releases the reservation atomically. The service owns every registration fiber, while the returned disposer also belongs to the companion fiber, so unloading either side removes listeners, trace state, and the reservation — a companion can reload and register the same name again without retained state. Session-backed companions rebuild their baseline from durable events; live-only companions observe operations that begin after reload.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+Read these pages when the package-level contract is not enough. They move from the generated service reference to the decision evidence and the group map.
+
+- [Runtime invariants subsystem](../../../docs/subsystems/invariants.md) — the generated reference for `Config`, the installer, the service, and the companion contract.
+- [Generated configuration catalog](../../../docs/config-catalog.md#buddhilivedsh-invariants) — every accepted config field and its source declaration.
+- [Package-owned invariant service Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-owned-invariant-service.md) — why checks live beside their owners and the registry owns selection and lifecycle.
+- [Invariant runtime contracts Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-invariant-runtime-contracts.md) — what a runtime invariant may assert and the mechanical gate that enforces companion wiring.
+- [Runtime-diagnostics group map](../../README.md) — adjacent diagnostics packages.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as the observer validates requests but never rewrites their context.
+
+#### KV Cache effect
+
+Checks observe assembled requests and durable state without mutating request content, so provider cache reuse is exactly what the underlying composition produces.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+
+These limits define when the registry is a poor fit or needs operational care. They are current package constraints, not a task backlog.
+
+- **Filters are fixed for the service lifetime** — `enabled`, `package_allowlist`, and `package_blocklist` are compiled once at startup; changing them requires a Cordis plugin reload.
+- **Live-only companions miss pre-reload operations** — a companion that only observes live operations cannot reconstruct operations that began before its own reload; session-backed companions rebuild their baseline from durable events.
+- **Request reconstruction covers loop-built requests only** — the `dsh-agent-loop` companion reconstructs requests explicitly built by the loop; direct one-shot LLM calls remain outside that contract even when callers freeze them or attach a session id.
+- **No checks without a companion** — the registry ships no product checks; a composition that mounts the service alone observes nothing.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>

package/README.zh.md

@@ -0,0 +1,166 @@
+---
+description: "面向用户与维护者的运行时不变量检查说明：选择、配置或排查由包自有检查组成的注册表服务。"
+kind: "package-reference"
+---
+
+# @buddhilive/dsh-invariants
+
+[English](README.md) | 中文
+
+## 概述
+
+`dsh-invariants` 在 DeepSeek Harness 组合中运行包自有的运行时检查——不变量：任何包都可以发布一个 `./invariant` 配套入口，在组合运行期间验证其自身的持久关系（权威事件流与可变快照）。检查自动运行，失败的检查会报告归因到拥有被违反关系的包的 `InvariantError`。需要带全局开关与包名过滤器的自检诊断时选择它；标准 agent 组合已挂载它及四个核心配套入口，而单独加载服务不会安装任何检查。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [进一步探索](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+当组合需要验证自身运行时约定时挂载注册表，然后决定运行哪些包的检查。服务暴露 `ctx.invariants`；配套入口以其包的精确 npm 名称注册检查，每次失败都会携带所属包名。
+
+### 何时使用
+
+需要实时诊断的组合请使用注册表。[`agent-spine-demo`](../../../packages/examples/agent-spine-demo/README.zh.md) 中的标准 agent 组合已挂载它及四个核心有状态配套入口——`dsh-session`、`dsh-agent`、`dsh-scope` 与 `dsh-agent-loop`。自定义组合挂载注册表，并为任何其他已加载、且希望检查其约定的包添加配套入口。单独加载注册表不会安装任何检查：它自身不携带任何产品检查，因此从不挂载配套入口的组合不会观察到任何诊断行为。
+
+### 启用检查与选择包
+
+注册表默认启用，并在没有过滤器的情况下检查每个已注册的包。用 `enabled` 作全局开关，用 `package_allowlist` 只接纳指定包，用 `package_blocklist` 在 allowlist 匹配之后排除包——blocklist 匹配优先于 allowlist 匹配。模式是区分大小写的 JavaScript 正则表达式源（除非自带 `^` 与 `$`，否则不锚定）；无效、空白或重复的条目会使服务启动失败，而不是被跳过。
+
+```yaml
+- name: '@buddhilive/dsh-invariants'
+  config:
+    enabled: true
+    package_allowlist:
+      - '^@buddhilive/dsh-'
+```
+
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `enabled` | `true` | 所有已注册检查的全局开关 |
+| `package_allowlist` | `[]` | 接纳包名的正则源；为空则全部接纳 |
+| `package_blocklist` | `[]` | 在 allowlist 匹配之后排除包名的正则源 |
+
+生成的[配置目录](../../../docs/config-catalog.zh.md#buddhilivedsh-invariants)是每个受支持字段及其 JSDoc 的穷尽式真源。
+
+### 运行哪些检查
+
+每个配套入口保护其包拥有的关系，且只为可观察的事件或可变数据关系安装检查——绝不针对服务或方法是否存在。已发布的可执行配套入口覆盖：
+
+| 配套入口 | 检查 |
+|---|---|
+| `dsh-session`、`dsh-agent`、`dsh-scope`、`dsh-agent-loop` | 会话日志包含关系与调用/结果跟踪、agent 状态转换、作用域过滤分发的主体、loop 构建请求重建 |
+| `dsh-llm`、`dsh-llm-retry`、`dsh-tools`、`dsh-system-prompt` | LLM 流语法、重试失败形状、工具流水线阶段配对与冻结结果、提示词组装章节名 |
+| `dsh-compaction`、`dsh-hook-protocol`、`dsh-sandbox-policy` | 压缩流配对、钩子调用/结果配对、沙箱 mode 值 |
+| `dsh-fs`、`dsh-subagent`、`dsh-workflow`、`dsh-tool-workflow` | 文件系统事件身份、subagent 提供方与开始/结束配对、workflow 生命周期身份、workflow 记录形状 |
+| `dsh-goal`、`dsh-goal-round-driver` | 持久 goal 流折叠与重建的继续提示词 |
+| `dsh-permission-presets`、`dsh-user-approval`、`dsh-commands` | preset 引用指向活动 preset、审批询问/决定配对、命令运行/完成配对 |
+| `dsh-jobs`、`dsh-tool-todo`、`dsh-time-context` | 任务快照字段关系、整表 todo 形状、持久时钟读数 |
+| `dsh-credentials`、`dsh-settings`、`dsh-storage-domain`、`dsh-workspace` | 提交事件对照活动服务或内存状态、实体缓存镜像 |
+| `dsh-agent-presets`、`dsh-session-title`、`dsh-plan-mode`、`dsh-schedule`、`dsh-webserver` | preset 挂载位置、标题来源引用、plan-mode 载荷、schedule 流、路由 disposer 对称性 |
+| `dsh-client-hmr`、`dsh-client-modules`、`dsh-client-runtime` | 浏览器/node 侧 stat-watcher 生命周期、启动入口图、slot 变更版本化 |
+
+其余每个工作区包都发布一个空配套入口，并以 `No runtime invariant:` 说明为何没有可检查的内容。
+
+### 向自定义组合添加配套入口
+
+配套入口就是挂载在注册表旁的普通插件。它声明所需的服务，并以其包的精确 npm 名称注册；注册表会先完成其设置再完成注册。
+
+```ts
+import type { Context } from '@deepseek-ai/cordis'
+import InvariantRegistry from '@buddhilive/dsh-invariants'
+import * as SessionInvariant from '@buddhilive/dsh-session/invariant'
+
+declare const ctx: Context
+
+ctx.plugin(InvariantRegistry, { enabled: true })
+ctx.plugin(SessionInvariant)
+```
+
+### 检查失败时
+
+违规会从报告它的上下文抛出 `InvariantError`：它携带稳定的 `INVARIANT` 代码、所属包的完整 npm `packageName`，以及以 `invariant violated by "<package>": …` 开头的信息。失败因此可以归因到某个包，而注册表无需导入任何产品代码。installer 本身失败的配套入口会被释放，其注册会回滚，因此损坏的检查不会遗留部分监听器。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>实现细节——点击展开</summary>
+
+本节解释注册表背后的设计；可观察行为已在[使用本包](#use-this-package)中说明。完整决策理由见[不变式服务 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-owned-invariant-service.zh.md)。
+
+### 设计理念
+
+- **与产品无关的注册表。** 服务不导入任何 session、agent、scope 或 agent-loop 包，也不包含它们的检查；配套入口把检查放在其归属者旁边。
+- **真实关系，而非人为断言。** 配套入口只检查其包拥有的事件流或可变数据关系；确认方法、插件名、注入或固定纯函数结果是类型、加载或单元测试关注点，绝不是运行时不变量。
+- **注册保留归属。** 即使过滤器让 installer 保持非活动，包名也会被保留，因此两个插件永远不会静默认领同一个名字。
+- **穷尽接线，机械强制。** `pnpm run verify-package-invariants` 拒绝生成标记、未说明的空 installer、省略或忽略 reporter 的非空 installer、错误注册名，以及不完整的导出、发布、依赖或 bundle 接线（[约定笔记](../../../.agents/notes/implemented/architecture/2026-07-19-package-invariant-runtime-contracts.zh.md)）。
+
+### 源码地图
+
+| 文件 | 职责 |
+|---|---|
+| [`src/index.ts`](src/index.ts) | 插件入口：`Config` schema、`InvariantRegistry` 服务、选择、注册、`InvariantError` |
+| [`src/invariant.ts`](src/invariant.ts) | 本包自己的配套入口：一个空 installer，说明注册归属本身就是服务的变更边界 |
+
+### 选择与注册生命周期
+
+`register(packageName, installer)` 保留完整 npm 名称并返回作用域化 disposer。启用的 installer 在专用子 fiber 中运行；`installer.inject` 声明该 fiber 可访问的服务，同步或异步完成都会在注册成功前被 join。失败会释放子级并原子地收回保留。服务拥有每个注册 fiber，返回的 disposer 同时属于配套 fiber，因此卸载任一侧都会移除监听器、跟踪状态与保留——配套入口可以重新加载并再次注册同一名称而不保留旧状态。由会话支撑的配套入口从持久事件重建 baseline；仅实时配套入口观察重新加载后开始的操作。
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 进一步探索
+
+当包级约定不够用时阅读以下页面。它们从生成的服务参考逐步进入决策证据与组地图。
+
+- [运行时不变式子系统](../../../docs/subsystems/invariants.zh.md)——`Config`、installer、服务与配套入口约定的生成参考。
+- [生成的配置目录](../../../docs/config-catalog.zh.md#buddhilivedsh-invariants)——每个受支持配置字段及其源声明。
+- [包自有不变式服务 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-owned-invariant-service.zh.md)——检查为何放在归属者旁边，以及注册表为何拥有选择与生命周期。
+- [不变式运行时约定 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-19-package-invariant-runtime-contracts.zh.md)——运行时不变量可以断言什么，以及强制配套入口接线的机械门禁。
+- [runtime-diagnostics 组地图](../../README.zh.md)——相邻的诊断包。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+无。作为观察者，本包验证请求但从不改写其上下文。
+
+#### KV Cache 影响
+
+检查只观察已组装的请求与持久状态，不修改请求内容，因此提供方缓存复用与底层组合产生的结果完全一致。
+
+## 已知限制与延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+
+这些限制说明注册表何时不合适或需要特别运维。它们是当前包约束，不是任务积压。
+
+- **过滤器在服务生命周期内固定**——`enabled`、`package_allowlist` 与 `package_blocklist` 在启动时编译一次；更改它们需要执行 Cordis 插件重新加载。
+- **仅实时配套入口会遗漏重载前的操作**——只观察实时操作的配套入口无法重建自身重新加载前开始的操作；由会话支撑的配套入口从持久事件重建 baseline。
+- **请求重建只覆盖 loop 构建的请求**——`dsh-agent-loop` 配套入口只重建 loop 显式构建的请求；直接一次性 LLM 调用即使由调用方冻结或附加会话 id，仍不在此约定内。
+- **没有配套入口就没有检查**——注册表自身不携带产品检查；只挂载服务的组合观察不到任何行为。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者的工作上下文——点击展开</summary>
+
+无。
+
+</details>

package/lib/index.js

@@ -0,0 +1,123 @@
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+//#region lib/types/index.js
+/**
+* Configurable registry for package-owned runtime invariant contributions.
+* Every workspace package registers checks from a `./invariant` companion;
+* ordinary package entrypoints stay independent of diagnostics.
+*
+* @module @buddhilive/dsh-invariants
+*/
+/** Thrown when a package-owned runtime invariant is violated. */
+var InvariantError = class extends Error {
+	/** Stable machine-readable invariant failure code. */
+	code = "INVARIANT";
+	/** Full npm package name that owns the violated invariant. */
+	packageName;
+	/**
+	* Construct a package-attributed invariant failure.
+	* @param packageName - full npm package name that registered the check.
+	* @param message - violated contract, without the standard error prefix.
+	*/
+	constructor(packageName, message) {
+		super(`invariant violated by "${packageName}": ${message}`);
+		this.name = "InvariantError";
+		this.packageName = packageName;
+	}
+};
+/** Compile and validate one package-filter list. */
+function compilePatterns(field, values) {
+	const seen = /* @__PURE__ */ new Set();
+	return values.map((value) => {
+		if (value.length === 0 || value.trim() !== value) throw new Error(`invariants: ${field} entries must be non-blank and have no surrounding whitespace`);
+		if (seen.has(value)) throw new Error(`invariants: ${field} contains duplicate regex ${JSON.stringify(value)}`);
+		seen.add(value);
+		try {
+			return new RegExp(value);
+		} catch (cause) {
+			throw new Error(`invariants: ${field} contains invalid regex ${JSON.stringify(value)}`, { cause });
+		}
+	});
+}
+/** Package-owned invariant registry with global and regex-based selection. */
+var InvariantRegistry = class extends Service {
+	static Config = z.object({
+		enabled: z.boolean().default(true),
+		package_allowlist: z.array(z.string()).default([]),
+		package_blocklist: z.array(z.string()).default([])
+	});
+	enabled;
+	ownerCtx;
+	packageAllowlist;
+	packageBlocklist;
+	registrations = /* @__PURE__ */ new Set();
+	/**
+	* Create and install the invariant registry.
+	* @param ctx - Cordis context that owns the service.
+	* @param config - global enablement and package-name regex filters.
+	*/
+	constructor(ctx, config = {}) {
+		super(ctx, "invariants");
+		this.ownerCtx = ctx;
+		this.enabled = config.enabled ?? true;
+		this.packageAllowlist = compilePatterns("package_allowlist", config.package_allowlist ?? []);
+		this.packageBlocklist = compilePatterns("package_blocklist", config.package_blocklist ?? []);
+	}
+	/** Return whether one full package name passes the configured filters. */
+	selected(packageName) {
+		if (!this.enabled) return false;
+		if (this.packageAllowlist.length > 0 && !this.packageAllowlist.some((pattern) => pattern.test(packageName))) return false;
+		return !this.packageBlocklist.some((pattern) => pattern.test(packageName));
+	}
+	/**
+	* Register one package's invariant installer. The package name is reserved
+	* even when filtering disables its checks. Enabled installers run in a child
+	* fiber; failure disposes that fiber and releases the reservation.
+	* @param packageName - full npm package name that owns the contribution.
+	* @param installer - listener or startup-check installer for the child context.
+	* @returns an effect-scoped disposer for the registration.
+	*/
+	register(packageName, installer) {
+		if (packageName.length === 0 || packageName.trim() !== packageName || /\s/.test(packageName)) throw new Error("invariants: packageName must be non-blank and contain no whitespace");
+		if (this.registrations.has(packageName)) throw new Error(`invariants: package "${packageName}" is already registered`);
+		const ctx = this.ownerCtx;
+		const registrations = this.registrations;
+		registrations.add(packageName);
+		let registration;
+		try {
+			registration = ctx.effect(async () => {
+				if (!this.selected(packageName)) return () => {
+					registrations.delete(packageName);
+				};
+				const installInvariant = (childCtx) => installer(childCtx, (message) => {
+					throw new InvariantError(packageName, message);
+				});
+				try {
+					const child = ctx.plugin(installer.inject === void 0 ? installInvariant : Object.assign(installInvariant, { inject: installer.inject }));
+					try {
+						await child;
+					} catch (error) {
+						await child.dispose();
+						throw error;
+					}
+					return async () => {
+						try {
+							await child.dispose();
+						} finally {
+							registrations.delete(packageName);
+						}
+					};
+				} catch (error) {
+					registrations.delete(packageName);
+					throw error;
+				}
+			}, `invariants.register(${JSON.stringify(packageName)})`);
+		} catch (error) {
+			registrations.delete(packageName);
+			throw error;
+		}
+		return registration;
+	}
+};
+//#endregion
+export { InvariantError, InvariantRegistry, InvariantRegistry as default };

package/lib/invariant.js

@@ -0,0 +1,23 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for `@buddhilive/dsh-invariants`.
+* @module @buddhilive/dsh-invariants/invariant
+*/
+const PACKAGE_NAME = "@buddhilive/dsh-invariants";
+/** Cordis companion plugin name. */
+const name = "invariants-invariant";
+/** Service required before the companion can reserve package ownership. */
+const inject = ["invariants"];
+/**
+* No runtime invariant: registration ownership and child lifecycle are the service's mutation
+* boundary itself; observing them from the same registry would only duplicate its implementation.
+*/
+const install = () => {};
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Configurable registry for package-owned runtime invariant contributions.
+ * Every workspace package registers checks from a `./invariant` companion;
+ * ordinary package entrypoints stay independent of diagnostics.
+ *
+ * @module @buddhilive/dsh-invariants
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+import type { Inject } from '@deepseek-ai/cordis';
+import type Schema from '@deepseek-ai/schemastery';
+/** Runtime invariant selection configured on the service plugin. */
+export interface Config {
+    /** Global switch; defaults to `true`. */
+    readonly enabled?: boolean;
+    /** Case-sensitive JavaScript regex sources that admit package names; empty admits all. */
+    readonly package_allowlist?: string[];
+    /** Case-sensitive JavaScript regex sources that exclude package names after allowlist matching. */
+    readonly package_blocklist?: string[];
+}
+/**
+ * Throw a package-attributed invariant failure.
+ * @param message - violated package contract without the standard prefix.
+ * @returns never because reporting a violation throws.
+ */
+export type InvariantFailure = (message: string) => never;
+/** Install one package's checks into the registration's child context. */
+export interface InvariantInstaller {
+    /**
+     * Install the package contribution.
+     * @param ctx - child context owned by this invariant registration.
+     * @param fail - reporter bound to the registering package name.
+     * @returns nothing, or a promise settling after asynchronous checks finish.
+     */
+    (ctx: Context, fail: InvariantFailure): void | Promise<void>;
+    /** Services the child installer fiber may access. */
+    readonly inject?: Inject;
+}
+/** Thrown when a package-owned runtime invariant is violated. */
+export declare class InvariantError extends Error {
+    /** Stable machine-readable invariant failure code. */
+    readonly code: "INVARIANT";
+    /** Full npm package name that owns the violated invariant. */
+    readonly packageName: string;
+    /**
+     * Construct a package-attributed invariant failure.
+     * @param packageName - full npm package name that registered the check.
+     * @param message - violated contract, without the standard error prefix.
+     */
+    constructor(packageName: string, message: string);
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        invariants: InvariantRegistry;
+    }
+}
+/** Package-owned invariant registry with global and regex-based selection. */
+export declare class InvariantRegistry extends Service {
+    static Config: Schema<Config>;
+    private readonly enabled;
+    private readonly ownerCtx;
+    private readonly packageAllowlist;
+    private readonly packageBlocklist;
+    private readonly registrations;
+    /**
+     * Create and install the invariant registry.
+     * @param ctx - Cordis context that owns the service.
+     * @param config - global enablement and package-name regex filters.
+     */
+    constructor(ctx: Context, config?: Config);
+    /** Return whether one full package name passes the configured filters. */
+    private selected;
+    /**
+     * Register one package's invariant installer. The package name is reserved
+     * even when filtering disables its checks. Enabled installers run in a child
+     * fiber; failure disposes that fiber and releases the reservation.
+     * @param packageName - full npm package name that owns the contribution.
+     * @param installer - listener or startup-check installer for the child context.
+     * @returns an effect-scoped disposer for the registration.
+     */
+    register(packageName: string, installer: InvariantInstaller): () => void;
+}
+export default InvariantRegistry;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@buddhilive/dsh-invariants`.
+ * @module @buddhilive/dsh-invariants/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "invariants-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@buddhilive/dsh-invariants",
+  "description": "Registry service for package-owned DeepSeek Harness runtime invariants",
+  "version": "0.1.2-alpha.3",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Buddhilive/buddhi-ai-harness.git",
+    "directory": "packages/runtime-diagnostics/invariants"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2"
+  }
+}