@deepwatch/dsh-bundle 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 oxbshw
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# @deepwatch/dsh-bundle
+
+DeepWatch's capabilities, installable into a DeepSeek Harness profile you
+already run. It gives that agent senses, and an independent answer to *did that
+actually work?* — without asking you to move to a different product.
+
+The full application is [DeepWatch](https://github.com/oxbshw/watch-skill/tree/main/workspace#readme);
+this package is the part of it that composes into somebody else's Harness.
+
+## Install
+
+> **Not on npm yet.** Nothing exists under the `@deepwatch` scope. This package
+> and its thirteen siblings are published for the first time by the
+> `deepwatch-v0.1.0` release; until then the command below resolves nothing.
+> To try it from a checkout, build the candidate tarballs and compose a profile
+> against them — [getting started](../../../docs/getting-started.md).
+
+```bash
+dsh plugin --profile web add @deepwatch/dsh-bundle
+```
+
+That is the whole installation. The package declares `dsh.bundle.patch`, so DSH
+reconciles it into the profile's layer stack and applies
+[`cordis.patch.yml`](cordis.patch.yml) after its own layers.
+
+For the full experience, install the engine too:
+
+```bash
+pip install watch-skill
+```
+
+`watch-skill` is on PyPI and the newest published version is 1.4.0 — the
+release this bundle is built against. The Bridge finds the executable on
+`PATH` and connects on its own.
+
+## Stability
+
+`0.1.0` — a stable release. Stable means tested, documented and supported —
+not 1.0. This is a pre-1.0 line, and semantic versioning gives `0.x` no
+compatibility guarantee across minor versions: **a `0.MINOR` bump may change or
+remove surface, and a patch will not.** Depend on it with a tilde range
+(`~0.1.0`) if you want that difference enforced by your lockfile rather than by
+a changelog. The usual major-version promise starts at 1.0.
+
+## What you get
+
+| Tool | What it does |
+|---|---|
+| `watch_capabilities` | what Watch can actually do here, and what is missing |
+| `watch_list_sources` | the sources Watch has indexed |
+| `watch_ask_source` | ask a question about a source, answered with timestamped evidence |
+| `watch_get_evidence` | resolve a citation and check whether it is still current |
+| `watch_verify` | run a verification contract and return an independent verdict |
+
+Plus a browser half that renders verification results as themselves —
+`UNVERIFIED` looks like `UNVERIFIED`, and green is reserved for `VERIFIED` —
+and a system-prompt section telling the agent that a tool returning without
+error is not proof that anything worked.
+
+## Without Watch Core installed
+
+Watch reports itself unavailable. `auto` does not substitute a mock: the
+Bridge says `core_missing`, every Watch capability reads **Unavailable**, and
+the install step is attached to each of them. Nothing pretends to work, and the
+rest of your Workspace is unaffected.
+
+If Watch Core is installed but fails to start, that is reported as a fault too,
+with its own fix. Neither case is ever answered from the mock — a Bridge that
+did that would give you a green Workspace and no indication that nothing you
+ask will ever be answered.
+
+## Configuration
+
+| Key | Default | Meaning |
+|---|---|---|
+| `transport` | `auto` | `auto` connects the engine, and reports it unavailable when it is absent or broken — it never selects the mock. `stdio` is the same transport named explicitly. `mock` is the test-only in-process backend and must be asked for by name. |
+| `command` | `watch-skill` | the executable that starts Watch Core in Bridge mode |
+| `args` | `[bridge]` | its arguments |
+| `startupTimeoutMs` | `45000` | how long the engine has to start. Generous on purpose: a first spawn against a freshly created virtualenv pays for a cold import that a 10s backstop reported as a dead engine. |
+| `requestTimeoutMs` | `30000` | deadline for a request that carries none |
+| `dataDir` | *(empty)* | where this profile's engine keeps its Library, Memory, receipts and indexes. Empty leaves the engine its own `~/.watch-skill`, which two profiles on one machine would then share. `deepwatch setup` composes a directory inside the profile instead. It is a *default*: an exported `WATCHSKILL_DATA_DIR` still wins, and nothing is migrated into it. |
+| `autoConnect` | `true` | connect during activation rather than on first use |
+
+A deployment that requires the engine should pin `transport: stdio`, which
+never falls back and so fails loudly when it is missing. A patch replaces the
+targeted row's whole `config`, so restate every key you want to keep.
+
+## Uninstall
+
+```bash
+dsh plugin --profile web remove @deepwatch/dsh-bundle
+```
+
+The rows are purely additive, so removing the bundle leaves the host profile
+exactly as it was.
+
+## Attribution
+
+Built on DeepSeek Harness · Powered by Watch Skill. DeepWatch and Watch Skill are
+independent projects and are not affiliated with or endorsed by DeepSeek.

package/cordis.patch.yml

@@ -0,0 +1,366 @@
+# Watch for DSH — the capability bundle applied over an existing profile.
+#
+# This file is the whole distribution mechanism. A package declaring
+# `dsh.bundle.patch` in its manifest becomes a profile layer when it is
+# installed with `dsh plugin --profile <name> add @deepwatch/dsh-bundle`, and
+# the rows below are appended to whatever the profile already composes.
+#
+# It is a patch overlay, not a tree: it is applied after the dsh-base and
+# dsh-web-app layers, so it can add Watch without restating — or disturbing —
+# a single upstream row. That is why this distribution needs no fork and
+# carries no upstream patches.
+#
+# Rows are additive on purpose. Removing this bundle removes Watch and leaves
+# the host profile exactly as it was.
+
+- insert:
+    # The Bridge to Watch Core. Everything Watch can perceive, prove or
+    # remember reaches the Harness through this one service.
+    #
+    # `auto` connects the real engine when `watch-skill` is installed. It does
+    # not fall back to the mock, and never has an outcome other than a real
+    # child process: a missing engine is reported as `core_missing` and one
+    # that fails to start as `handshake_failed`, each carrying the step that
+    # fixes it, and the Workspace stays fully usable with Watch features
+    # disabled. The fallback did exist, and is what let a machine with no
+    # engine report itself connected while refusing every real request — which
+    # the surfaces drew as an empty result nobody could tell from "nothing
+    # indexed yet".
+    #
+    # `stdio` is the same transport named explicitly. `mock` is the in-process
+    # test backend and has to be asked for by name; everything it touches is
+    # flagged `isTestOnlyMock`, so no screen can present it as data. A patch
+    # replaces the
+    # targeted row's whole `config`, so an overlay must restate every key it
+    # wants to keep:
+    #
+    #   - id: watch-core-bridge
+    #     config:
+    #       transport: stdio
+    #       command: watch-skill
+    #       args: [bridge]
+    #       cwd: ''
+    #       startupTimeoutMs: 45000
+    #       requestTimeoutMs: 30000
+    #       autoConnect: true
+    - id: watch-core-bridge
+      name: '@deepwatch/dsh-core-bridge'
+      config:
+        transport: auto
+        command: watch-skill
+        args: [bridge]
+        cwd: ''
+        # 45s, not 10s. This is the backstop for "the engine cannot answer at
+        # all", and 10 seconds could not tell that apart from "the engine is
+        # starting for the first time". A fresh `deepwatch setup` creates the
+        # Core virtualenv moments earlier; the first `watch-skill bridge` then
+        # pays for a cold Python import of thousands of files a Windows
+        # security scanner has never seen, and exceeded 10s on a clean machine.
+        #
+        # The product called that failure: Diagnostics reported Watch Core
+        # failed with `core_timeout`, the reconnect breaker opened, and the
+        # session never recovered — on an installation that was completely
+        # healthy and connected in under three seconds on its second start.
+        #
+        # A generous backstop costs nothing when the engine is well, because
+        # the handshake resolves as soon as it lands. It is paid only when the
+        # engine is genuinely dead, which is already a degraded case.
+        startupTimeoutMs: 45000
+        requestTimeoutMs: 30000
+        autoConnect: true
+
+    # The Host's half of the routing preflight, and the store the binding
+    # screens write through.
+    #
+    # A composer that refuses to submit is an affordance -- it lives in a
+    # browser tab and the RPC it declines to call stays callable. This is the
+    # other half: it reads the same stored decisions and refuses a model
+    # request whose route nobody in this profile chose, so a stale tab or a
+    # caller that skipped the screens is stopped before the provider is
+    # reached rather than after.
+    #
+    # It injects `llm` and nothing else. Injecting `settings` would park it on
+    # a deployment that composes no settings file, and a routing check that
+    # quietly stops running is worse than one that is not there.
+    #
+    # The `/routing` subpath, not the package root. The root re-exports the OCR
+    # worker and carries no `apply`; the Loader refuses a row whose module
+    # exports none with "invalid plugin", and takes the whole plugin tree down
+    # with it. `scripts/verify-bundle.mjs` now imports every row's module and
+    # checks for `apply`, because that failure looks exactly like a composition
+    # problem and is three minutes of provisioning away from being seen.
+    # The one place that knows who asked for a provider request, and which
+    # routes have actually been proved.
+    #
+    # A row of its own, ahead of everything that injects it, because there has
+    # to be exactly one. The routing guard used to construct it, and a Cordis
+    # service is reflected per scope — so the guard and the read plane read two
+    # different objects, and the single request allowed to prove a route was
+    # refused while the guard insisted nothing had asked for it. One owner,
+    # injected by both halves, is the fix.
+    - id: watch-provenance
+      name: '@deepwatch/dsh-technology/provenance'
+
+    # Watch, listening at the boundary every tool call already goes through.
+    #
+    # An owner evaluation ran 76 tool calls through this Host and Watch recorded
+    # none of them -- not a write that failed, but nothing listening: every
+    # Watch capability was a tool the model could choose to call, and the model
+    # never chose to. A product whose subject is evidence produced none, and the
+    # only thing resembling a verdict was a file the model wrote and then reread.
+    #
+    # `@deepseek-ai/dsh-tools` publishes the dispatch lifecycle, so this needs no
+    # fork and no per-tool patch. A row of its own, ahead of what injects it,
+    # because a Cordis service is reflected per scope and a ledger two halves
+    # disagree about is worse than no ledger.
+    - id: watch-observation
+      name: '@deepwatch/dsh-technology/observation'
+
+    # What one turn may spend, measured against the run that made this
+    # necessary: 47 model rounds, 76 tool calls, three subagents, nine minutes
+    # and 2.97M tokens of processed context at a 97% cache hit rate. The cache
+    # is why nobody stopped it -- the price signal that normally ends a runaway
+    # had been optimised away.
+    #
+    # Every hard limit sits well clear of that run. A budget that fires during
+    # ordinary work teaches people to raise it, and then it is not a budget.
+    - id: watch-budget
+      name: '@deepwatch/dsh-technology/budget'
+      config:
+        enforce: true
+
+    # The route a delegated child inherits, and the preflight that stops a
+    # child being created when there is not one.
+    #
+    # Upstream inherits `parent.options.provider`, which is right for a
+    # deployment that puts its route there. This one resolves a route per
+    # request from the binding a person made, so the parent has nothing in
+    # `options` to pass down and three subagents died on their first step with
+    # "has no provider/model". `agent/request` is the waterfall upstream's own
+    # error names for exactly this, and filling it there fixes parent and child
+    # with one rule.
+    - id: watch-delegation
+      name: '@deepwatch/dsh-technology/delegation'
+
+    - id: watch-routing
+      name: '@deepwatch/dsh-technology/routing'
+      config:
+        enforce: true
+
+    # The model-facing surface: Watch's senses and its proof step as ordinary
+    # Harness tools, plus the system-prompt section that tells the agent a
+    # tool returning without error is not a verified outcome.
+    #
+    # This row injects `watchCore`, so the Loader resolves it only after the
+    # Bridge exists. Removing the Bridge row leaves the agent with no Watch
+    # tools at all rather than with tools that fail when called.
+    - id: watch-tools
+      name: '@deepwatch/dsh-tools'
+      config:
+        queryTimeoutMs: 120000
+        verifyTimeoutMs: 60000
+        # A read is quick. The first read of a session used to hang: the
+        # embedding stack was imported lazily on a Bridge worker thread, where
+        # loading numpy's C extension deadlocks, and `watch_search_sources`
+        # never answered at all the first time it was asked. Core now warms
+        # that stack at startup on the thread that owns the server, and a
+        # first search in a fresh engine answers in under a second.
+        #
+        # `coldReadTimeoutMs` is the backstop for a box where that warm-up was
+        # skipped and the first read pays for the import itself. Deliberately
+        # not larger: waiting three minutes on a request that is never coming
+        # back is worse than reporting it.
+        readTimeoutMs: 30000
+        coldReadTimeoutMs: 60000
+        # Where execution receipts are journalled, beside the memory store and
+        # for the same reason: a record the Host makes about your workspace
+        # belongs in your profile, not in a process that is about to exit.
+        #
+        # Without it receipts are live-only. A room holding thirteen of them
+        # was restarted and the Library afterwards returned one — the receipt
+        # made after the restart — and Refresh could not bring the rest back,
+        # because Refresh re-reads what is on disk and they never were.
+        receiptsDirectory: .watch/receipts
+
+    # The browser half. These are `dsh.client` rows, so the modules package
+    # scans them into the boot graph and serves their bundles under /plugins.
+    #
+    # Every one of them registers into a slot DSH itself renders. That is not a
+    # stylistic preference: `slots.register` accepts any name, so a registration
+    # into a slot nothing renders loads cleanly, passes its tests and draws
+    # nothing at all. `scripts/verify-slots.mjs` checks each name against
+    # `inventory/dsh-slots.json`, which is extracted from the pinned packages'
+    # own `renderSlot` call sites.
+
+    # The product identity. It fills the same generic brand slots the official
+    # row fills, and claims the document title and favicon at runtime — the
+    # HTML shell is a built DSH artifact and is not forked.
+    - id: watch-brand
+      name: '@deepwatch/dsh-client-brand'
+
+    # The browser end of the read plane: Watch's generated Typert Remote,
+    # mounted into `ctx.remote`.
+    #
+    # Its own row rather than a line inside the Library, and the reason is a
+    # dependency cycle rather than taste. `@deepwatch/dsh-tools` is the Host
+    # that answers these reads, and it reads the Library's index — so tools
+    # depends on the Library. When the Library's browser half also mounted the
+    # generated contribution, the Library depended on tools in return, and no
+    # build order can satisfy a package that cannot compile until a file
+    # generated from its own dependent exists.
+    #
+    # This row must come before `watch-library`: the Library's browser half
+    # injects `remote.watchQuery`, so without the mount it parks rather than
+    # drawing a tab whose search answers from nothing.
+    - id: watch-client-remotes
+      name: '@deepwatch/dsh-client-remotes'
+
+    # Evidence: keyed tool views, plus the Compare mode.
+    #
+    # It reads what the conversation already carries and makes no Host call at
+    # all, which is why it can render a verdict correctly even when the Bridge
+    # is on its mock backend: there is no second source of truth to fall out of
+    # sync. Remove this row and the Watch tools still work — their results
+    # simply render in DSH's generic tool card.
+    - id: watch-client-evidence
+      name: '@deepwatch/dsh-client-evidence'
+
+    # The shell: the Watch mode, the sidebar section, the status strip in the
+    # session header, the sensory timeline and the composer panel.
+    - id: watch-workspace
+      name: '@deepwatch/dsh-workspace'
+
+    # The Live mode.
+    - id: watch-live
+      name: '@deepwatch/dsh-live'
+
+    # The Library mode.
+    - id: watch-library
+      name: '@deepwatch/dsh-library'
+
+    # The Memory mode, and the "why was this remembered?" chip.
+    - id: watch-client-memory
+      name: '@deepwatch/dsh-client-memory'
+
+    # The Technology & Capability Center: role bindings, engines, sources,
+    # memory, verification, diagnostics and about, added to DSH's own settings
+    # panel. `settings.section` is a list, so upstream's General, Models and
+    # Plugins sections are untouched and keep the top of the list.
+    - id: watch-client-settings
+      name: '@deepwatch/dsh-client-settings'
+
+    # Durable, correctable memory. `off` by default and deliberately so:
+    # durable memory about a person is not something a deployment should
+    # acquire because nobody changed a setting.
+    #
+    # Turn it on by restating this row's whole config with a different mode:
+    #   'off'              nothing written, nothing recalled
+    #   'session_only'     kept in memory only; never reaches a later session
+    #   'local_personal'   a local ledger on disk for this profile
+    #   'workspace_shared' knowledge and decisions shared; personal taste is not
+    #
+    # The mode values are quoted deliberately. YAML reads a bare `off` as the
+    # boolean false, which would silently become an invalid mode rather than
+    # the one written here.
+    #
+    # The ledger is the authority and every projection — taste.md, index.md,
+    # log.md — is rebuilt from it, which is what makes Forget remove a memory
+    # rather than hide it. The ledger is not yet encrypted at rest; on Desktop
+    # it will move behind the OS keychain, and until then `local_personal`
+    # means a plain file with the profile's own permissions.
+    - id: watch-memory
+      name: '@deepwatch/dsh-memory'
+      config:
+        mode: 'off'
+        directory: .watch/memory
+        inferredThreshold: 0.8
+        tokenBudget: 600
+        writeProjections: true
+
+# The inherited default model selection, emptied.
+#
+# The base layer composes `agent-default-model` with `deepseek-official` /
+# `deepseek-v4-flash`, which is the right default for the Harness and the wrong
+# one for this distribution. A person who had installed DeepWatch, saved an
+# OpenRouter credential and never chosen a model still had that pair sitting in
+# their composer as though they had picked it -- and their first prompt was
+# routed to DeepSeek, which failed on a credential they had never been asked
+# for and left a failed turn behind.
+#
+# Emptying it is a *configuration* change, not a removal. The row stays
+# mounted, because `@deepseek-ai/dsh-host-apiproxy` hard-injects
+# `agentDefaultModel` and disabling it would park the whole API gateway. What
+# changes is that the default names no route, and upstream's own admission
+# boundary refuses a turn whose provider no adapter serves -- so an
+# unconfigured Chat is refused before a durable turn, a trajectory or a
+# provider request exists, by the Harness's own enforcement rather than by
+# anything this distribution has to intercept.
+#
+# DeepSeek is not removed and is not disfavoured. `llm-deepseek` stays
+# composed, `deepseek-official` stays in the picker, and choosing it is one
+# click. What it stops being is *chosen for you*.
+#
+# `name:` is deliberately absent. A patch that carries one is compared for
+# equality against the target row and SKIPPED with a warning when it differs
+# (vendor/include: "patch: name mismatch for %C ... skipping"), so an upstream
+# rename would silently restore the DeepSeek default. Targeting the id alone
+# cannot be skipped, and `tests/default-model.test.mjs` pins this row to the
+# pinned baseline so a bump that changes its shape fails loudly instead.
+- id: agent-default-model
+  config:
+    provider: ''
+    model: ''
+
+# The dedicated DeepSeek adapter, switched off.
+#
+# Not because DeepSeek is unwelcome -- it stays in the catalogue and stays one
+# click away -- but because it was the only provider in this distribution that
+# did not have to be chosen. `llm-deepseek` registers `deepseek-official` at
+# plugin load, unconditionally and with no credential, and three things follow
+# from that which nothing else in the product would tolerate:
+#
+#   - a route exists that nobody configured, so the Harness's own pre-turn
+#     admission check passes for it and a stale or careless client can spend a
+#     turn on a provider the person never set up. That is exactly how the first
+#     prompt in Sayed's profile reached DeepSeek;
+#   - `ui-settings-models` renders an "Add an API key to get started ---
+#     Configure the official DeepSeek provider" dialog whenever that row exists
+#     and holds no credential, so a fresh profile met a second first-run modal
+#     asking for a key to a provider it had not chosen. Its own readiness
+#     reports `adapter-absent` and skips the dialog when the row is gone, which
+#     is the supported way to answer it;
+#   - and it made DeepSeek a special case: every other provider is configured
+#     through Models & Providers, and one was configured by existing.
+#
+# `@earendil-works/pi-ai` carries `deepseek` in the same catalogue as the other
+# thirty-six routes, and `llm-pi-ai` declares its whole installed catalogue as
+# configurable from the moment it mounts -- dormant or not. So DeepSeek remains
+# selectable, with the same endpoint and the same `DEEPSEEK_API_KEY`, reached
+# the same way as Anthropic or OpenRouter. What it stops being is the one
+# provider that configures itself.
+#
+# `disabled: true` on a targeted id is upstream's own mechanism, so nothing
+# here is patched or forked, and removing this bundle restores the row.
+- id: llm-deepseek
+  disabled: true
+
+# The official brand row, switched off.
+#
+# This is the single entry in the parity register marked
+# `intentionally_replaced`, and this is where the replacement takes effect.
+# Both halves are needed, and neither alone is enough:
+#
+#   - `renderSlot("sidebar.brand.mark", …, { fallback: <official mark> })` means
+#     an unfilled brand slot still draws DeepSeek's mark. Registering the Watch
+#     brand is what displaces the fallback.
+#   - `ui-brand-official` *also* registers into those slots. Left enabled, both
+#     marks would be drawn.
+#
+# `disabled: true` on a targeted id is upstream's own mechanism — the same one
+# `DSH_TELEMETRY_DISABLED` uses — so nothing here is patched or forked.
+#
+# Attribution is not what is being removed. It moves to `sidebar.footer.action`,
+# where the Watch brand plugin renders "Built on DeepSeek Harness · Extended by
+# Watch Skill" together with the independence disclosure, on every screen.
+- id: ui-brand-official
+  disabled: true

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@deepwatch/dsh-bundle",
+  "version": "0.1.0",
+  "description": "DeepWatch's capabilities, installable into an existing DeepSeek Harness profile",
+  "type": "module",
+  "license": "MIT",
+  "author": "Sayed Allam",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oxbshw/watch-skill.git",
+    "directory": "workspace/packages/watch/bundle"
+  },
+  "homepage": "https://github.com/oxbshw/watch-skill/tree/main/workspace#readme",
+  "bugs": {
+    "url": "https://github.com/oxbshw/watch-skill/issues"
+  },
+  "keywords": [
+    "deepwatch",
+    "deepseek-harness",
+    "watch-skill",
+    "bundle",
+    "plugin"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml",
+      "variants": {
+        "full": "./cordis.patch.yml",
+        "media": "./variants/media.patch.yml",
+        "browser": "./variants/browser.patch.yml",
+        "memory": "./variants/memory.patch.yml",
+        "document": "./variants/document.patch.yml"
+      }
+    }
+  },
+  "files": [
+    "cordis.patch.yml",
+    "variants/*.yml",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@deepwatch/dsh-client-brand": "^0.1.0",
+    "@deepwatch/dsh-client-evidence": "^0.1.0",
+    "@deepwatch/dsh-client-memory": "^0.1.0",
+    "@deepwatch/dsh-client-remotes": "^0.1.0",
+    "@deepwatch/dsh-client-settings": "^0.1.0",
+    "@deepwatch/dsh-core-bridge": "^0.1.0",
+    "@deepwatch/dsh-library": "^0.1.0",
+    "@deepwatch/dsh-live": "^0.1.0",
+    "@deepwatch/dsh-memory": "^0.1.0",
+    "@deepwatch/dsh-technology": "^0.1.0",
+    "@deepwatch/dsh-tools": "^0.1.0",
+    "@deepwatch/dsh-trajectory": "^0.1.0",
+    "@deepwatch/dsh-workspace": "^0.1.0"
+  }
+}

package/variants/browser.patch.yml

@@ -0,0 +1,34 @@
+# Watch Browser — observe a page, act on it, and prove what happened.
+#
+# Media perception plus the operator loop. This is the bundle for the case the
+# product exists for: the agent clicks something, and Watch establishes whether
+# the world actually changed, rather than reporting that the click succeeded.
+#
+# Memory is absent on purpose. Verification needs no memory, and a bundle that
+# quietly acquired durable memory about a person because it was convenient is
+# the failure ADR-006 exists to prevent.
+
+- insert:
+    - id: watch-core-bridge
+      name: '@deepwatch/dsh-core-bridge'
+      config:
+        transport: auto
+        command: watch-skill
+        args: [bridge]
+        cwd: ''
+        # See cordis.patch.yml: a first cold start outruns 10s.
+        startupTimeoutMs: 45000
+        requestTimeoutMs: 30000
+        autoConnect: true
+
+    - id: watch-tools
+      name: '@deepwatch/dsh-tools'
+      config:
+        queryTimeoutMs: 120000
+        verifyTimeoutMs: 60000
+
+    - id: watch-client-evidence
+      name: '@deepwatch/dsh-client-evidence'
+
+    - id: watch-trajectory
+      name: '@deepwatch/dsh-trajectory'

package/variants/document.patch.yml

@@ -0,0 +1,35 @@
+# Watch Document — reading text off things, with the engine family behind it.
+#
+# OCR and document perception: the lightweight local route by default, the
+# heavier engines available where the hardware and the licence allow. The
+# Technology Centre row is what makes engine state truthful here — presence on
+# disk is not readiness, and this bundle is the one where that distinction is
+# most likely to be tested.
+#
+# No browser operation and no memory. A document reader that could also click
+# things is a larger grant than the name implies.
+
+- insert:
+    - id: watch-core-bridge
+      name: '@deepwatch/dsh-core-bridge'
+      config:
+        transport: auto
+        command: watch-skill
+        args: [bridge]
+        cwd: ''
+        # See cordis.patch.yml: a first cold start outruns 10s.
+        startupTimeoutMs: 45000
+        requestTimeoutMs: 30000
+        autoConnect: true
+
+    - id: watch-tools
+      name: '@deepwatch/dsh-tools'
+      config:
+        queryTimeoutMs: 120000
+        verifyTimeoutMs: 60000
+
+    - id: watch-technology
+      name: '@deepwatch/dsh-technology'
+
+    - id: watch-client-evidence
+      name: '@deepwatch/dsh-client-evidence'

package/variants/media.patch.yml

@@ -0,0 +1,33 @@
+# Watch Media — perception over recorded and live media, and nothing else.
+#
+# The narrowest useful bundle. It gives an agent the ability to look at a video
+# or a stream and answer questions with citations, and deliberately stops
+# there: no browser operation, no durable memory, no verification of world
+# effects. A deployment that only ever needs "what happened in this recording"
+# should not be asked to accept the rest.
+#
+# Every variant in this directory installs the same way as the full bundle and
+# is checked by the same gate, so a narrow bundle cannot drift into referencing
+# a package the workspace does not have.
+
+- insert:
+    - id: watch-core-bridge
+      name: '@deepwatch/dsh-core-bridge'
+      config:
+        transport: auto
+        command: watch-skill
+        args: [bridge]
+        cwd: ''
+        # See cordis.patch.yml: a first cold start outruns 10s.
+        startupTimeoutMs: 45000
+        requestTimeoutMs: 30000
+        autoConnect: true
+
+    - id: watch-tools
+      name: '@deepwatch/dsh-tools'
+      config:
+        queryTimeoutMs: 120000
+        verifyTimeoutMs: 60000
+
+    - id: watch-client-evidence
+      name: '@deepwatch/dsh-client-evidence'

package/variants/memory.patch.yml

@@ -0,0 +1,31 @@
+# Watch Memory — durable, correctable memory without perception.
+#
+# For a deployment that wants an agent to remember how somebody works and does
+# not want it watching anything. The Bridge is still present, because memory
+# projections and the Context Compiler are Watch's, but no sensory tools are
+# mounted: there is nothing here that can look at a screen.
+#
+# `mode` is 'off' as it is everywhere else. Installing a memory bundle is not
+# consent to remember things about a person; changing the mode is.
+
+- insert:
+    - id: watch-core-bridge
+      name: '@deepwatch/dsh-core-bridge'
+      config:
+        transport: auto
+        command: watch-skill
+        args: [bridge]
+        cwd: ''
+        # See cordis.patch.yml: a first cold start outruns 10s.
+        startupTimeoutMs: 45000
+        requestTimeoutMs: 30000
+        autoConnect: true
+
+    - id: watch-memory
+      name: '@deepwatch/dsh-memory'
+      config:
+        mode: 'off'
+        directory: .watch/memory
+        inferredThreshold: 0.8
+        tokenBudget: 600
+        writeProjections: true