@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/CHANGELOG.md

@@ -16,6 +16,78 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.1.0-rc.3
+
+### Summary
+
+This preview integrates the multi-provider Web workbench with project Agent
+settings, retained native history and project file editing. It also includes
+session isolation and recovery fixes, shutdown quiescence and more precise
+regression diagnostics. A new frozen package preserves the earlier rc.2 archive.
+
+### Highlights
+
+- Create Codex, Claude and DeepSeek Harness Agents from the Web workbench; retain
+  project defaults, explicit native-history restore and directory-bound drafts.
+- Upload project files and edit complete UTF-8 text with revision conflicts,
+  preserved drafts and explicit readback after uncertain writes.
+- Scope login cookies by trusted protocol and port so Web instances on different
+  ports do not overwrite each other's login or logout state. Sign in again after
+  upgrading; arbitrary SSH port remapping is not inferred.
+- Keep the native-worker discovery error and refresh guidance when a restore
+  receipt is absent, instead of failing inside the error handler.
+- Stop admitting background work when administrator shutdown is accepted, then
+  start cleanup after the HTTP response finishes or closes; preserve process
+  identity checks, exit deadlines and independently owned workers.
+- Recognize terminal regression markers split across output chunks and submit
+  fixture input once. Isolate regression HTTP connections and test-owned ports.
+- Add bounded CI task-dispatch and HTTP failure diagnostics without recording
+  request bodies, credentials or query parameters, or retrying failed requests.
+
+### Validation
+
+Release checks compare the package file set, per-file hashes and modes with the
+new frozen rc.3 archive. Source tests, browser checks and installed Harness checks
+retain their exact commit and package receipts. The regression transport changes
+isolate test fixtures; they do not establish the root cause of the earlier macOS
+connection reset. Publication, current-device upgrades and real business calls
+require separate evidence.
+
+## 1.1.0-rc.2
+
+### Summary
+
+This local Web workbench candidate adds project Agent defaults, retained native
+history with explicit closed-worker resume, and project file upload/editing.
+It is based on the 1.0.5 delivery line and retains its process identity, tmux
+snapshot and shutdown fixes. A local candidate does not establish publication.
+
+### Highlights
+
+- Create Codex, Claude and DeepSeek Harness background Agents from one Web form;
+  save project defaults without changing provider credentials or global settings.
+- Read HCC-retained native events and resume explicitly closed workers with
+  owner, session and working-directory identity checks.
+- Upload new project files up to 10 MiB and edit complete UTF-8 text up to 1 MiB,
+  with revision conflicts, preserved drafts and explicit uncertain-write readback.
+- Bind browser project requests and drafts to the selected directory identity.
+- Preserve native Web connections and control tokens when background discovery
+  overlaps Agent creation or history restore; discard stale discovery results.
+- Recheck provider initialization before rejecting an older snapshot with no
+  session ID, and retain exact project file matches when a wider search times out.
+- Stop admitting background scans as soon as an administrator stop is accepted,
+  and begin cleanup after its HTTP response finishes or closes. Keep existing
+  process identity checks, exit confirmation deadlines and independent workers.
+- Keep the existing terminal/App Server modes, readonly previews and bounded
+  reconnect behavior.
+
+### Validation
+
+The candidate is checked with the full source regression suite, a disposable
+npm installation and desktop/narrow browser flows. Real-provider entry and
+history checks have separate receipts. These checks do not establish a public
+release, a global installation upgrade or real business acceptance.
+
 ## 1.0.5
 
 ### Summary

package/docs/codex-account.zh-CN.md

@@ -0,0 +1,38 @@
+# Codex 账号与限额
+
+Web 专用 Codex App Server 和 HCC 托管的 Codex Native worker 都提供“账号与限额”折叠面板。打开对应会话后读取该执行器的账号状态，点击“刷新账号与限额”重新查询。观察窗口也可以读取；发送消息、中断或应答审批仍受当前控制权约束。Claude 和 dsh 没有此 Codex 面板。
+
+## 状态怎么理解
+
+- **需要在本地 Codex 登录**：请在运行该任务的电脑完成 Codex 登录，再刷新面板。手机或另一台电脑上的 Web 登录不等于原执行器已登录。
+- **ChatGPT 已登录**：显示 App Server 报告的套餐及可获得的用量窗口、重置时间、可用额度状态。账号已识别不等于真实模型调用已经通过。
+- **供应商自行管理认证**：当前模型供应商不要求 OpenAI 登录。HCC 无法通过此接口确认供应商凭据或剩余配额，需通过该供应商的实际任务验证。
+- **暂不可用 / 此版本未提供限额**：数据缺失或接口不支持，不能理解成零用量或无限额度。API key 和自定义供应商不会显示推测的 ChatGPT 订阅配额。
+- **历史状态，待刷新**：执行器断开或读取失败时，旧用量保留并明确标记，不能作为当前状态。账号变更则清除旧账号的配额，再读当前账号。
+
+多个配额桶分别展示，缺失的窗口保持未知；已读取的 0% 用量会正常显示。界面同时标注账号和限额的读取时间。输出流、刷新和执行器替换不会让旧请求覆盖新状态；切走再返回后，过期响应被丢弃，刷新按钮可继续使用。
+
+## 读取范围
+
+两条公开入口都是需要 Web 认证的只读 GET；请求须携带现有 API 版本头 `X-HCC-API-Version: 2`：
+
+| 会话 | 入口 | 必须匹配的身份 |
+| --- | --- | --- |
+| Web 专用 Codex | `/api/sessions/:id/codex/account` | `root`、当前 `executorId` |
+| 原生 Codex worker | `/api/sessions/:id/native/account` | `root`、当前 `generation`、`owner`、`sessionId` |
+
+身份都通过 query 参数传入。原执行器在查询期间被替换时，响应重新核对身份；旧页面不能借此查询新实例。刷新不提交 turn、task、消息或 mutation receipt，不需要控制租约 token/epoch。
+
+底层仅调用 `account/read`（`refreshToken: false`），以及适用 ChatGPT 订阅时的 `account/rateLimits/read`。账号/限额通知更新当前执行器状态；登录完成通知仍需要读取当前账号后才能显示已登录。并发刷新合并为同一读取，账号变更与通知使旧响应失效。
+
+HCC 投影只保留必要状态。邮箱、凭据 ID、token、额度余额/支出和原始账号错误不进入面板、账号事件或接口响应；账号数据不写入浏览器存储。此功能不提供登录、退出登录、设备码登录、凭据保存或外部 token 刷新。执行器本身的认证生命周期仍由 Codex 管理。
+
+## 协议与验收边界
+
+基线为已安装 Codex 0.144.6；升级检查覆盖 57 项交接契约，其中包含本功能的方法、通知和必要字段。账号 Schema 从官方生成物的 `json-schema/v2/` 读取。运行方式见 [Codex 协议升级检查](codex-protocol.md)。
+
+真实安装版 App Server 已在隔离 HOME/CODEX_HOME 中分别验证 Web 和 Native 的未登录、自定义供应商状态，共 4 项；原执行器/会话保持不变，没有模型调用，也没有读取现有账号。桌面 1440×1000、手机 390×844 和观察窗口通过真实 HTTP/SQLite/JSON-RPC 的浏览器检查；ChatGPT 配额、多窗口、账号变更与不支持接口由模拟 provider 覆盖。这些结果不等于真实 ChatGPT 订阅限额或外部账号业务验收。
+
+浏览器验收入口为 `scripts/web-codex-account-acceptance.mjs --run --output NEW_RECEIPT`，需要通过 `HCC_ACCEPTANCE_PLAYWRIGHT` 和 `HCC_ACCEPTANCE_CHROME` 指定现有 Playwright 模块和 Chrome 可执行文件。脚本使用隔离项目、tmux、HOME/CODEX_HOME 和模拟 App Server，不调用模型；默认仅显示帮助。截图与 JSON 回执写到源码目录之外。
+
+官方接口参考：<https://developers.openai.com/codex/app-server/>。当前 HCC 未实现 `account/chatgptAuthTokens/refresh`；所验收的 0.144.6 生成 Schema 将 `chatgptAuthTokens` 登录模式标为内部使用，后续版本需按其实际生成协议重新评估。

package/docs/codex-protocol.md

@@ -0,0 +1,59 @@
+# Codex protocol generation and upgrade check / 协议升级检查
+
+HCC uses the installed Codex App Server over stdio for structured Web sessions
+and independent native workers. Before upgrading that executable, generate its
+own protocol and check the HCC subset:
+
+```sh
+npm run codex:protocol -- --codex-bin /absolute/path/to/codex --out /tmp/hcc-protocol-new
+```
+
+The output directory must not exist, and its parent must exist. Without `--out`,
+the script retains a new private temporary protocol directory and prints its
+path. From an installed package, the same command is:
+
+```sh
+node /absolute/path/to/hello-cc/scripts/codex-protocol.mjs --codex-bin /absolute/path/to/codex --out /tmp/hcc-protocol-new
+```
+
+The script uses isolated HOME/CODEX_HOME directories and runs only `--version`,
+`app-server generate-ts`, and `app-server generate-json-schema`. Both generators
+include `--experimental` because HCC's interactive thread configuration exposes
+experimental permission and user-input tools. It does not start an App Server,
+call a model, read an account, or modify login/trust configuration.
+
+The output contains:
+
+- `typescript/`: official generated TypeScript bindings.
+- `json-schema/`: official generated JSON Schema documents.
+- `manifest.json`: Codex version, commands, per-file SHA-256, bundle fingerprint,
+  57 HCC contract checks, and unsupported server requests.
+
+The check covers method availability, the thread/turn notifications consumed by
+HCC, human response fields and choices, MCP form/URL identity, and read-only account/quota methods, notifications and fields.
+Account schemas are read from the official `json-schema/v2/` directory. A missing
+contract or a new required response field returns exit code 1. Unsupported
+requests remain listed separately even when the supported subset passes.
+Optional fields do not fail this gate. It is a bounded compatibility check;
+it does not validate every nested request type, replace runtime validation,
+or prove transport/model/business acceptance. Keep the manifest and rerun the
+installed acceptance scripts before accepting a new Codex version.
+
+Official generator reference: <https://developers.openai.com/codex/app-server/>.
+The local official-protocol fixture in `test/fixtures/codex-protocol-0.144.6.json`
+was extracted from installed Codex 0.144.6 on 2026-10-03. It retains method
+registries and the relevant interaction and account schemas, rather than claiming that
+all generated methods are implemented.
+
+## 中文说明
+
+升级 Codex 前运行上述命令，生成的是指定已安装版本自身的协议。协议目录必须是
+新目录；工具不覆盖旧证据。生成物包括官方 TypeScript、JSON Schema 和带版本/
+文件指纹的检查清单。
+
+当前检查覆盖 57 项交接契约：客户端方法、轮次通知、人工答复字段/可选决策、
+MCP 表单/URL 请求身份，以及只读账号/限额的方法、通知和必要字段。账号 Schema
+从官方生成的 `json-schema/v2/` 读取。缺少方法、改变关键决策或新增 HCC 无法答复的必填字段时
+返回非零退出码。账号 token 刷新、动态工具、扩展验证等未接入请求会单独列出，
+不会因为生成成功而被视为已支持。该检查没有把运行时整体迁移为强类型协议，也不
+代表新版本已完成真实模型、外部账户授权、发布或设备验收。

package/docs/commands.md

@@ -57,6 +57,15 @@ want coordination without the Web console or shims. Provider shims only join
 projects with a local `.hello-cc/runtime.json` from `hcc web`; they do not use a
 global runtime to manage arbitrary directories.
 
+One browser can sign in to multiple Web instances on different listener ports
+of the same host without refresh or logout replacing another instance's login.
+Cookie names use the protocol and actual listener port, or the fixed
+`--proxy-origin` protocol and port behind a trusted reverse proxy. Sign in again
+after upgrading; legacy cookies are neither reused nor cleared. This prevents
+accidental collisions and is not a browser security boundary. When separate SSH
+tunnels map the same remote listener port to different local ports, use separate
+browser profiles or hostnames: the direct listener cannot identify that mapping.
+
 ## Native Workers
 
 ```text

package/docs/commands.zh-CN.md

@@ -51,6 +51,13 @@ runtime 生成 URL token。用 `--local` 可只绑定 `127.0.0.1`，用 `--token
 已经由 `hcc web` 生成本地 `.hello-cc/runtime.json` 的项目，不会使用全局 runtime
 去管理任意目录。
 
+同一浏览器可以登录同一主机上不同监听端口的多个 Web 实例，刷新或退出其中
+一个不会覆盖另一个的登录。Cookie 按协议与实际监听端口命名；可信反向代理
+使用固定 `--proxy-origin` 的协议与端口。升级后需重新登录，旧版 Cookie 不会
+被复用或清除。这用于避免实例间的意外覆盖，不是浏览器安全隔离边界。
+若多个 SSH 隧道把相同的远端监听端口映射到不同本地端口，应使用独立浏览器
+配置文件或不同主机名；服务端无法从直连配置识别此端口映射。
+
 ## Native 后台 worker
 
 ```text

package/docs/macos-process-identity.md

@@ -8,6 +8,8 @@ Darwin 身份改为 `darwin:<kern.bootsessionuuid>:<UTC/C ps lstart>`。开机 U
 
 这种专用 `unknown` 同样保留 peer/binding、过期锁和缓冲文件，阻止过期任务被接管；它不会赋予 `live` 身份、续租或写权限。普通未知状态的超时策略不变。
 
+早期 Web 工作台候选使用过 `mac:<boot UUID>:<ps lstart>` 前缀。它与正式的 `darwin:` 格式交叉比较时同样保留为 `unknown`，不因前缀变化回收仍存活的候选进程；需要由原版本正常关闭后再启动新版本。
+
 升级前，先用原版本正常关闭所属 native worker/runtime，正常退出 Harness Desktop，再安装并启动新版本，使运行中的 owner 重新建立身份。保留账号配置、会话与协作数据库；不要手工改写旧身份、删除仍存活 runtime 的指针，或仅凭 PID 强行接管。若旧进程已经退出，OS 的死亡证据仍允许正常恢复。没有完整身份的其他未知状态继续使用原有策略。
 
 回归覆盖同一次开机期间 `kern.boottime` 漂移、不同 boot UUID、错误和缺失 UUID、PATH 缺失时的固定系统路径、语言环境、PID 复用、exec、真实自有 zombie，以及跨格式 runtime 指针、native 启动和 Cordis 恢复边界。

package/docs/native.md

@@ -54,6 +54,49 @@ real Web approval receipt (source checkout: `docs/verification/2026-10-02-native
 exercises this default project lookup without injecting a query function. It
 does not verify a published package or an employee installation.
 
+## Start from Web
+
+Run `hcc web`, select the project, and choose **New Agent**. Codex, Claude and
+DeepSeek Harness default to **Background Agent**, which creates a native worker
+and starts or reuses the project's independent native runtime. You do not need
+to run `hcc native start` first; the provider requirements above still apply.
+
+**Settings** can save the project default provider plus a model and an in-project
+working directory for each provider. **New Agent** prefills these values; when no
+directory is configured it uses the project root. The worker continues to share the selected
+project's HCC task and message bus. Select or add another project to work outside
+that root. **Model (optional)** can stay empty to use the provider's configured
+default; any supplied value must be supported by that provider. **Name (optional)**
+can stay empty for a generated peer name.
+
+These defaults live in the selected HCC project database and apply only to future
+Web native creations. They do not change running workers, history resume, CLI
+launches or provider account files. Concurrent saves use revision checks; reload
+and review the latest values after a conflict. Clearing the model in the creation
+form explicitly chooses the provider's own default for that one worker.
+
+**New Agent** creates a new native session. **History → HCC retained history**
+browses saved native workers and explicitly resumes workers recorded as closed.
+Resume keeps the peer and provider session ID, rechecks ownership, and starts a
+new executor. CLI resume remains available. **Advanced options** keeps the terminal
+CLI and Codex App Server paths, including their existing history controls. Shell
+uses a terminal; DeepSeek Harness uses a background worker.
+
+After creation, send prompts and inspect receipts or approvals in the same Web
+session. Creating a worker does not by itself complete a model task. Closing
+the page or stopping Web preserves the independent native runtime and worker;
+explicitly close the worker when it is no longer needed. The dated acceptance
+records below do not establish real-model or release acceptance of this new
+creation or history/resume entries. See the [Web guide](web-handoff.zh-CN.md).
+
+The **Files** entry browses saved project files and artifacts without creating a
+worker or sending file contents to a model. It provides bounded text, Markdown,
+image, PDF and static HTML previews. Explicit uploads create new project files
+without replacing existing names (up to 10 MiB); complete UTF-8 text files can be
+edited and saved with a revision check (up to 1 MiB). Conflicts and uncertain write
+results keep the draft for inspection. These actions do not attach files to a model
+conversation. See the [project file guide](web-handoff.zh-CN.md#上传与编辑项目文件).
+
 ## CLI
 
 Run commands from the project you want the workers to share, or select it with
@@ -87,7 +130,7 @@ or dsh executable. Claude uses the SDK and rejects `--binary`.
 | `hcc native deliveries` | Optional `--peer NAME`; inspect delivery receipts |
 | `hcc native events` | Required `--peer NAME`; optional `--after ID`; inspect a bounded event history |
 | `hcc native requests` | Requires `--peer NAME`; inspect pending requests bound to this executor, session and turn |
-| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets or answers |
+| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets, answers or MCP form content |
 | `hcc native interrupt` | Required `--peer NAME`; optional `--turn ID`; request interruption of the active turn |
 | `hcc native close` | Required `--peer NAME`; close that worker's owned connection/process |
 | `hcc native down` | Request worker closure and runtime shutdown; returns a stop-request receipt |
@@ -153,6 +196,13 @@ it does not attach to an existing live TUI or desktop instance. HCC cannot prove
 that an external application has independently opened the same saved session,
 so do not open the same conversation concurrently outside the owned runtime.
 
+New saved workers also retain the filesystem identity of their working
+directory. Resume requires that identity to still match, even if the path
+spelling is unchanged. Older workers without that evidence remain readable in
+HCC history but are not automatically resumable; manual review and association
+are not yet implemented. Web history marks these records as unavailable before
+the native service rechecks at admission.
+
 Native workers receive a worker-specific `HCC_ROOT`, `HCC_DB`, `HCC_PEER`, and
 `HCC_NATIVE_OWNER`. A provider hook must match the peer's native transport owner.
 Its native hook path only heartbeats that owner and renews its locks. It does
@@ -170,12 +220,18 @@ hosted responder retain conservative denial.
 
 | Provider | Hosted interaction |
 | --- | --- |
-| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, and one-call empty-form MCP tool approvals |
+| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, one-call empty-form MCP tool approvals and common MCP form fields |
 | Claude | SDK tool permission callback; approval grants the original tool input once without rewriting it |
 | dsh ACP | Offered permission choices; approval selects only `allow_once`, never `allow_always` |
 
 rc.2 may send only a tool-call ID in an ACP approval request. The adapter correlates same-session/turn tool updates to show the operation input. Missing or truncated input still allows rejection; acceptance returns `NATIVE_APPROVAL_CONTEXT_MISSING`. See dsh installed acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`).
 
+Native approval cards show the tool, command or target path and a content
+preview before the decision. Full operation details can be expanded and stay
+expanded across state refreshes. ACP approval is disabled when operation input
+or a one-time option is missing; rejection remains available. Shortened
+previews are identified, with complete parameters still available.
+
 Hosted interactive Codex threads explicitly enable
 `features.default_mode_request_user_input` and `features.request_permissions_tool`
 in their private start/resume configuration. Web-owned start/resume/fork uses
@@ -209,21 +265,23 @@ hcc native respond --peer codex-reviewer --request REQUEST_ID --decision accept
 hcc native respond --peer codex-reviewer --request REQUEST_ID --decision cancel
 ```
 
-Only `permissions`, `scope` and `answers` are accepted in that file. Permissions
+Only `permissions`, `scope`, `answers` and `content` are accepted in that file. For MCP forms, use the original field names and types, for example `{"content":{"project":"demo","count":2,"enabled":false}}`. Permissions
 can narrow the request but cannot add paths or network access; requested deny
 entries must be retained when granting filesystem access. Answer every question
-explicitly. Truncated requests can only be declined or cancelled. Arbitrary MCP
-forms, URL authentication, dynamic tools and account-token refresh requests are
-outside this responder's supported interaction set.
+explicitly. Truncated requests can only be declined or cancelled. Nested schemas, dynamic tools and account-token refresh requests remain unsupported. Correlated MCP `url` requests are supported through the Web authorization entry described below.
 
 ## Current boundaries
 
 - Existing Codex/Claude/dsh terminal sessions remain on their original transport;
   attaching to or taking over an existing TUI/Desktop session is not implemented.
-- Web discovers existing native workers in the same project and exposes messages,
-  delivery receipts, interruption, and explicit closure. Closing the page or Web
-  runtime preserves the independent native worker. Human responses are bound to
-  the current executor and turn. See the [Web handoff guide](web-handoff.zh-CN.md).
+- Web can create Codex, Claude and dsh native workers, and discovers existing
+  workers in the same project. It exposes messages, delivery receipts,
+  interruption, and explicit closure. History reads retained project events and
+  explicitly resumes closed workers; it is not the provider's complete transcript.
+  Active workers and workers without confirmed closure cannot resume from this
+  entry. Closing the page or Web runtime
+  preserves the independent native worker. Human responses are bound to the
+  current executor and turn. See the [Web handoff guide](web-handoff.zh-CN.md).
 - Codex, Claude and dsh native workers receive project- and peer-scoped HCC MCP
   configuration. Writes still require provider permission and HCC ownership checks.
 - Provider-internal `SendMessage`, subagent/team discovery, and Codex delegation
@@ -234,7 +292,8 @@ outside this responder's supported interaction set.
   task's business acceptance.
 - Adapter tests cover protocol and interaction boundaries. The authenticated
   checks below provide separate evidence for model execution and scoped MCP;
-  packaged-client installation and business acceptance remain unverified.
+  the installed-package harness below checks installation separately.
+  Stakeholder acceptance of a production workflow remains a separate step.
 
 
 ## Authenticated acceptance on October 2, 2026
@@ -255,8 +314,20 @@ survival after closing that bridge. These receipts are separate source snapshots
 
 Codex MCP tool approvals use `mcpServer/elicitation/request`. HCC submits the
 official action/content response for explicit tool confirmations without
-persisting session/always authorization. Approving arbitrary form fields or URL
-authentication is unsupported; decline and cancel remain available.
+persisting session/always authorization. Standard `form` requests support strings, numbers/integers, booleans, single-select and string-enum multi-select fields, with titles, descriptions, suggested defaults, required fields, length/numeric/selection limits and common mailbox/URI/date/date-time format checks. Optional fields are sent only when explicitly included, and booleans require a yes/no choice. Limits are 50 fields, 100 options per field, 8192 UTF-16 units per string and 65536 characters each for schema and response content.
+
+Correlated MCP `url` requests display the authorization destination and an **Open authorization page** action. Only the current controller can submit it. HCC reserves a blank tab on the explicit click and navigates after the original executor accepts the exact request; stale requests close the blank tab. Popup blocking leaves the request pending. HTTPS and loopback HTTP are allowed; credentials in the URL, other schemes, missing elicitation identities and truncated requests block acceptance while retaining decline/cancel. The new tab has no opener or referrer. Loopback destinations require a browser on the executor computer; HCC does not proxy local login callbacks to another device.
+
+Opening sends only `{ "action": "accept" }` and is not proof of successful authentication. Complete the external flow, then return to the task and follow the provider result. HCC does not invent a completion event or collect credentials in its form. URLs, device messages, opaque elicitation ids and metadata remain in the live pending request only; HCC interaction events and browser storage do not retain them. Provider-owned logs/history and the destination browser retain their existing behavior. Account login, token refresh, `openai/userVerification` and external-flow completion APIs remain separate unsupported capabilities.
+
+State refresh keeps edits in page memory. Submission, request removal or session changes clear them; a full page reload does not recover answers. HCC browser storage, events and delivery receipts do not retain form responses through the interaction-response path. Provider-owned history and model output retain their existing behavior. The owning server revalidates types and constraints and preserves executor/session/turn/request fencing. Nested objects, unrestricted arrays, unknown constraints and OpenAI extended form modes remain visibly unsupported with decline/cancel available.
+
+To reproduce browser acceptance, set `HCC_ACCEPTANCE_PLAYWRIGHT` to a Playwright module and run `node scripts/web-mcp-form-acceptance.mjs --run-browser`; optionally set `HCC_ACCEPTANCE_CHROME`. This uses simulated providers with the production HTTP/SQLite/native runtime and isolated browsers; it makes no model calls. See the source-checkout report `docs/verification/2026-10-02-mcp-form-web-validation.md`.
+
+Installed-model acceptance uses `node scripts/web-mcp-form-live-acceptance.mjs --run-live` with `HCC_ACCEPTANCE_PLAYWRIGHT`; `HCC_ACCEPTANCE_CHROME`, `HCC_ACCEPTANCE_TMUX`, `--codex-bin PATH` and `--output NEW_FILE` are optional. Without the opt-in flag it only prints help. A live run consumes quota on the currently configured model/account. Installed Codex calls a disposable stdio MCP tool; actual Web interactions accept the tool confirmation and submit the field form. The harness checks typed responses, model-written results, continuation on the same native executor after Web shuts down, and a Web-owned App Server form. It injects neither model output nor App Server requests.
+
+The HCC user directory, Codex home, project, tmux socket and browser profile are disposable. A configured external credential helper can retain its original user home for read-only credential retrieval; the original provider/model, login and configuration remain intact. Receipts include source hashes, checks, cleanup results and original config/auth/shell-config hash checks. Output paths must be new so existing receipts are preserved. Fixture logs contain synthetic form values only.
+
 
 The local validation receipt (source checkout: `docs/verification/2026-10-02-native-live-validation.json`)
 records the unit suite (785 passed, one platform-dependent skip), a 63-module
@@ -286,10 +357,104 @@ acceptance remains a separate check.
 
 For real model and browser interactions, use
 `scripts/web-native-interaction-acceptance.mjs`. It defaults to help; only
-`--run-live --provider codex|claude|all` invokes models. Set
+`--run-live --provider codex|claude|dsh|all` invokes models. Set
 `HCC_ACCEPTANCE_PLAYWRIGHT` and optionally `HCC_ACCEPTANCE_CHROME`.
 `--claude-package DIR` links an installed SDK package into the isolated worker
 project for default resolution, without injecting its query function. The
 harness checks explicit approval and rejection and continuing the original
 session. It uses existing authentication/quota, cleans test provider homes and
 processes, and never attaches to existing user conversations.
+
+
+`--provider dsh --dsh-bin /absolute/path/to/dsh` uses the installed public launcher
+and existing `DEEPSEEK_API_KEY`. The harness adds an official `tools/pre-execute`
+ask policy to a private ACP profile for only two acceptance-owned target files.
+Permission requests come from real model tool calls; no ACP request injection is
+used. It verifies an approved write, absence of a declined target, local return
+to the same session, and desktop and 390px mobile approval controls. See the
+dsh Web interaction receipt (source checkout: `docs/verification/2026-10-02-native-web-dsh-final-snapshot-interactions.json`).
+
+
+## Installed-package acceptance
+
+`scripts/native-installed-acceptance.mjs` tests an already installed HCC archive
+through the public `hcc native` commands. Install the archive and the optional
+Claude SDK into the same isolated npm prefix before running it. The script uses
+the SDK's default package resolver; it does not inject an adapter or query
+function. Running it without `--run-live` prints help and makes no model calls.
+
+```sh
+npm install --prefix /absolute/path/to/acceptance-prefix \
+  /absolute/path/to/hello-cc.tgz @anthropic-ai/claude-agent-sdk
+
+HCC_ACCEPTANCE_PLAYWRIGHT=file:///absolute/path/to/playwright/index.mjs \
+HCC_ACCEPTANCE_CHROME=/absolute/path/to/chrome \
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex \
+  --dsh-bin /absolute/path/to/dsh --archive /absolute/path/to/hello-cc.tgz \
+  --browser --task --output /absolute/path/to/receipt.json
+```
+
+The checks cover correlated replies and ACKs, duplicate submission, continuing
+context, owned close/resume and interruption for all three installed providers.
+A separate Codex check explicitly rejects a write outside the allowed sandbox. Each worker first receives a bounded task through the local user controls.
+Models then send messages through MCP along `Codex → Claude → dsh → Codex`. The browser check verifies default SDK
+loading, an explicit approved write, desktop/mobile rendering, released control
+and local continuation of the same session after closing Web. `--task` adds an
+independent file collaboration example: Codex implements invoice arithmetic,
+five contract tests run, and Claude receives the model-authored handoff and
+writes its review. This example is separate from stakeholder acceptance of a
+production workflow.
+
+Existing authentication and provider quota are used. HCC's global HOME, provider
+homes, tmux server and project are private acceptance directories. A copied
+Codex credential command preserves the caller's HOME only while retrieving
+existing credentials; the original configuration is unchanged. Owned processes
+and credential copies are removed on exit. The receipt records the archive
+SHA-256, provider versions, source hashes, browser evidence and cleanup results.
+The script neither publishes npm packages nor deploys to employee devices.
+
+Requests submitted through authenticated native CLI/Web controls are recorded
+as local user requests. Messages arriving through the shared HCC bus remain
+peer coordination data, even if the sender calls itself `web` or `shell`.
+Legacy deliveries retain peer origin during migration. This distinction does
+not grant tool permissions: writes and other gated tools still require approval.
+For delegated file work, first authorize the receiving agent's bounded task,
+then send the peer handoff.
+
+## Bounded stability acceptance
+
+Add `--stability` to installed-package acceptance to run sustained work after
+its lifecycle and cross-provider checks:
+
+```sh
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex --dsh-bin /absolute/path/to/dsh \
+  --archive /absolute/path/to/hello-cc.tgz --stability \
+  --stability-cycles 6 --stability-burst 2 --stability-idle-ms 30000 \
+  --stability-resume-every 2 --output /absolute/path/to/stability-receipt.json
+```
+
+All three providers work concurrently. Each worker receives its whole burst
+before the driver waits. Each reply must recall the original random marker
+and the previous ticket from history, checking FIFO execution and retained
+context. Duplicate submission IDs must yield exactly one reply and ACK.
+Periodic worker close/resume and one normal owned-daemon restart preserve the
+original sessions. Idle observation checks the control endpoint, pending
+requests and identity. The final audit checks persisted deliveries, database
+integrity, bounded event retention and absence of reply loops. Receipts retain
+actual replies, failure state and owned-process memory samples. Failed work is
+not replayed automatically or reclassified as successful after a retry.
+
+Defaults are six cycles, two queued messages per worker per cycle, 30 seconds
+of idle observation per cycle, and worker resume every two cycles. Limits are
+1–24 cycles, 1–4 messages, 0–300000 idle milliseconds and a 1–24 cycle resume
+interval. These options require `--stability`. This is bounded authenticated
+work, not a 24-hour soak, capacity benchmark or proof of no memory leak. A
+successful DSH resume alone does not explain earlier context fluctuations.
+
+`--stability-only` requires `--stability`. It bootstraps three real sessions and
+runs stability work while skipping the baseline interruption, command approval
+and model MCP communication scenarios. The receipt records this scope; skipped
+scenarios require separate evidence. On any failure, the driver captures current
+session snapshots, recent deliveries and events before closing owned workers.