@yugoo-design/dsh-design-system-dsh 0.1.0-beta.1 → 0.1.0-beta.3

package/README.md

@@ -12,7 +12,7 @@ The single external DeepSeek Harness installation bundle for Yugoo Design. Offic
 `dsh-design-skills-web-app` contains one Mindset plus self-contained Bundle
 files, including optional ordinary Agent-facing scripts. Generic Core confines
 their execution and gives them no Design Files or Git authority.
-The official Web App Kit's 14 Bundles now declare their presentations in
+The official Web App Kit's 15 Bundles now declare their presentations in
 `panel.yaml`, using shared components supplied by `dsh-design-panel`.
 `dsh-design-provider-web-app` remains in this distribution for explicitly selected
 native presentations and comparison; it is not the default presentation contract
@@ -22,20 +22,28 @@ depend on the Web App Kit or its native provider. A Kit can revise its validated
 panel definition or locale content without rebuilding the Host; introducing a
 new shared runtime component or native UI surface requires a runtime release.
 Installed-package native-equivalence acceptance remains separate from this
-source declaration and is not established by the presence of 14 definitions.
+source declaration and is not established by the presence of 15 definitions.
 
-## Daily entry and compatibility
+## Daily entry
+
+DSH Web and Desktop use the same Core message producers. Plugin-authored
+context, notices and delegated tasks carry the producer-owned source kind
+`yugoo-design`; explicit user commands retain `kind: user`. Delivery still uses
+the existing non-waking `agent.inject()` or delegated `followup()` operation.
+The plugin does not rewrite Session history, replace the Host codec or translate
+retired `kind: plugin` messages at runtime. UI presentation and Session protocol
+version are separate compatibility boundaries.
 
 Use `/yugoo` in the existing DSH conversation to open the project command help,
 or `/yugoo new <name>`, `/yugoo open <id|name|path>` and `/yugoo status` to manage
 Design Projects. These commands share the existing project service and native
 conversation binding; they do not start a second host or change authentication.
 
-`/design` remains a compatibility alias to the same handler when that name is
-available. If another plugin already owns `/design`, Yugoo Design leaves it
-untouched and warns that the alias is unavailable. A conflict on the primary
-`/yugoo` entry fails registration explicitly. Panel actions use `/yugoo` so they
-cannot accidentally invoke a different plugin's `/design` command.
+`/yugoo` is the only registered project entry. Yugoo Design does not register
+`/design`, even when that name is free, and does not offer it as a compatibility
+alias. Another plugin's command remains untouched. A conflict on `/yugoo` fails
+registration explicitly. Panel actions use `/yugoo`; internal service, tool and
+package identifiers are not additional user command aliases.
 
 ## Installation target and current package composition
 
@@ -43,11 +51,18 @@ The product name is **yugoo-design**. Source package and Loader identifiers rema
 `dsh-design-*`; public npm exports use the `@yugoo-design` scope. The brand does
 not rename imports or Loader identities.
 Official DSH is an external, separately installed host and is not one of the
-plugin's system packages. Its agents supply model execution, questions,
+plugin's system packages. Its agents supply generative model execution, questions,
 subagents and search; installing this plugin must preserve the user's existing
 model/search configuration and must not ask for a plugin-specific search key.
-
-The current official DSH distribution comprises these ten system packages.
+Design Knowledge uses a separate local CPU embedding model; it does not require
+a GPU or replace the host's generative models.
+
+The current published `0.1.0-beta.2` distribution retains the ten system packages
+listed below
+and adds `yugoo-design-git-native` (`packages/git-native`) as a Core runtime
+dependency: eleven Yugoo package artifacts in the registry release set.
+The native helper does not add a DSH Loader registration. The selected release
+manifest determines the complete exact dependency set.
 The directory column identifies the existing source package, not an end-user
 checkout or build requirement.
 
@@ -65,21 +80,25 @@ checkout or build requirement.
 | `dsh-design-studio-dsh` | `packages/studio-dsh` | DSH Studio integration |
 
 The Knowledge provider selects the official `@ladybugdb/wasm-core` at exact
-version **`0.21.1`**. This is a third-party runtime dependency, not an eleventh
-system package or a replacement DSH application. Do not substitute the earlier
-WAL fork, an unpublished fixture alias, or `latest`.
+version **`0.21.1`**. This is a separately pinned third-party runtime dependency,
+not one of the eleven Yugoo package artifacts or a replacement DSH application.
+Do not substitute the earlier WAL fork, an unpublished fixture alias, or `latest`.
 
 ### Agent-led installation and local release files
 
-After publication, copy the [DSH-specific installation prompt](../companion/HOSTS.md#install-or-update-deepseek-harness)
-into the existing host conversation. The Agent acquires the exact product installer
+Copy the [shared installation prompt](../companion/HOSTS.md#default-prompt-any-supported-host)
+into the existing DSH conversation, or explicitly use the
+[DSH override](../companion/HOSTS.md#install-or-update-deepseek-harness).
+The Agent checks release availability, acquires the exact product installer
 from npm and uses its `release-hosts.json` to install the aggregate and internal
-modules through the official host. Users do not acquire all ten modules manually.
+modules through the official host. Users do not install the internal modules or
+native helper manually.
 Use the accepted public installation guide and exact release manifest; the host Agent should:
 
 1. Identify the installed official DSH version and check the selected release's
    required host peers, including Core's Cordis minimum `^4.0.2`.
-2. Resolve the exact ten-package release and Ladybug `0.21.1`, then install the
+2. Resolve the selected release's complete exact dependency set, including any
+   declared native Git helper and pinned Ladybug `0.21.1`, then install the
    DSH bundle through the official host's package/bundle interface. Preserve
    existing user profiles, models and search settings.
 3. Confirm the Loader registrations and open a Design Project with its pinned
@@ -87,26 +106,108 @@ Use the accepted public installation guide and exact release manifest; the host
    the canonical data and checkpoint. Verify KAG and GRA through actual host
    execution, reporting any capability or credential limitation explicitly.
 
-The npm scope is `@yugoo-design` and the first beta target is `0.1.0-beta.1`,
-with dist-tag `beta`; `latest` stays unchanged. Companion and all ten owned DSH
-packages use that same exact npm version. Native suite and Kit/Bundle content
-versions do not change with the npm prerelease. The packages are being prepared
-and are not yet published; the registry-based route still needs acceptance.
+The CPU-first installation policy applies before acquiring the product installer
+and its DSH dependencies. Follow the
+[shared installation entry](../companion/HOSTS.md#agent-led-installation-and-updates)
+to use `ONNXRUNTIME_NODE_INSTALL_CUDA=skip` while retaining normal dependency
+lifecycle scripts. Skipping extra CUDA downloads does not prepare embedding
+model files: use the exact model cache or explicit download policy documented by
+the acquired version. Loader registration, a database opening and a working host
+LLM do not establish semantic indexing. GPU acceleration is outside the
+first-release scope; this policy does not change the published
+beta.2 archives or their installation acceptance.
+
+The npm scope is `@yugoo-design`. As checked on 2026-10-17 UTC, metadata is verified
+for the product installer `@yugoo-design/companion@0.1.0-beta.3` and all eleven DSH
+packages at `0.1.0-beta.2`, including `@yugoo-design/yugoo-design-git-native`.
+Their `beta` tags select those exact versions. Only the native Git helper has
+`latest` at beta.2; Companion and the original ten DSH packages retain beta.1.
+Eight archives were fully downloaded and matched their digests. Four transfers
+(native Git helper, Panel, Web App provider and Companion) returned HTTP 200 but
+timed out after 90 seconds with partial bodies (`curl` exit 28), not digest
+mismatches. Full twelve-archive verification is incomplete; cold registry
+installation and native-host installation/update acceptance remain unverified.
+The separate cache-only Companion installation result is bounded in the
+[preview status](../../docs/wiki/preview-status.md).
+Normal Design versioning uses the bundled native Git runtime, without
+system Git, on Windows x64 MSVC and Linux x64 GNU; other platforms are unsupported.
+System Git remains separate for source development and explicit CLI diagnostics.
+
+At the historical 2026-10-14 check, the product installer
+`@yugoo-design/companion@0.1.0-beta.2` and all ten owned DSH packages at
+`0.1.0-beta.1` were publicly available, with anonymous downloads matching the
+reviewed archives. Companion's `beta` pointed to beta.2 and initial `latest`
+remained beta.1; DSH's two tags pointed to beta.1. If a selected release is missing,
+report it rather than partially installing a guessed set. Native suite and Kit/Bundle content versions
+do not change with the npm prerelease. Registry acquisition, native installation
+and functional acceptance remain separate checks.
 The supplied local files below are for pre-publication preflight, rather than
 the main public installation tutorial. A package-manager exit code, Loader mount or
 MCP listing alone does not prove that Bundle generation, Panel saving, GRA and
 KAG work. The developer launcher and clone/build steps are not the user install
 path; Companion hosts use their own adapters rather than this DSH bundle.
 
-### Current Windows host admission
+### Current DSH host admission
 
-Official Windows DSH **`0.2.0-rc.2`** is the current release target. The affected
-host peer declarations append that exact prerelease to their existing supported
-ranges; they do not admit unknown RCs, `0.2.0` stable, or React 19. The earlier
-`0.1.2-rc.1` development pins and historical local results below stay unchanged.
+Official DSH Web and Desktop **`0.2.0-rc.2`** are the current release target. The affected
+host peers and development SDK pins require exact `0.2.0-rc.2`. The current
+Agent setup and lifecycle APIs differ from earlier releases, so older versions
+are no longer declared compatible; unknown RCs, `0.2.0` stable and React 19 are
+not admitted. Historical local results below
+retain their original versions and are not current-host acceptance evidence.
 Loader compatibility uses its own prerelease policy and is not a substitute for
 the package manager's strict peer resolution.
 
+Run Core's `test:dependency-baseline` and `test:consumer-dependency-baseline`
+after building the workspace dependencies to check exact SDK pins, strict
+peers and shared Cordis identity. Compilation and `typecheck` are separate
+checks. The focused V4 gate requires an explicit `DSH_TEST_WEB_ANCHOR` naming
+an installed Host package manifest, or `DSH_TEST_ASAR` naming the actual
+Desktop archive. The content-upgrade SDK test uses the Web anchor. These
+read-only SDK inputs and scripted-loop tests do not establish rendered UI,
+native model execution or recovery of an already failing live conversation.
+
+The official RC2 factory supplies `setup(ctx, agent)` with an independent
+child scope. Producer and Worker adapters capture only the authorized parent
+tool definitions before creation, close inherited globals, then register those
+exact definitions and their own confined capabilities in the child scope.
+They do not require the historical `inheritParentAgentScope` Host patch.
+Initialization uses the Host's awaited `agent/created` event. These public API
+adaptations replace our need for the old fork behavior; they are not a claim
+that the official Host incorporated that patch.
+
+Bundle result reporting keeps execution provenance separate from the derived
+U/S/T assessment. Worker completion is reported only from the current Host's
+bounded, invocation- and conversation-bound observations, with the exact child
+lifecycle and Host-computed receipt checked against the accepted publication's
+canonical reference and artifact bytes. A rejected call, a missing or truncated
+observation, a Producer fallback, or a model's assessment text is not a successful
+Worker receipt. Missing provenance remains explicitly unverified; persisted
+Bundle content is not rolled back because execution reporting is unavailable.
+These checks do not reconstruct lost in-memory observations after a restart or
+claim that a live native-model reporting regression has passed.
+
+Background G/R/A reviews use the same public Agent factory with a child-local
+read-only capability. The current adapter admits native `spawn` only; another
+configured provider fails explicitly. It inherits the parent's model route,
+but does not inherit shell, write, script, publication or delegation authority.
+A monotonic tool guard also rejects unexpected child-local tools and same-name
+replacements before execution. Nested dispatch and unverified PTC transports
+are not admitted. Host-owned Session logging and advisory publication retain
+their existing owners.
+
+Review file reads use one full Git commit, including its own `project.json`
+and exact Kit/Bundle overrides. Bounded source and resource reads use the
+existing Git and content loaders; they do not discover files across the host
+filesystem. The resource manifest distinguishes loaded method/schema
+projections from raw resources and from committed project facts. Missing exact
+content is an explicit error, never a latest-version or source-checkout fallback.
+Structured results still pass the official profile parser and staleness check
+before the existing publisher. Run Core's `test:advisory-readonly` with an
+explicit `DSH_TEST_WEB_ANCHOR` for the actual RC2 factory/tools/loop regression;
+the scripted-model test is separate from native model and installed-host
+acceptance.
+
 On the current host, advisory settings use the owning plugin's live `Config`
 fields and the public `SettingsForms` projection. The host owns profile entry
 identity, persistence and change delivery; the plugin creates no second settings
@@ -116,8 +217,9 @@ store. The Studio launcher consumes Slots and Locale only, retaining its
 session-status projection while preserving the exact session and question id.
 Only an actual cancellation channel is invoked: the current host's hide-only
 tool-call card dismissal is not reported as cancellation.
-Existing section-provider and legacy-host adapters remain supported; unknown
-interfaces fail explicitly rather than being replaced by empty or fake services.
+Existing settings-section adapters remain in source without qualifying older
+Hosts for this release; unknown interfaces fail explicitly rather than being
+replaced by empty or fake services.
 
 Public API checks and isolated lifecycle fixtures establish only their tested
 boundaries. The fixed beta archives still require actual strict installation,
@@ -129,6 +231,9 @@ acceptance steps; this declaration does not claim those outcomes.
 This route verifies a received fixed local candidate before registry publication.
 Its historical installation results remain tied to those archives; they do not
 establish beta registry acquisition, update or native-host acceptance.
+The ten-archive recipe and receipts below describe that historical set. For a
+newer candidate, use its supplied complete package inventory, including any
+required native Git helper, rather than reusing the historical package count.
 
 The local delivery includes ten compiled `.tgz` packages, `PORTABLE-INPUTS.json`
 (archive filenames, package identities and SHA-256), `PORTABLE-PROVIDERS.json`
@@ -275,7 +380,7 @@ and release.
 
 ### Candidate npm installer: DSH route and recovery limits
 
-The generated Companion npm candidate also exposes an `install --host dsh`
+The published Companion `0.1.0-beta.3` exposes an `install --host dsh`
 route. This is an installer adapter for the separately installed official DSH
 host, not a bundled DSH application or a desktop Companion runtime inside DSH.
 Yugoo design has one product installation entry. For DSH, that entry installs
@@ -288,9 +393,10 @@ absolute `--dsh-config` JSON file pinning the official Node/CLI/Loader inputs,
 `--profile`, and an external `--receipt-dir`. A bound product
 `release-hosts.json` supplies the exact aggregate version and HTTPS registry.
 Optional `--aggregate-selector` and `--registry` overrides must match it.
-For the beta set, the product mapping must select
-`@yugoo-design/dsh-design-system-dsh@0.1.0-beta.1` and
-`https://registry.npmjs.org`, matching all ten owned packages' exact beta pins.
+For a beta set, use the exact aggregate version recorded in that product
+candidate's `release-hosts.json` and `https://registry.npmjs.org`, matching
+the complete dependency set's exact package pins, including any declared native
+Git helper. Do not substitute an earlier beta.
 This identifies the intended release;
 it does not establish registry availability or authorize publication. Older or unbound candidates
 retain the explicit selector and registry compatibility route. Use `--dry-run`
@@ -343,7 +449,41 @@ watching and the bounded configured-root existence checks.
 
 The Portable Kernel owns Design Projects, Kit and Bundle versions, validation, execution, DesignJournal, Design Knowledge, advisories, and the shared UI. The DSH Provider maps Host identity, model-context delivery, subagents, commands, tools, and panel transport to DSH public capabilities. It exposes `ctx.userQuestions` for an in-turn blocking question when Bundle policy or the Agent requires native ask-user. Persistent asynchronous continuation appears in the plugin continuation UI, and acceptance enters as an ordinary logged user turn; advisory dispositions remain plugin-owned review decisions. Its plugin-owned binding store maps an opaque DSH Session id to the selected Design Project. No Design Project, Kit, Design File, or clarity-specific DSH Session events or projections are required; the standard `designAdvisoryInbox` projection is only a refresh/read-model mechanism and is not Design authority.
 
-Every successful `run_design_skill` completion remains attached while Core synchronously evaluates U/S/T against that exact published Git commit. The assessment is promoted to the shared project clarity authority and returned with the completed result. A bounded evaluator failure never rolls back the Bundle commit; it marks clarity failed so the main Agent cannot derive a next recommendation from stale scores. `report_design_clarity` remains the explicit main-Agent path for meaningful checkpoints outside that completion hook.
+Core owns both automatic read-only assessment and explicit main-Agent reporting.
+Every successful `run_design_skill` completion remains attached while Core
+synchronously evaluates U/S/T against that exact published Git commit. The
+assessment is promoted to the shared project clarity authority and returned with
+the completed result. A bounded evaluator failure never rolls back the Bundle
+commit; it marks clarity failed so the main Agent cannot derive a next
+recommendation from stale scores. `report_design_clarity` remains the explicit
+main-Agent path for other meaningful checkpoints, including its existing
+once-per-turn and exact-replay rules.
+
+Meaningful Panel saves are assessed by the main Agent in the same native
+continuation turn. After Git, DesignJournal and required gate settlement, the
+server injects the saved diff and exact assessment input before Save returns.
+The input pins the project, its selection revision, checkpoint, effective Kit
+content and bounded human scope. The client retains the normal native prompt
+and echo; its compatible receipt-metadata RPC is passive and starts no detached
+evaluator or pending activity. The main Agent calls `report_design_clarity`
+with the latest saved input before its final reply or next-step recommendation.
+Several saves before continuation require one report of their latest checkpoint;
+an unchanged or replayed save needs none. A valid current assessment already
+returned by `run_design_skill` is used without a duplicate main report.
+
+The explicit report requires complete input for the latest durable Panel-origin
+change; non-Panel legacy callers retain optional input. It rejects obsolete
+supplied input and retains the existing
+currentness, cancellation, Journal and guarded authority-replacement fences in
+the [architecture baseline](../../docs/system-design-baseline.md#agent-host-and-user-interface-integration).
+Once-per-user-turn and exact replay remain unchanged. If another save invalidates
+an already successful report in the same turn, the Agent withholds recommendations
+from stale scores until the next real user boundary. No browser metadata,
+displayed text or inbox claim manufactures a report or a user turn. Bundle
+completion still synchronously evaluates and returns its exact checkpoint;
+G/R/A stays in the background. Save, native admission, assessment and Agent
+consumption need separate native Web/Desktop and installed-candidate evidence;
+source or scripted lifecycle coverage is not that acceptance.
 
 Every Design Project records the exact knowledge provider in `project.json`. This DSH composition creates new projects with `ladybug-wasm` and opens that project's embedded database below its external runtime-state root, never inside the Git repository. Project switching opens and materializes the target before replacing the binding-store selection, then releases the previous handle. Provider or materialization failures leave the prior selection active and fail visibly.
 
@@ -351,7 +491,7 @@ Grounding, reflection, and alignment are Kit-neutral built-in profiles. Successf
 
 The lightbulb Design advisories entry opens its settings even with zero suggestions. Settings persist outside Design Files; Clarity and KAG are independent. Reviewers consume bounded persisted suggestion dispositions: pending/deferred issues should not be repeated, rejection is not a permanent ban, and new evidence must explain why reconsideration is warranted. The journal suppresses exact evidence/action duplicates, not fuzzy semantic matches. No suggestion is automatically accepted or rejected.
 
-Pending targets survive restart; attempted evaluations are not automatically replayed as the same attempt. Historical results cannot update current advice, Clarity, or a newer KAG. Foreground Producer work does not block review of earlier completed designs: a running `run_design_skill` call explains editing scope, while the immutable commit boundary excludes unpublished content. The loops inherit the primary Agent's model route and credentials, never block the foreground conversation, isolate profile failures, and expose aggregate operational state through `/design status`. Grounding checks deterministic cross-file consistency, Reflection recommends Research for external-knowledge uncertainty, and Alignment routes user-only decisions through the semantic Question capability. Every loop investigates committed Design Files with read-only Git commands, may use checkpoint-matched KAG as an optional discovery aid, performs its own stale checks, and publishes without waiting for siblings. There is no atomic G/R/A set or cross-profile input flow. Selecting or closing a Design Project cancels old analysis; the binding store and DesignJournal then expose only the selected project's evidence and clarity.
+Pending targets survive restart; attempted evaluations are not automatically replayed as the same attempt. Historical results cannot update current advice, Clarity, or a newer KAG. Foreground Producer work does not block review of earlier completed designs: a running `run_design_skill` call explains editing scope, while the immutable commit boundary excludes unpublished content. The loops inherit the primary Agent's model route and credentials, never block the foreground conversation, isolate profile failures, and expose aggregate operational state through `/yugoo status`. Grounding checks deterministic cross-file consistency, Reflection recommends Research for external-knowledge uncertainty, and Alignment routes user-only decisions through the semantic Question capability. Every loop investigates committed Design Files with read-only Git commands, may use checkpoint-matched KAG as an optional discovery aid, performs its own stale checks, and publishes without waiting for siblings. There is no atomic G/R/A set or cross-profile input flow. Selecting or closing a Design Project cancels old analysis; the binding store and DesignJournal then expose only the selected project's evidence and clarity.
 
 Design Kits are content packages managed by the Design System. They do not install or remove system capabilities. Deployment overlays may configure model providers, credentials, budgets, and other tunables, but must not reproduce this package's plugin roster.
 

package/licenses/dsh-distribution.json

@@ -11,7 +11,17 @@
   "fonts": [],
   "embeddedBpmnFonts": [],
   "unresolvedEmbeddedFonts": [],
-  "externalDependencies": {},
+  "externalDependencies": {
+    "@yugoo-design/dsh-design-core": "0.1.0",
+    "@yugoo-design/dsh-design-knowledge-ladybug": "0.1.0",
+    "@yugoo-design/dsh-design-panel": "0.1.0",
+    "@yugoo-design/dsh-design-provider-web-app": "0.1.0",
+    "@yugoo-design/dsh-design-studio-dsh": "0.1.0",
+    "@yugoo-design/dsh-design-skills-web-app": "0.1.0",
+    "@yugoo-design/dsh-design-skills-decision-modeling": "0.1.0",
+    "@yugoo-design/dsh-design-studio": "0.1.0",
+    "@yugoo-design/dsh-design-studio-ui": "0.1.0"
+  },
   "externalPeers": {},
   "copiedMaterials": {},
   "limitations": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yugoo-design/dsh-design-system-dsh",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.3",
   "license": "Apache-2.0",
   "type": "module",
   "description": "Yugoo Design (yugoo-design) installation plugin for DeepSeek Harness.",
@@ -23,15 +23,16 @@
     "licenses"
   ],
   "dependencies": {
-    "@yugoo-design/dsh-design-core": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-knowledge-ladybug": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-panel": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-provider-web-app": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-studio-dsh": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-skills-web-app": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-skills-decision-modeling": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-studio": "0.1.0-beta.1",
-    "@yugoo-design/dsh-design-studio-ui": "0.1.0-beta.1"
+    "@yugoo-design/dsh-design-core": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-knowledge-ladybug": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-panel": "0.1.0-beta.3",
+    "@yugoo-design/dsh-design-provider-web-app": "0.1.0-beta.3",
+    "@yugoo-design/dsh-design-studio-dsh": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-skills-web-app": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-skills-decision-modeling": "0.1.0-beta.2",
+    "@yugoo-design/yugoo-design-git-native": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-studio": "0.1.0-beta.2",
+    "@yugoo-design/dsh-design-studio-ui": "0.1.0-beta.2"
   },
   "publishConfig": {
     "access": "public"