dsh-completion-guard 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project are documented here. The project is pre-1.0; release versions track the plugin lifecycle, not stabilised API promises.
 
+## 0.3.1 - 2026-08-31
+
+### Fixed
+
+- **Frozen npm artifacts now carry their exact source commit.** The release packer stages the npm file set, injects the full 40-character Git HEAD into the staged package manifest, packs twice, and fails unless both tgz files are byte-identical. It also emits a SHA-256 checksum and a machine-readable artifact record before any registry mutation.
+- **The incomplete 0.3.0 publication is not promoted as a complete release.** Its npm artifact remains installable and passed native same-byte validation, but the registry omitted `gitHead`; no GitHub Release is created for `v0.3.0`. Version 0.3.1 supersedes that consumed version without moving its tag or attempting to reuse its npm identity.
+
+### Validation
+
+- Focused release-pack tests cover exact-HEAD injection, repeated-pack byte identity, checksum/record output, and dirty-tree rejection. The 0.3 runtime and digest bytes are otherwise unchanged; the final 0.3.1 tgz requires exact-byte macOS and native Windows acceptance before publication.
+
 ## 0.3.0 - 2026-08-31
 
 ### Added

package/CHANGELOG.zh-CN.md

@@ -2,6 +2,17 @@
 
 本项目的重要变化记录在这里。项目仍处于 1.0 之前；版本号跟踪插件生命周期，不代表 API 已稳定。
 
+## 0.3.1 - 2026-08-31
+
+### 修复
+
+- **冻结 npm 工件现在携带精确源码提交。** release packer 会先构造 npm 文件集，在 staging 包 manifest 中注入完整 40 字符 Git HEAD，再重复打包两次；只有两个 tgz 逐字节一致才通过。registry mutation 前还会生成 SHA-256 校验文件与机器可读工件记录。
+- **不把未闭合的 0.3.0 publication 提升为完整 release。** 其 npm 工件仍可安装，并已通过原生平台同字节验收，但 registry 缺少 `gitHead`；因此不为 `v0.3.0` 创建 GitHub Release。0.3.1 在不移动旧 tag、不尝试复用旧 npm 身份的前提下取代该已消费版本。
+
+### 验证
+
+- 聚焦 release-pack 测试覆盖精确 HEAD 注入、重复打包字节一致、checksum/record 输出以及脏工作树拒绝。除此之外，v0.3 runtime 与 digest 字节不变；最终 0.3.1 tgz 在发布前须完成 macOS 与原生 Windows 的同一字节验收。
+
 ## 0.3.0 - 2026-08-31
 
 ### 新增

package/README.md

@@ -11,7 +11,7 @@ A task-contract and completion-certification plugin for DeepSeek Harness (DSH).
 Install the published plugin into a DSH Web profile:
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard@0.3.0
+dsh plugin --profile web add dsh-completion-guard@0.3.1
 ```
 
 Restart DSH Web, open a session, and enable the guard:
@@ -55,7 +55,9 @@ Once enabled, Context Guard captures direct user requirements and acceptance cri
 
 ## Status and compatibility
 
-Version 0.3.0 is available from [npm](https://www.npmjs.com/package/dsh-completion-guard) and the [GitHub release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.0).
+Version 0.3.1 is the current release line. Its [npm package](https://www.npmjs.com/package/dsh-completion-guard) and [GitHub release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1) are authoritative only when the exact-artifact public readback recorded in [`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) is complete. Verify those linked identities before installing.
+
+The `0.3.0` npm artifact passed same-byte native validation, but npm omitted its required `gitHead` metadata because a prebuilt tgz was published. Its version identity cannot be reused, and no GitHub Release is created for `v0.3.0`; `0.3.1` preserves the runtime behavior while repairing the release provenance path.
 
 > The project was renamed from `dsh-context-guard` to `dsh-completion-guard` on 2026-08-29 to avoid a name collision with an unrelated DSH plugin (kpl0111/dsh-context-guard, tool-result pruning). The internal Cordis bundle id stays `context-guard`, and the previous npm package `dsh-context-guard` will be deprecated in favor of this package. It targets DSH `0.1.1-rc.2`, Node.js `>=22`, and pnpm `>=11`.
 
@@ -65,9 +67,9 @@ The 0.2.1 release suite contains 138 tests (105 domain/core). It attributes shel
 
 The Windows TEMP readback verifies the `b75868e9e73d29f50530ddaba15cfaef82e03ece` source matrix and the exact-source tarball → isolated installation → dump-config → Web startup log and cleanup chain. HTTP 200 appeared only in the first-run stdout, was not persisted, and was not rerun during readback, so the HTTP response itself is not independently confirmed. A real model-session smoke remains not run.
 
-### v0.3.0
+### v0.3.1
 
-Version 0.3.0 adds semantic action/target binding, independent state readback for stateful actions, typed boundaries, digest-v3 certificates, exact active-host identity, and paired optional Goal integration. The 19-file deterministic suite passed 351 tests with one Windows-only capability skip on macOS and all 352 tests without skips on native Windows. One canonical pre-release tarball was then installed and read back byte-for-byte on both native platforms, while CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified a valid evidence binding and persisted typed-boundary/disarm flow; an intentionally over-broad prompt stayed incomplete and received no false certificate. [`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) separates these source, artifact, CI, model-session, and publication evidence scopes.
+Version 0.3.1 carries the v0.3 semantic action/target binding, independent state readback for stateful actions, typed boundaries, digest-v3 certificates, exact active-host identity, and paired optional Goal integration introduced in 0.3.0. It adds a deterministic release packer that binds the full Git HEAD inside the frozen tgz before native-platform acceptance and registry publication. The 19-file deterministic suite passed 351 tests with one Windows-only capability skip on macOS and all 352 tests without skips on native Windows for the unchanged runtime baseline. [`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) keeps source, artifact, CI, model-session, and publication evidence scopes separate.
 
 The release uses [`manifests/action-manifest.v1.json`](manifests/action-manifest.v1.json), [`manifests/git-command-manifest.v2.json`](manifests/git-command-manifest.v2.json), and [`manifests/supported-host.v1.json`](manifests/supported-host.v1.json). Goal integration requires the exact optional peers `@deepseek-ai/dsh-goal@0.1.1-rc.2` and `@deepseek-ai/dsh-tool-goal@0.1.1-rc.2` together. It fails closed unless the active DSH runtime/profile graph injects the exact `hostLockPackages`, platform, and profile identity. A nearest lockfile is not accepted because DSH core and profile plugins use separate package graphs. The default bundled patch deliberately contains no fabricated lock.
 

package/README.zh-CN.md

@@ -11,7 +11,7 @@
 将已发布插件安装到 DSH Web profile：
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard@0.3.0
+dsh plugin --profile web add dsh-completion-guard@0.3.1
 ```
 
 重启 DSH Web，打开一个会话并启用 Guard：
@@ -55,7 +55,9 @@ dsh plugin --profile web add dsh-completion-guard@0.3.0
 
 ## 状态与兼容性
 
-0.3.0 已发布到 [npm](https://www.npmjs.com/package/dsh-completion-guard) 和 [GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.0)。
+0.3.1 是当前 release line。只有 [`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) 记录的精确工件公开读回闭合时，其 [npm 包](https://www.npmjs.com/package/dsh-completion-guard) 与 [GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1) 才构成权威发布身份；安装前请核对这些链接身份。
+
+`0.3.0` npm 工件已通过原生平台同字节验收，但由于发布的是预构建 tgz，npm 没有写入合同要求的 `gitHead`。该版本身份不能复用，也不会为 `v0.3.0` 创建 GitHub Release；`0.3.1` 保留其运行时行为并修复发布溯源路径。
 
 > 本项目于 2026-08-29 由 `dsh-context-guard` 更名为 `dsh-completion-guard`,以避免与无关的 DSH 插件(kpl0111/dsh-context-guard,工具结果剪裁)撞名。内部 Cordis bundle id 保持 `context-guard` 不变;原 npm 包 `dsh-context-guard` 将被 deprecate 并指向本包。目标环境为 DSH `0.1.1-rc.2`、Node.js `>=22`、pnpm `>=11`。
 
@@ -65,9 +67,9 @@ dsh plugin --profile web add dsh-completion-guard@0.3.0
 
 Windows TEMP 读回现已确认 `b75868e9e73d29f50530ddaba15cfaef82e03ece` 的源码矩阵，以及 exact-source tarball → 隔离安装 → dump-config → Web 启动日志与清理链。HTTP 200 只出现在首轮 stdout，未持久化且复核时没有重跑，因此 HTTP 响应本身不能写成“独立复核已确认”。真实模型会话 smoke 仍未运行。
 
-### v0.3.0
+### v0.3.1
 
-v0.3.0 增加语义 action/target 绑定、有状态动作的独立状态读回、typed boundary、digest-v3 证书、精确活动宿主身份，以及成对 optional Goal 集成。19 个测试文件在 macOS 通过 351 项并按能力跳过 1 项 Windows-only 测试，在原生 Windows 则 352 项全部通过且无跳过。随后，同一份 canonical 预发布 tarball 以逐字节一致方式在两个原生平台完成安装与读回；CI 还覆盖 Ubuntu、macOS、Windows 的 Node.js 22/24。带凭据的真实模型会话验证了有效 evidence binding 与持久化 typed-boundary/disarm 流程；一个刻意过宽的提示词保持 incomplete，且未被错误签发证书。[`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) 分别记录源码、工件、CI、模型会话与发布证据边界。
+v0.3.1 承载 0.3.0 引入的语义 action/target 绑定、有状态动作独立读回、typed boundary、digest-v3 证书、精确活动宿主身份和成对 optional Goal 集成，并增加确定性 release packer，在原生平台验收与 registry 发布前把完整 Git HEAD 绑定进冻结 tgz。对于未变化的运行时基线，19 个测试文件在 macOS 通过 351 项并按能力跳过 1 项 Windows-only 测试，在原生 Windows 通过全部 352 项且无跳过。[`docs/LOCAL_ACCEPTANCE.md`](docs/LOCAL_ACCEPTANCE.md) 分别记录源码、工件、CI、模型会话与 publication 证据边界。
 
 该版本使用 [`manifests/action-manifest.v1.json`](manifests/action-manifest.v1.json)、[`manifests/git-command-manifest.v2.json`](manifests/git-command-manifest.v2.json) 与 [`manifests/supported-host.v1.json`](manifests/supported-host.v1.json)。Goal 集成要求精确 optional peers `@deepseek-ai/dsh-goal@0.1.1-rc.2` 和 `@deepseek-ai/dsh-tool-goal@0.1.1-rc.2` 同时存在。活动 DSH runtime/profile graph 未显式注入精确 `hostLockPackages`、platform 与 profile 身份时一律 fail-closed。由于 DSH 核心与 profile 插件使用不同 package graph，运行时不接受“向上找到的最近 lockfile”替代活动宿主身份；默认 bundle patch 也不会伪造这份锁。
 

package/docs/COMPATIBILITY.md

@@ -54,7 +54,7 @@ certifying capability, and has unknown outcome.
 - `dsh --profile web --dump-config` and `--profile headless --dump-config` both include `context-guard`.
 - A real headless boot loads the plugin (apply, `ctx.sessions` access, and listener registration succeed) and only stops at missing provider credentials.
 
-The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. Version 0.3.0 exercises 352 deterministic tests in 19 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 351 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. The final documentation-inclusive tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
+The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. The v0.3 runtime baseline exercises 352 deterministic tests in 19 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 351 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. Version 0.3.1 preserves those runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. The final 0.3.1 tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
 
 ## Session-layer capture filter and goal completion (v0.2.1)
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,7 +2,27 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
-## v0.3.0 release gates (2026-08-31)
+## v0.3.1 release-repair gates
+
+Version 0.3.1 preserves the v0.3 runtime and digest behavior while repairing
+the public provenance path. `scripts/release-pack.mjs` requires a clean Git
+root, resolves the full 40-character HEAD, stages the exact npm file set,
+injects that HEAD as `gitHead` only in the staged package manifest, and packs
+the staged package twice. It fails unless both tgz outputs are byte-identical
+and retain the same file count, then emits the single frozen tgz,
+`SHA256SUMS.txt`, and `release-artifact.json`. Publishing must use that tgz
+without repacking. The registry manifest, downloaded registry tgz, annotated
+tag, GitHub Release target, and checksum must all read back to the same commit
+and bytes.
+
+The focused Node test covers exact-HEAD injection, repeated-pack byte identity,
+checksum and artifact-record output, and dirty-tree rejection. Acceptance of
+the final tgz requires the full isolated Web/Headless install, no-op, package parity,
+host-lock, real restart, HTTP recovery, and cleanup lifecycle on native macOS
+and Windows before publication. CI, native-platform evidence, registry
+publication, tag identity, and GitHub Release remain separate gates.
+
+## v0.3.0 incomplete publication (2026-08-31)
 
 Release preparation froze one canonical pre-release package from commit
 `a33b69326eb46fbefc56affc55e2a486695f545c`. The 26-file, 170158-byte tgz
@@ -29,15 +49,24 @@ checkpoint remained incomplete and no completion certificate was issued.
 This proves the bounded evidence, boundary, and disarm paths without claiming
 that arbitrary model instructions are semantically certifiable.
 
-The release-state documentation in this commit is itself packaged and thus
-changes the tgz bytes from the pre-release artifact above. The final release
-gate therefore packs the documentation-inclusive commit once, installs and
-reads back those exact bytes separately on native macOS and Windows, and
-publishes that frozen tgz without repacking. Public identity is accepted only
-when the annotated `v0.3.0` tag, npm `gitHead` and integrity, GitHub Release
-target, published checksum, and registry package readback agree. These
-publication identities do not derive from source tests or from the earlier
-pre-release hash.
+The final documentation-inclusive source was commit
+`12e8411537b7f843aed267bc150a9403ddbb04c9`. Its frozen 26-file,
+171419-byte tgz had SHA-256
+`416b3539d38c13ea0e01b2154f342d911d4c14b81cc90d71f99e8b9bd6d6de45`
+and passed the same isolated lifecycle and same-byte package readback on native
+macOS and Windows. Main CI run 33347875843 and tag CI run 33347976931 passed
+Ubuntu, macOS, and Windows with Node.js 22 and 24. Annotated tag `v0.3.0`
+peels to that commit.
+
+The exact tgz was published as `dsh-completion-guard@0.3.0`; registry shasum
+`4c881b83b6046833229d5f54a062bfa2eea5be6f` and integrity
+`sha512-WSxbxD5N/79SJ/6UW0/XonCUlmckUhMHtj4LhUpa9u3XGC+MFZ/GUX935Y4Aqp8HJmxnj2gdHmAYmk8pcccykg==`
+identify the validated bytes. However, npm did not populate registry
+`gitHead` when publishing the prebuilt tgz. That fails this release's frozen
+public-identity gate. The version and tag remain immutable historical facts,
+but no GitHub Release is created for `v0.3.0`, and 0.3.0 is not claimed as a
+completed release. Version 0.3.1 repairs the packaging path instead of moving
+the tag, reusing the npm version, or weakening the gate after publication.
 
 ## Windows exact-source readback (2026-08-30)
 

package/docs/distribution.md

@@ -15,6 +15,15 @@ installed profiles keep their runtime identity. The previous npm package
 `dsh-context-guard` is deprecated across all published versions (0.1.0 –
 0.2.1) with a pointer to this package.
 
+## Incomplete v0.3.0 identity
+
+`dsh-completion-guard@0.3.0` is publicly readable from npm and its tarball
+passed same-byte native macOS and Windows validation. The registry metadata
+omits the release contract's required `gitHead`, however, so `v0.3.0` is not
+listed as a completed destination and has no GitHub Release. The immutable npm
+version and annotated tag are retained for audit history. Version 0.3.1 repairs
+the provenance-bearing frozen-package workflow.
+
 ## Published v0.2.1 destinations
 
 1. [GitHub Release `v0.2.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.2.1)

package/docs/upstream-deltas.json

@@ -1,7 +1,7 @@
 {
   "ledgerVersion": "1",
   "description": "Delta ledger tracking how dsh-completion-guard adapts codex-context-guard protocol capabilities. Each entry separates the source fact from plan status, implementation status, deterministic tests, native platform acceptance, and release readback. A disposition of adapted/adopted with implementationStatus not-implemented is a planned alignment, not a shipped one.",
-  "snapshotBoundary": "Pre-release planning snapshot retained for historical traceability. Candidate labels and empty release readbacks describe the planning state when each row was recorded, not the current package status. Use CHANGELOG.md and docs/LOCAL_ACCEPTANCE.md for v0.3.0 release and validation state.",
+  "snapshotBoundary": "Pre-release planning snapshot retained for historical traceability. Candidate labels and empty release readbacks describe the planning state when each row was recorded, not the current package status. Use CHANGELOG.md and docs/LOCAL_ACCEPTANCE.md for the v0.3.0 publication attempt and v0.3.1 release-repair state.",
   "source": {
     "product": "codex-context-guard",
     "version": "v0.9.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-completion-guard",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "A task-contract and completion-certification layer for DeepSeek Harness.",
   "repository": {
     "type": "git",
@@ -61,6 +61,15 @@
       "optional": true
     }
   },
+  "scripts": {
+    "build": "tsdown",
+    "lint": "oxlint src tests",
+    "test": "vitest run",
+    "test:release-pack": "node --test tests/release-pack.node.mjs",
+    "test:stats": "node --test tests/npm-download-stats.node.mjs",
+    "typecheck": "tsc --noEmit",
+    "pack:check": "pnpm pack --dry-run --json"
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
     "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
@@ -97,12 +106,5 @@
     "hooks",
     "typescript"
   ],
-  "scripts": {
-    "build": "tsdown",
-    "lint": "oxlint src tests",
-    "test": "vitest run",
-    "test:stats": "node --test tests/npm-download-stats.node.mjs",
-    "typecheck": "tsc --noEmit",
-    "pack:check": "pnpm pack --dry-run --json"
-  }
-}
+  "gitHead": "00ed5c6456e15f0859c1ef7731157d07a3903af9"
+}