dsh-completion-guard 0.3.0 → 0.3.2

package/dist/{index-GvKLkTqV.d.ts → index-CTFLYvNL.d.ts}

@@ -78,12 +78,6 @@ interface PackageRow {
   version?: string;
   integrity?: string;
 }
-interface HostLockManifest {
-  manifestVersion: number;
-  supportedGoalVersions: string[];
-  capabilities?: CapabilityRow[];
-  packages?: PackageRow[];
-}
 //#endregion
 //#region src/domain/types.d.ts
 type GuardItemKind = "requirement" | "acceptance" | "prohibition";
@@ -461,11 +455,35 @@ declare function currentContractDigest(projection: GuardProjection): string;
 type HostLockStatus = "supported" | "unsupported" | "unavailable";
 type HostPlatform = "posix" | "windows";
 type HostProfileKind = "headless" | "web";
-declare const SUPPORTED_HOST_MANIFEST: HostLockManifest;
+interface HostCohort {
+  /** Stable cohort identity; bound into every hostLockDigest via `host_cohort`. */
+  id: string;
+  manifestVersion: number;
+  supportedGoalVersions: string[];
+  /**
+  * Platforms where this cohort's exact package graph was extracted from a
+  * native host and audited. Other platforms fail closed; integrity must not
+  * be inferred across platforms.
+  */
+  auditedPlatforms: readonly HostPlatform[];
+  packages: PackageRow[];
+  capabilities: CapabilityRow[];
+}
 /**
-* Audited package identities. This is a catalogue, not one indivisible lock:
-* evaluateHostLock requires only BASE_HOST_PACKAGES globally and evaluates the
-* remaining action/platform groups independently.
+* Audited host cohort registry. The rc.2 cohort keeps the exact identities
+* audited for 0.3.0/0.3.1 on macOS and Windows. The alpha.2 cohort carries the
+* exact package graph extracted from native macOS and Windows DSH
+* `0.1.2-alpha.2` / dshmarket `1.38.1` runtimes. Graphs that mix cohorts,
+* lack rows, duplicate rows, or use
+* versions outside both cohorts fail closed.
+*/
+declare const HOST_COHORTS: readonly HostCohort[];
+/**
+* rc.2 audited package identities (first registry cohort). The audited
+* cohort is an atomic whole-graph contract (CG-DSH-001): any drifted,
+* duplicated, unknown-version, unbound, OR MISSING row fails the whole lock
+* closed (`host_lock_missing`); no capability inherits independence from a
+* partially present graph.
 */
 declare const EXPECTED_HOST_PACKAGES: PackageRow[];
 declare const BASE_HOST_PACKAGES: ReadonlySet<string>;
@@ -484,18 +502,50 @@ interface HostLockEvaluation {
   status: HostLockStatus;
   digest: string;
   goalAvailable: boolean;
-  reasonCode?: "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch";
+  reasonCode?: "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
   packages: PackageRow[];
   capabilities: Record<HostCapabilityId, HostCapabilityEvaluation>;
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   liveGoalAvailable?: boolean;
+  /** Readback of the audited cohort the supplied graph was evaluated against. */
+  cohortId?: string;
+  /** Audited cohort rows absent from the supplied graph (diagnostic). */
+  missingPackages?: string[];
 }
 interface HostLockContext {
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   capabilityId?: string;
 }
+type HostCohortSelectionReason = "host_cohort_unknown_package" | "host_cohort_version_mismatch" | "host_cohort_integrity_mismatch" | "host_cohort_mixed_graph" | "host_cohort_incomplete_graph" | "host_cohort_unbound_identity" | "host_cohort_platform_not_audited";
+interface HostCohortSelection {
+  /**
+  * Cohort used for expected-row lookups and digest identity. When the graph
+  * does not consistently match one cohort this is the deterministic
+  * closest-cohort fallback (most exact row matches, then registry order) and
+  * `consistent` is false, so evaluation fails closed downstream.
+  */
+  cohort: HostCohort;
+  /**
+  * True only when every supplied row exactly matches the selected cohort
+  * AND every audited cohort row is present: the audited cohort is an atomic
+  * whole-graph contract, so a graph missing audited rows (missing packages)
+  * never selects consistently.
+  */
+  consistent: boolean;
+  reasonCode?: HostCohortSelectionReason;
+}
+/**
+* Atomically select the audited cohort for one supplied package graph. A
+* graph matches a cohort only when every row carries version and integrity,
+* each exactly equals that cohort's audited row, and the graph covers the
+* complete audited cohort (missing packages fail closed); graphs that mix
+* rows from different cohorts, use versions unknown to the registry, or
+* target a platform the cohort was never audited on never select
+* consistently.
+*/
+declare function selectHostCohort(rows: readonly PackageRow[], platform?: HostPlatform): HostCohortSelection;
 declare function evaluateHostLock(rows: readonly PackageRow[], context?: HostLockContext): HostLockEvaluation;
 interface HostCapabilityRequest {
   action: SemanticAction;
@@ -954,4 +1004,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { gitCommandMatchesTarget as $, VerificationContract as $n, UserInteractionKind as $t, hostLockRowsFromComposedDump as A, DerivedEnvelope as An, HOST_CAPABILITY_PACKAGE_GROUPS as At, GitCommandManifest as B, GuardEvidence as Bn, SUPPORTED_HOST_MANIFEST as Bt, CommandSurfaceManifest as C, qualifyBoundary as Cn, digestStrings as Cr, AuditedExecutable as Ct, ActiveProfileHostLock as D, DeriveConfig as Dn, sha256 as Dr, ExecutableIdentity as Dt, validateManifest as E, DeferAuthorization as En, sanitizeUrl as Er, EXPECTED_HOST_PACKAGES as Et, resolveInstalledHostLock as F, ExpectedTransition as Fn, HostLockEvaluation as Ft, GitPrestateCheck as G, GuardOperation as Gn, evaluateHostLock as Gt, GitCommandRejected as H, GuardItem as Hn, bindLiveGoalCapability as Ht, verifyComposedHostLockDump as I, ExternalOperation as In, HostLockStatus as It, LinearCommitReadback as J, PersistenceAuthorization as Jn, AuthorityBlock as Jt, GitPrestateEnvelope as K, GuardProjection as Kn, evaluateToolSurfaceCapability as Kt, GIT_COMMAND_MANIFEST_IDS as L, GoalRef as Ln, HostPlatform as Lt, packageRowsFromActiveGraph as M, EvidenceOutcome as Mn, HostCapabilityId as Mt, packageRowsFromPnpmLock as N, EvidenceParseStatus as Nn, HostCapabilityRequest as Nt, HostProfileError as O, DeriveResult as On, ExecutableIdentityBinding as Ot, resolveActiveProfileHostLock as P, EvidenceRole as Pn, HostLockContext as Pt, executeRevalidatedGitEffect as Q, TargetValue as Qn, segmentAuthorityBlocks as Qt, GitAdapterAction as R, GuardBoundary as Rn, HostProfileKind as Rt, COMMAND_SURFACE_MANIFEST as S, isCurrentAcceptedBoundary as Sn, canonicalizePath as Sr, deriveProjection as St, OperationVerbEntry as T, BoundaryQualificationKind as Tn, sanitizeClauseText as Tr, DEFAULT_HOST_LOCK as Tt, GitEffectExecution as U, GuardItemKind as Un, evaluateExternalWaitCapability as Ut, GitCommandParseResult as V, GuardIntegrity as Vn, bindExecutableIdentity as Vt, GitEffectRunner as W, GuardItemStatus as Wn, evaluateHostCapability as Wt, commitTreeSnapshotDigest as X, TargetCaptureStatus as Xn, AuthorityKind as Xt, commitIndexSnapshotDigest as Y, TargetCaptureReasonCode as Yn, AuthorityBlockKind as Yt, createGitPrestateEnvelope as Z, TargetTuple as Zn, authorityCaptureCounts as Zt, EvidenceFacetCoverage as _, BoundaryRequest as _n, requestedTargetMatchesResolved as _r, extractTextContent as _t, classifyCompletionClaim as a, ClassifiedClause as an, ActionManifest as ar, ParsedShell as at, evidenceMatchesItem as b, availableBoundaryQualifications as bn, validateActionManifest as br, withDurability as bt, isWholeTaskCompletionClaim as c, captureItem as cn, SEMANTIC_ACTIONS as cr, isRunExecutable as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, extractMethod as dn, SUPPORTED_EVIDENCE_ADAPTERS as dr, goalCompletionDenial as dt, classifyUserInteraction as en, WaitAuthorization as er, parseGitCommandManifest as et, RecoveryOptions as f, extractOperation as fn, SemanticAction as fr, hasCurrentCertificate as ft, renderRecoveryPacket as g, BoundaryQualification as gn, requestedTargetAuthorizesMutation as gr, evidenceFromPersistedToolResult as gt, recoveryDigest as h, BoundaryEffectuation as hn, isStatefulAction as hr, ToolSubject as ht, TurnStoppingDecision as i, CaptureScope as in, ACTION_MANIFEST_VERSION as ir, CanonicalCommandSurface as it, injectActiveProfileHostLock as j, EvidenceBinding as jn, HostCapabilityEvaluation as jt, hostLockContextFromComposedDump as k, DeriveScope as kn, GOAL_HOST_PACKAGES as kt, latestAssistantText as l, classifyClause as ln, STATEFUL_ACTIONS as lr, parsePwshCommand as lt, openItems as m, segmentClauses as mn, actionCompatible as mr, ToolResultInput as mt, AssistantOutcomeObservation as n, RejectedBinding as nn, PackageRow as nr, verifiedLinearCommitReadback as nt, decideTurnBoundary as o, ClauseSegment as on, ActionSpec as or, ShellParseStatus as ot, closingHint as p, isInformationalMessage as pn, StatefulAction as pr, ToolCallInput as pt, GitTargetIdentity as q, HostStatus as qn, currentContractDigest as qt, CompletionDisposition as r, certifyCheckpoint as rn, ACTION_MANIFEST as rr, CanonicalArgv as rt, decideTurnStopping as s, captureClause as sn, CERTIFICATE_VERSION as sr, canonicalArgvFromCommand as st, supersedeItem as t, CheckpointResult as tn, createProjection as tr, revalidateGitPrestate as tt, observeAssistantOutcome as u, extractArtifactPaths as un, STOP_PROTOCOL_VERSION as ur, parseShellCommand as ut, bindingSatisfies as v, GoalActivationState as vn, semanticActionFromCommand as vr, extractToolSubject as vt, ManifestIssue as w, BoundaryDisposition as wn, normalizeClause as wr, BASE_HOST_PACKAGES as wt, isVerifyingCapability as x, effectuateBoundary as xn, validateActionTarget as xr, PROTOCOL_V3_NOTICE as xt, evidenceCoverage as y, GoalBoundaryAccess as yn, semanticActionFromText as yr, isDeterministicCheck as yt, GitCommandAccepted as z, GuardCheckpoint as zn, HostToolSurface as zt };
+export { gitCommandMatchesTarget as $, TargetCaptureReasonCode as $n, AuthorityBlockKind as $t, hostLockRowsFromComposedDump as A, DeferAuthorization as An, sanitizeUrl as Ar, HOST_CAPABILITY_PACKAGE_GROUPS as At, GitCommandManifest as B, ExternalOperation as Bn, HostLockStatus as Bt, CommandSurfaceManifest as C, GoalBoundaryAccess as Cn, semanticActionFromText as Cr, AuditedExecutable as Ct, ActiveProfileHostLock as D, qualifyBoundary as Dn, digestStrings as Dr, ExecutableIdentity as Dt, validateManifest as E, isCurrentAcceptedBoundary as En, canonicalizePath as Er, EXPECTED_HOST_PACKAGES as Et, resolveInstalledHostLock as F, EvidenceBinding as Fn, HostCohort as Ft, GitPrestateCheck as G, GuardIntegrity as Gn, bindLiveGoalCapability as Gt, GitCommandRejected as H, GuardBoundary as Hn, HostProfileKind as Ht, verifyComposedHostLockDump as I, EvidenceOutcome as In, HostCohortSelection as It, LinearCommitReadback as J, GuardItemStatus as Jn, evaluateHostLock as Jt, GitPrestateEnvelope as K, GuardItem as Kn, evaluateExternalWaitCapability as Kt, GIT_COMMAND_MANIFEST_IDS as L, EvidenceParseStatus as Ln, HostCohortSelectionReason as Lt, packageRowsFromActiveGraph as M, DeriveResult as Mn, HostCapabilityEvaluation as Mt, packageRowsFromPnpmLock as N, DeriveScope as Nn, HostCapabilityId as Nt, HostProfileError as O, BoundaryDisposition as On, normalizeClause as Or, ExecutableIdentityBinding as Ot, resolveActiveProfileHostLock as P, DerivedEnvelope as Pn, HostCapabilityRequest as Pt, executeRevalidatedGitEffect as Q, PersistenceAuthorization as Qn, AuthorityBlock as Qt, GitAdapterAction as R, EvidenceRole as Rn, HostLockContext as Rt, COMMAND_SURFACE_MANIFEST as S, GoalActivationState as Sn, semanticActionFromCommand as Sr, deriveProjection as St, OperationVerbEntry as T, effectuateBoundary as Tn, validateActionTarget as Tr, DEFAULT_HOST_LOCK as Tt, GitEffectExecution as U, GuardCheckpoint as Un, HostToolSurface as Ut, GitCommandParseResult as V, GoalRef as Vn, HostPlatform as Vt, GitEffectRunner as W, GuardEvidence as Wn, bindExecutableIdentity as Wt, commitTreeSnapshotDigest as X, GuardProjection as Xn, selectHostCohort as Xt, commitIndexSnapshotDigest as Y, GuardOperation as Yn, evaluateToolSurfaceCapability as Yt, createGitPrestateEnvelope as Z, HostStatus as Zn, currentContractDigest as Zt, EvidenceFacetCoverage as _, isInformationalMessage as _n, StatefulAction as _r, extractTextContent as _t, classifyCompletionClaim as a, CheckpointResult as an, createProjection as ar, ParsedShell as at, evidenceMatchesItem as b, BoundaryQualification as bn, requestedTargetAuthorizesMutation as br, withDurability as bt, isWholeTaskCompletionClaim as c, CaptureScope as cn, ACTION_MANIFEST_VERSION as cr, isRunExecutable as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, captureClause as dn, CERTIFICATE_VERSION as dr, goalCompletionDenial as dt, AuthorityKind as en, TargetCaptureStatus as er, parseGitCommandManifest as et, RecoveryOptions as f, captureItem as fn, SEMANTIC_ACTIONS as fr, hasCurrentCertificate as ft, renderRecoveryPacket as g, extractOperation as gn, SemanticAction as gr, evidenceFromPersistedToolResult as gt, recoveryDigest as h, extractMethod as hn, SUPPORTED_EVIDENCE_ADAPTERS as hr, ToolSubject as ht, TurnStoppingDecision as i, classifyUserInteraction as in, WaitAuthorization as ir, CanonicalCommandSurface as it, injectActiveProfileHostLock as j, DeriveConfig as jn, sha256 as jr, HOST_COHORTS as jt, hostLockContextFromComposedDump as k, BoundaryQualificationKind as kn, sanitizeClauseText as kr, GOAL_HOST_PACKAGES as kt, latestAssistantText as l, ClassifiedClause as ln, ActionManifest as lr, parsePwshCommand as lt, openItems as m, extractArtifactPaths as mn, STOP_PROTOCOL_VERSION as mr, ToolResultInput as mt, AssistantOutcomeObservation as n, segmentAuthorityBlocks as nn, TargetValue as nr, verifiedLinearCommitReadback as nt, decideTurnBoundary as o, RejectedBinding as on, PackageRow as or, ShellParseStatus as ot, closingHint as p, classifyClause as pn, STATEFUL_ACTIONS as pr, ToolCallInput as pt, GitTargetIdentity as q, GuardItemKind as qn, evaluateHostCapability as qt, CompletionDisposition as r, UserInteractionKind as rn, VerificationContract as rr, CanonicalArgv as rt, decideTurnStopping as s, certifyCheckpoint as sn, ACTION_MANIFEST as sr, canonicalArgvFromCommand as st, supersedeItem as t, authorityCaptureCounts as tn, TargetTuple as tr, revalidateGitPrestate as tt, observeAssistantOutcome as u, ClauseSegment as un, ActionSpec as ur, parseShellCommand as ut, bindingSatisfies as v, segmentClauses as vn, actionCompatible as vr, extractToolSubject as vt, ManifestIssue as w, availableBoundaryQualifications as wn, validateActionManifest as wr, BASE_HOST_PACKAGES as wt, isVerifyingCapability as x, BoundaryRequest as xn, requestedTargetMatchesResolved as xr, PROTOCOL_V3_NOTICE as xt, evidenceCoverage as y, BoundaryEffectuation as yn, isStatefulAction as yr, isDeterministicCheck as yt, GitCommandAccepted as z, ExpectedTransition as zn, HostLockEvaluation as zt };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as gitCommandMatchesTarget, $n as VerificationContract, $t as UserInteractionKind, A as hostLockRowsFromComposedDump, An as DerivedEnvelope, At as HOST_CAPABILITY_PACKAGE_GROUPS, B as GitCommandManifest, Bn as GuardEvidence, Bt as SUPPORTED_HOST_MANIFEST, C as CommandSurfaceManifest, Cn as qualifyBoundary, Cr as digestStrings, Ct as AuditedExecutable, D as ActiveProfileHostLock, Dn as DeriveConfig, Dr as sha256, Dt as ExecutableIdentity, E as validateManifest, En as DeferAuthorization, Er as sanitizeUrl, Et as EXPECTED_HOST_PACKAGES, F as resolveInstalledHostLock, Fn as ExpectedTransition, Ft as HostLockEvaluation, G as GitPrestateCheck, Gn as GuardOperation, Gt as evaluateHostLock, H as GitCommandRejected, Hn as GuardItem, Ht as bindLiveGoalCapability, I as verifyComposedHostLockDump, In as ExternalOperation, It as HostLockStatus, J as LinearCommitReadback, Jn as PersistenceAuthorization, Jt as AuthorityBlock, K as GitPrestateEnvelope, Kn as GuardProjection, Kt as evaluateToolSurfaceCapability, L as GIT_COMMAND_MANIFEST_IDS, Ln as GoalRef, Lt as HostPlatform, M as packageRowsFromActiveGraph, Mn as EvidenceOutcome, Mt as HostCapabilityId, N as packageRowsFromPnpmLock, Nn as EvidenceParseStatus, Nt as HostCapabilityRequest, O as HostProfileError, On as DeriveResult, Ot as ExecutableIdentityBinding, P as resolveActiveProfileHostLock, Pn as EvidenceRole, Pt as HostLockContext, Q as executeRevalidatedGitEffect, Qn as TargetValue, Qt as segmentAuthorityBlocks, R as GitAdapterAction, Rn as GuardBoundary, Rt as HostProfileKind, S as COMMAND_SURFACE_MANIFEST, Sn as isCurrentAcceptedBoundary, Sr as canonicalizePath, St as deriveProjection, T as OperationVerbEntry, Tn as BoundaryQualificationKind, Tr as sanitizeClauseText, Tt as DEFAULT_HOST_LOCK, U as GitEffectExecution, Un as GuardItemKind, Ut as evaluateExternalWaitCapability, V as GitCommandParseResult, Vn as GuardIntegrity, Vt as bindExecutableIdentity, W as GitEffectRunner, Wn as GuardItemStatus, Wt as evaluateHostCapability, X as commitTreeSnapshotDigest, Xn as TargetCaptureStatus, Xt as AuthorityKind, Y as commitIndexSnapshotDigest, Yn as TargetCaptureReasonCode, Yt as AuthorityBlockKind, Z as createGitPrestateEnvelope, Zn as TargetTuple, Zt as authorityCaptureCounts, _ as EvidenceFacetCoverage, _n as BoundaryRequest, _r as requestedTargetMatchesResolved, _t as extractTextContent, a as classifyCompletionClaim, an as ClassifiedClause, ar as ActionManifest, at as ParsedShell, b as evidenceMatchesItem, bn as availableBoundaryQualifications, br as validateActionManifest, bt as withDurability, c as isWholeTaskCompletionClaim, cn as captureItem, cr as SEMANTIC_ACTIONS, ct as isRunExecutable, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as extractMethod, dr as SUPPORTED_EVIDENCE_ADAPTERS, dt as goalCompletionDenial, en as classifyUserInteraction, er as WaitAuthorization, et as parseGitCommandManifest, f as RecoveryOptions, fn as extractOperation, fr as SemanticAction, ft as hasCurrentCertificate, g as renderRecoveryPacket, gn as BoundaryQualification, gr as requestedTargetAuthorizesMutation, gt as evidenceFromPersistedToolResult, h as recoveryDigest, hn as BoundaryEffectuation, hr as isStatefulAction, ht as ToolSubject, i as TurnStoppingDecision, in as CaptureScope, ir as ACTION_MANIFEST_VERSION, it as CanonicalCommandSurface, j as injectActiveProfileHostLock, jn as EvidenceBinding, jt as HostCapabilityEvaluation, k as hostLockContextFromComposedDump, kn as DeriveScope, kt as GOAL_HOST_PACKAGES, l as latestAssistantText, ln as classifyClause, lr as STATEFUL_ACTIONS, lt as parsePwshCommand, m as openItems, mn as segmentClauses, mr as actionCompatible, mt as ToolResultInput, n as AssistantOutcomeObservation, nn as RejectedBinding, nr as PackageRow, nt as verifiedLinearCommitReadback, o as decideTurnBoundary, on as ClauseSegment, or as ActionSpec, ot as ShellParseStatus, p as closingHint, pn as isInformationalMessage, pr as StatefulAction, pt as ToolCallInput, q as GitTargetIdentity, qn as HostStatus, qt as currentContractDigest, r as CompletionDisposition, rn as certifyCheckpoint, rr as ACTION_MANIFEST, rt as CanonicalArgv, s as decideTurnStopping, sn as captureClause, sr as CERTIFICATE_VERSION, st as canonicalArgvFromCommand, t as supersedeItem, tn as CheckpointResult, tr as createProjection, tt as revalidateGitPrestate, u as observeAssistantOutcome, un as extractArtifactPaths, ur as STOP_PROTOCOL_VERSION, ut as parseShellCommand, v as bindingSatisfies, vn as GoalActivationState, vr as semanticActionFromCommand, vt as extractToolSubject, w as ManifestIssue, wn as BoundaryDisposition, wr as normalizeClause, wt as BASE_HOST_PACKAGES, x as isVerifyingCapability, xn as effectuateBoundary, xr as validateActionTarget, xt as PROTOCOL_V3_NOTICE, y as evidenceCoverage, yn as GoalBoundaryAccess, yr as semanticActionFromText, yt as isDeterministicCheck, z as GitCommandAccepted, zn as GuardCheckpoint, zt as HostToolSurface } from "./index-GvKLkTqV.js";
+import { $ as gitCommandMatchesTarget, $n as TargetCaptureReasonCode, $t as AuthorityBlockKind, A as hostLockRowsFromComposedDump, An as DeferAuthorization, Ar as sanitizeUrl, At as HOST_CAPABILITY_PACKAGE_GROUPS, B as GitCommandManifest, Bn as ExternalOperation, Bt as HostLockStatus, C as CommandSurfaceManifest, Cn as GoalBoundaryAccess, Cr as semanticActionFromText, Ct as AuditedExecutable, D as ActiveProfileHostLock, Dn as qualifyBoundary, Dr as digestStrings, Dt as ExecutableIdentity, E as validateManifest, En as isCurrentAcceptedBoundary, Er as canonicalizePath, Et as EXPECTED_HOST_PACKAGES, F as resolveInstalledHostLock, Fn as EvidenceBinding, Ft as HostCohort, G as GitPrestateCheck, Gn as GuardIntegrity, Gt as bindLiveGoalCapability, H as GitCommandRejected, Hn as GuardBoundary, Ht as HostProfileKind, I as verifyComposedHostLockDump, In as EvidenceOutcome, It as HostCohortSelection, J as LinearCommitReadback, Jn as GuardItemStatus, Jt as evaluateHostLock, K as GitPrestateEnvelope, Kn as GuardItem, Kt as evaluateExternalWaitCapability, L as GIT_COMMAND_MANIFEST_IDS, Ln as EvidenceParseStatus, Lt as HostCohortSelectionReason, M as packageRowsFromActiveGraph, Mn as DeriveResult, Mt as HostCapabilityEvaluation, N as packageRowsFromPnpmLock, Nn as DeriveScope, Nt as HostCapabilityId, O as HostProfileError, On as BoundaryDisposition, Or as normalizeClause, Ot as ExecutableIdentityBinding, P as resolveActiveProfileHostLock, Pn as DerivedEnvelope, Pt as HostCapabilityRequest, Q as executeRevalidatedGitEffect, Qn as PersistenceAuthorization, Qt as AuthorityBlock, R as GitAdapterAction, Rn as EvidenceRole, Rt as HostLockContext, S as COMMAND_SURFACE_MANIFEST, Sn as GoalActivationState, Sr as semanticActionFromCommand, St as deriveProjection, T as OperationVerbEntry, Tn as effectuateBoundary, Tr as validateActionTarget, Tt as DEFAULT_HOST_LOCK, U as GitEffectExecution, Un as GuardCheckpoint, Ut as HostToolSurface, V as GitCommandParseResult, Vn as GoalRef, Vt as HostPlatform, W as GitEffectRunner, Wn as GuardEvidence, Wt as bindExecutableIdentity, X as commitTreeSnapshotDigest, Xn as GuardProjection, Xt as selectHostCohort, Y as commitIndexSnapshotDigest, Yn as GuardOperation, Yt as evaluateToolSurfaceCapability, Z as createGitPrestateEnvelope, Zn as HostStatus, Zt as currentContractDigest, _ as EvidenceFacetCoverage, _n as isInformationalMessage, _r as StatefulAction, _t as extractTextContent, a as classifyCompletionClaim, an as CheckpointResult, ar as createProjection, at as ParsedShell, b as evidenceMatchesItem, bn as BoundaryQualification, br as requestedTargetAuthorizesMutation, bt as withDurability, c as isWholeTaskCompletionClaim, cn as CaptureScope, cr as ACTION_MANIFEST_VERSION, ct as isRunExecutable, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as captureClause, dr as CERTIFICATE_VERSION, dt as goalCompletionDenial, en as AuthorityKind, er as TargetCaptureStatus, et as parseGitCommandManifest, f as RecoveryOptions, fn as captureItem, fr as SEMANTIC_ACTIONS, ft as hasCurrentCertificate, g as renderRecoveryPacket, gn as extractOperation, gr as SemanticAction, gt as evidenceFromPersistedToolResult, h as recoveryDigest, hn as extractMethod, hr as SUPPORTED_EVIDENCE_ADAPTERS, ht as ToolSubject, i as TurnStoppingDecision, in as classifyUserInteraction, ir as WaitAuthorization, it as CanonicalCommandSurface, j as injectActiveProfileHostLock, jn as DeriveConfig, jr as sha256, jt as HOST_COHORTS, k as hostLockContextFromComposedDump, kn as BoundaryQualificationKind, kr as sanitizeClauseText, kt as GOAL_HOST_PACKAGES, l as latestAssistantText, ln as ClassifiedClause, lr as ActionManifest, lt as parsePwshCommand, m as openItems, mn as extractArtifactPaths, mr as STOP_PROTOCOL_VERSION, mt as ToolResultInput, n as AssistantOutcomeObservation, nn as segmentAuthorityBlocks, nr as TargetValue, nt as verifiedLinearCommitReadback, o as decideTurnBoundary, on as RejectedBinding, or as PackageRow, ot as ShellParseStatus, p as closingHint, pn as classifyClause, pr as STATEFUL_ACTIONS, pt as ToolCallInput, q as GitTargetIdentity, qn as GuardItemKind, qt as evaluateHostCapability, r as CompletionDisposition, rn as UserInteractionKind, rr as VerificationContract, rt as CanonicalArgv, s as decideTurnStopping, sn as certifyCheckpoint, sr as ACTION_MANIFEST, st as canonicalArgvFromCommand, t as supersedeItem, tn as authorityCaptureCounts, tr as TargetTuple, tt as revalidateGitPrestate, u as observeAssistantOutcome, un as ClauseSegment, ur as ActionSpec, ut as parseShellCommand, v as bindingSatisfies, vn as segmentClauses, vr as actionCompatible, vt as extractToolSubject, w as ManifestIssue, wn as availableBoundaryQualifications, wr as validateActionManifest, wt as BASE_HOST_PACKAGES, x as isVerifyingCapability, xn as BoundaryRequest, xr as requestedTargetMatchesResolved, xt as PROTOCOL_V3_NOTICE, y as evidenceCoverage, yn as BoundaryEffectuation, yr as isStatefulAction, yt as isDeterministicCheck, z as GitCommandAccepted, zn as ExpectedTransition, zt as HostLockEvaluation } from "./index-CTFLYvNL.js";
 import "@deepseek-ai/dsh-tools";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
@@ -21,4 +21,4 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockProfile?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_MANIFEST, SemanticAction, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as classifyUserInteraction, A as extractToolSubject, At as STOP_PROTOCOL_VERSION, B as DEFAULT_HOST_LOCK, Bt as COMMAND_SURFACE_MANIFEST, C as latestAssistantText, Ct as canonicalRegistryBase, D as supersedeItem, Dt as CERTIFICATE_VERSION, E as deriveProjection, Et as ACTION_MANIFEST_VERSION, F as parsePwshCommand, Ft as requestedTargetMatchesResolved, G as bindExecutableIdentity, Gt as sanitizeClauseText, H as GOAL_HOST_PACKAGES, Ht as canonicalizePath, I as parseShellCommand, It as semanticActionFromCommand, J as evaluateHostCapability, Jt as createProjection, K as bindLiveGoalCapability, Kt as sanitizeUrl, L as goalCompletionDenial, Lt as semanticActionFromText, M as withDurability, Mt as actionCompatible, N as canonicalArgvFromCommand, Nt as isStatefulAction, O as evidenceFromPersistedToolResult, Ot as SEMANTIC_ACTIONS, P as isRunExecutable, Pt as requestedTargetAuthorizesMutation, Q as segmentAuthorityBlocks, R as hasCurrentCertificate, Rt as validateActionManifest, S as isWholeTaskCompletionClaim, St as segmentClauses, T as PROTOCOL_V3_NOTICE, Tt as ACTION_MANIFEST, U as HOST_CAPABILITY_PACKAGE_GROUPS, Ut as digestStrings, V as EXPECTED_HOST_PACKAGES, Vt as validateManifest, W as SUPPORTED_HOST_MANIFEST, Wt as normalizeClause, X as evaluateToolSurfaceCapability, Y as evaluateHostLock, Z as authorityCaptureCounts, _ as revalidateGitPrestate, _t as classifyClause, a as packageRowsFromActiveGraph, at as DEFAULT_RECOVERY_CHAR_BUDGET, b as decideTurnBoundary, bt as extractOperation, c as resolveInstalledHostLock, ct as recoveryDigest, d as commitIndexSnapshotDigest, dt as evidenceCoverage, et as availableBoundaryQualifications, f as commitTreeSnapshotDigest, ft as evidenceMatchesItem, g as parseGitCommandManifest, gt as captureItem, h as gitCommandMatchesTarget, ht as captureClause, i as injectActiveProfileHostLock, it as certifyCheckpoint, j as isDeterministicCheck, jt as SUPPORTED_EVIDENCE_ADAPTERS, k as extractTextContent, kt as STATEFUL_ACTIONS, l as verifyComposedHostLockDump, lt as renderRecoveryPacket, m as executeRevalidatedGitEffect, mt as currentContractDigest, n as hostLockContextFromComposedDump, nt as isCurrentAcceptedBoundary, o as packageRowsFromPnpmLock, ot as closingHint, p as createGitPrestateEnvelope, pt as isVerifyingCapability, q as evaluateExternalWaitCapability, qt as sha256, r as hostLockRowsFromComposedDump, rt as qualifyBoundary, s as resolveActiveProfileHostLock, st as openItems, t as HostProfileError, tt as effectuateBoundary, u as GIT_COMMAND_MANIFEST_IDS, ut as bindingSatisfies, v as verifiedLinearCommitReadback, vt as extractArtifactPaths, w as observeAssistantOutcome, wt as npmEscapedPackageName, x as decideTurnStopping, xt as isInformationalMessage, y as classifyCompletionClaim, yt as extractMethod, z as BASE_HOST_PACKAGES, zt as validateActionTarget } from "./domain-CBvBQHTL.js";
+import { $ as segmentAuthorityBlocks, A as extractToolSubject, At as STATEFUL_ACTIONS, B as DEFAULT_HOST_LOCK, Bt as validateActionTarget, C as latestAssistantText, Ct as segmentClauses, D as supersedeItem, Dt as ACTION_MANIFEST_VERSION, E as deriveProjection, Et as ACTION_MANIFEST, F as parsePwshCommand, Ft as requestedTargetAuthorizesMutation, G as bindExecutableIdentity, Gt as normalizeClause, H as GOAL_HOST_PACKAGES, Ht as validateManifest, I as parseShellCommand, It as requestedTargetMatchesResolved, J as evaluateHostCapability, Jt as sha256, K as bindLiveGoalCapability, Kt as sanitizeClauseText, L as goalCompletionDenial, Lt as semanticActionFromCommand, M as withDurability, Mt as SUPPORTED_EVIDENCE_ADAPTERS, N as canonicalArgvFromCommand, Nt as actionCompatible, O as evidenceFromPersistedToolResult, Ot as CERTIFICATE_VERSION, P as isRunExecutable, Pt as isStatefulAction, Q as authorityCaptureCounts, R as hasCurrentCertificate, Rt as semanticActionFromText, S as isWholeTaskCompletionClaim, St as isInformationalMessage, T as PROTOCOL_V3_NOTICE, Tt as npmEscapedPackageName, U as HOST_CAPABILITY_PACKAGE_GROUPS, Ut as canonicalizePath, V as EXPECTED_HOST_PACKAGES, Vt as COMMAND_SURFACE_MANIFEST, W as HOST_COHORTS, Wt as digestStrings, X as evaluateToolSurfaceCapability, Y as evaluateHostLock, Yt as createProjection, Z as selectHostCohort, _ as revalidateGitPrestate, _t as captureItem, a as packageRowsFromActiveGraph, at as certifyCheckpoint, b as decideTurnBoundary, bt as extractMethod, c as resolveInstalledHostLock, ct as openItems, d as commitIndexSnapshotDigest, dt as bindingSatisfies, et as classifyUserInteraction, f as commitTreeSnapshotDigest, ft as evidenceCoverage, g as parseGitCommandManifest, gt as captureClause, h as gitCommandMatchesTarget, ht as currentContractDigest, i as injectActiveProfileHostLock, it as qualifyBoundary, j as isDeterministicCheck, jt as STOP_PROTOCOL_VERSION, k as extractTextContent, kt as SEMANTIC_ACTIONS, l as verifyComposedHostLockDump, lt as recoveryDigest, m as executeRevalidatedGitEffect, mt as isVerifyingCapability, n as hostLockContextFromComposedDump, nt as effectuateBoundary, o as packageRowsFromPnpmLock, ot as DEFAULT_RECOVERY_CHAR_BUDGET, p as createGitPrestateEnvelope, pt as evidenceMatchesItem, q as evaluateExternalWaitCapability, qt as sanitizeUrl, r as hostLockRowsFromComposedDump, rt as isCurrentAcceptedBoundary, s as resolveActiveProfileHostLock, st as closingHint, t as HostProfileError, tt as availableBoundaryQualifications, u as GIT_COMMAND_MANIFEST_IDS, ut as renderRecoveryPacket, v as verifiedLinearCommitReadback, vt as classifyClause, w as observeAssistantOutcome, wt as canonicalRegistryBase, x as decideTurnStopping, xt as extractOperation, y as classifyCompletionClaim, yt as extractArtifactPaths, z as BASE_HOST_PACKAGES, zt as validateActionManifest } from "./domain-DPPFAcbF.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -3466,4 +3466,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HostProfileError, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_MANIFEST, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/ARCHITECTURE.md

@@ -28,7 +28,7 @@ The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` appli
 
 The runtime rebuilds the projection from the log before each step. Before evidence is produced, the runtime awaits `ctx.sessions.flush(session)`; if no durability listener participated, evidence is marked `durability-unknown`, which fails closed.
 
-The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values and action/platform capability groups live in `manifests/supported-host.v1.json`. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
+The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values live in `manifests/supported-host.v1.json` as an exact host cohort registry: the whole graph must atomically match one audited cohort, mixed or unknown rows fail closed, and the selected cohort identity is part of every host lock digest, so switching cohorts invalidates certificate authority. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
 
 Evidence is produced only from persisted `tool/call` + `tool/result` pairs. Guard never inserts context between a Code Mode sub-call and its durable result.
 

package/docs/COMPATIBILITY.md

@@ -4,12 +4,12 @@ The current development target is pinned, not a floating claim.
 
 ## Target
 
-- DeepSeek Harness: `0.1.1-rc.2`
-- Cordis: `4.0.1`
+- DeepSeek Harness: `0.1.1-rc.2` with dshmarket `1.36.0`, or `0.1.2-alpha.2` with dshmarket `1.38.1` (both checked on macOS and Windows)
+- Cordis: `4.0.1` (rc.2 cohort) / `4.0.2` (alpha.2 cohort)
 - Node: `>= 22`
 - pnpm: `>= 11`
 
-The DSH host is a developer preview that declares breaking changes. A source build does not establish native acceptance; each profile and platform is verified separately.
+DSH is still a developer preview and may make breaking changes. Compatibility is therefore limited to two audited host sets in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). A host set is the complete list of required packages and their exact versions. Every row must match one set; missing, mixed, duplicate, unidentified, or unknown packages leave the Guard unavailable. The selected set is part of the host-lock digest, so changing sets invalidates earlier certificates. Platform support is registered only after the complete set is checked natively on that platform.
 
 ## Loader contract
 
@@ -21,7 +21,7 @@ Version 0.3 additionally accepts `hostLockPackages`, `hostLockPlatform`, and `ho
 
 ## Peer dependencies
 
-Runtime packages are host-provided and declared as peer dependencies: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-agent`, `@deepseek-ai/dsh-commands`, `@deepseek-ai/dsh-llm`, `@deepseek-ai/dsh-session`, `@deepseek-ai/dsh-tools`. Goal uses two exact optional peers as one capability: `@deepseek-ai/dsh-goal@0.1.1-rc.2` owns state, and `@deepseek-ai/dsh-tool-goal@0.1.1-rc.2` owns the audited `update_goal` name/schema/arguments. Both graph rows and the live Goal service/tool must agree. Profiles without this complete capability still load, but Goal-dependent integration is inactive. The other peer ranges remain compatible package declarations, while runtime acceptance is constrained by the exact injected host lock.
+Runtime packages are host-provided and declared as peer dependencies: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-agent`, `@deepseek-ai/dsh-commands`, `@deepseek-ai/dsh-llm`, `@deepseek-ai/dsh-session`, `@deepseek-ai/dsh-tools`. Goal uses two exact optional peers as one capability: `@deepseek-ai/dsh-goal` owns state, and `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name/schema/arguments. Both graph rows and the live Goal service/tool must agree. Profiles without this complete capability still load, but Goal-dependent integration is inactive. Peer ranges accept exactly the two audited cohort sets (`0.1.1-rc.2 || 0.1.2-alpha.2`; Cordis `4.0.1 || 4.0.2`) — never a floating range — while runtime acceptance is constrained by the exact injected host lock and its atomic cohort selection.
 
 ## Terminal outcome contract
 
@@ -54,7 +54,7 @@ certifying capability, and has unknown outcome.
 - `dsh --profile web --dump-config` and `--profile headless --dump-config` both include `context-guard`.
 - A real headless boot loads the plugin (apply, `ctx.sessions` access, and listener registration succeed) and only stops at missing provider credentials.
 
-The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. Version 0.3.0 exercises 352 deterministic tests in 19 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 351 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. The final documentation-inclusive tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
+The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. The v0.3 runtime baseline exercises 360 deterministic tests in 20 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 359 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 tests of the earlier 19-file baseline with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. Version 0.3.1 preserves those runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. The final 0.3.1 tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. The 0.3.2 source checks now cover both exact host sets on macOS and Windows; the Windows registration still needs a clean committed candidate and same-byte package acceptance, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
 
 ## Session-layer capture filter and goal completion (v0.2.1)
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,7 +2,110 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
-## v0.3.0 release gates (2026-08-31)
+## v0.3.2 source candidate gates (2026-08-31, in progress)
+
+Version 0.3.2 lets the Guard recognize either of two complete DSH package sets. It never combines packages from different sets, and a missing or mismatched package leaves the whole host unavailable. The initial host-cohort checks below were run on macOS from a working tree based on `844b62848c1e2685e0574b660dc4546b6bf6dbac`, which was `origin/main` when implementation began. They cover source behavior, not a release artifact.
+
+A later native Windows release-pack run exposed an archive-extraction portability defect: the packer passed absolute archive paths to tar. Commit `a3e77de6d8260f16f0723491495cacab57b9f62d` now runs tar from the temporary package directory with relative archive and output paths. GitHub Actions run `33413968461` passed that exact fix on Ubuntu, macOS, and Windows with Node.js 22 and 24. This is CI evidence for the packaging fix, not native alpha.2 host acceptance or final documentation-inclusive artifact evidence.
+
+Package sets checked:
+
+- The `dsh-0.1.1-rc.2` set has the same 34 package rows used by 0.3.1 and already checked on macOS and Windows.
+- The `dsh-0.1.2-alpha.2` set contains 34 exact package name, version, and integrity rows originally extracted from the active macOS runtime and Web profile with dshmarket `1.38.1`, then matched in full on native Windows. Tests confirm that the TypeScript and JSON copies match.
+- A source comparison found no change in the session events, Goal calls, tool definitions, or terminal results that the Guard uses. Internal DSH changes outside those inputs are not treated as compatibility evidence.
+
+Verified source gates (macOS, Node.js 25.1.0, pnpm 11.x):
+
+- Type checking, lint, build, and `git diff --check` pass. The 20-file suite passes 359 tests and skips one Windows-only test on macOS.
+- `pnpm run pack:check` lists the expected 26 package files. `pnpm run test:release-pack` passes exact-commit binding, repeatable package output, dirty-tree rejection, and the portable relative-path extraction flow; it does not establish a final release artifact from the current documentation-inclusive tree.
+- Read-only checking against the daily macOS Web profile reports `dsh-0.1.2-alpha.2` as supported with all 34 rows, Web control, and Goal support. The installed 0.2.1 plugin still rejects a generator-version mismatch as expected.
+
+Native Windows source evidence (2026-09-01, PowerShell 5.1):
+
+- Fresh checkout `a3e77de6d8260f16f0723491495cacab57b9f62d` passed install, build, release-pack (2/2), and `git diff --check`.
+- The active DSH `0.1.2-alpha.2` / dshmarket `1.38.1` graph matched all 34 candidate rows; missing, extra, and duplicate counts were zero. This authorizes the Windows cohort registration, but it is source/host evidence rather than final package evidence.
+
+Pending gates (each requires its own authorization and evidence):
+
+- A frozen package from a clean committed tree, followed by isolated Web and Headless install, no-op, package comparison, host check, restart, cleanup, and native macOS/Windows acceptance of those same bytes.
+- Final documentation-inclusive candidate CI, release readback, tag, npm publication, GitHub Release, and consumer pin updates.
+
+## v0.3.1 release-repair gates
+
+Version 0.3.1 preserves the v0.3 runtime and digest behavior while repairing
+the public provenance path. `scripts/release-pack.mjs` requires a clean Git
+root, resolves the full 40-character HEAD, stages the exact npm file set,
+injects that HEAD as `gitHead` only in the staged package manifest, and packs
+the staged package twice. It fails unless both tgz outputs are byte-identical
+and retain the same file count, then emits the single frozen tgz,
+`SHA256SUMS.txt`, and `release-artifact.json`. Publishing must use that tgz
+without repacking. The registry manifest, downloaded registry tgz, annotated
+tag, GitHub Release target, and checksum must all read back to the same commit
+and bytes.
+
+The focused Node test covers exact-HEAD injection, repeated-pack byte identity,
+checksum and artifact-record output, and dirty-tree rejection. Acceptance of
+the final tgz requires the full isolated Web/Headless install, no-op, package parity,
+host-lock, real restart, HTTP recovery, and cleanup lifecycle on native macOS
+and Windows before publication. CI, native-platform evidence, registry
+publication, tag identity, and GitHub Release remain separate gates.
+
+### v0.3.1 completed public release (2026-08-31)
+
+The release commit is
+`00ed5c6456e15f0859c1ef7731157d07a3903af9`. Candidate CI run
+33349603269, main CI run 33351918318, and tag CI run 33352017747 each
+passed the six Ubuntu, macOS, and Windows combinations for Node.js 22 and
+24. Public `main` readback returned the same commit. Annotated tag `v0.3.1`
+has tag-object SHA `88e6842b289a0bf0df68fcc25d09e5358d7f457d` and peels to that release
+commit.
+
+The frozen `dsh-completion-guard-0.3.1.tgz` contains 26 files and is 172923
+bytes. Its identities are:
+
+- SHA-256
+  `df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`;
+- npm shasum `b09f3844de9d957b5e15aa432833baf978483c55`;
+- npm integrity
+  `sha512-TgCFFzIoj4tpDKIGr3QrgVjUq+nPySEFWS3f9RJR9VuNqBiWUvOBZrzS5QSd4+jXp3ug7uq91fPgdh44yVROcw==`;
+- staged manifest `gitHead`
+  `00ed5c6456e15f0859c1ef7731157d07a3903af9`.
+
+That exact tgz passed isolated Web and Headless installation, strict second
+Web-install no-op, 26-of-26 package-byte parity, commit-blob parity, host-lock
+inspection/injection/dump verification, package import, intentional Headless
+`MISSING_CREDENTIAL`, fixed-port restart, HTTP recovery, and scoped cleanup on
+native macOS. Native Windows repeated the same exact-artifact lifecycle under
+an isolated supported DSH `0.1.1-rc.2` runtime after the daily runtime had
+advanced to an unsupported alpha cohort; the fail-closed version mismatch and
+the isolated rerun are both recorded in the Windows annex. The reported annex
+is 45531 bytes with SHA-256
+`5b46cac12973c287dd72445f7d0b118d91a9329d77fae1ad56e756f24a99365c`.
+The raw Windows annex remains on the Windows host, so this repository records
+its immutable identity and bounded result rather than claiming an independent
+macOS read of that file.
+
+The exact tgz was published as
+[`dsh-completion-guard@0.3.1`](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.1).
+Anonymous registry readback returned `latest=0.3.1`, the exact `gitHead`,
+shasum, integrity, 26-file count, and tarball URL. A fresh public-registry
+download had the expected SHA-256 and was byte-identical to the frozen tgz.
+
+The non-draft, non-prerelease
+[`v0.3.1` GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1)
+was published at `2026-08-31T03:04:09Z` and is the repository's latest public
+Release. Its only assets are the 172923-byte frozen tgz and the 97-byte
+`SHA256SUMS.txt`. Anonymous downloads of both assets were byte-identical to
+the frozen local files; the GitHub asset digests are respectively
+`sha256:df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`
+and
+`sha256:699764cfe8887f2a3abbaa35028abea18d6105794ea85983dff768d87239152f`.
+The release is therefore closed across source commit, annotated tag, CI,
+native-platform acceptance, npm metadata and bytes, GitHub metadata, and both
+public assets. These facts do not make the separate 0.3.0 npm publication a
+completed release and do not move or reuse its immutable identity.
+
+## v0.3.0 incomplete publication (2026-08-31)
 
 Release preparation froze one canonical pre-release package from commit
 `a33b69326eb46fbefc56affc55e2a486695f545c`. The 26-file, 170158-byte tgz
@@ -29,15 +132,24 @@ checkpoint remained incomplete and no completion certificate was issued.
 This proves the bounded evidence, boundary, and disarm paths without claiming
 that arbitrary model instructions are semantically certifiable.
 
-The release-state documentation in this commit is itself packaged and thus
-changes the tgz bytes from the pre-release artifact above. The final release
-gate therefore packs the documentation-inclusive commit once, installs and
-reads back those exact bytes separately on native macOS and Windows, and
-publishes that frozen tgz without repacking. Public identity is accepted only
-when the annotated `v0.3.0` tag, npm `gitHead` and integrity, GitHub Release
-target, published checksum, and registry package readback agree. These
-publication identities do not derive from source tests or from the earlier
-pre-release hash.
+The final documentation-inclusive source was commit
+`12e8411537b7f843aed267bc150a9403ddbb04c9`. Its frozen 26-file,
+171419-byte tgz had SHA-256
+`416b3539d38c13ea0e01b2154f342d911d4c14b81cc90d71f99e8b9bd6d6de45`
+and passed the same isolated lifecycle and same-byte package readback on native
+macOS and Windows. Main CI run 33347875843 and tag CI run 33347976931 passed
+Ubuntu, macOS, and Windows with Node.js 22 and 24. Annotated tag `v0.3.0`
+peels to that commit.
+
+The exact tgz was published as `dsh-completion-guard@0.3.0`; registry shasum
+`4c881b83b6046833229d5f54a062bfa2eea5be6f` and integrity
+`sha512-WSxbxD5N/79SJ/6UW0/XonCUlmckUhMHtj4LhUpa9u3XGC+MFZ/GUX935Y4Aqp8HJmxnj2gdHmAYmk8pcccykg==`
+identify the validated bytes. However, npm did not populate registry
+`gitHead` when publishing the prebuilt tgz. That fails this release's frozen
+public-identity gate. The version and tag remain immutable historical facts,
+but no GitHub Release is created for `v0.3.0`, and 0.3.0 is not claimed as a
+completed release. Version 0.3.1 repairs the packaging path instead of moving
+the tag, reusing the npm version, or weakening the gate after publication.
 
 ## Windows exact-source readback (2026-08-30)
 

package/docs/distribution.md

@@ -15,26 +15,45 @@ installed profiles keep their runtime identity. The previous npm package
 `dsh-context-guard` is deprecated across all published versions (0.1.0 –
 0.2.1) with a pointer to this package.
 
-## Published v0.2.1 destinations
-
-1. [GitHub Release `v0.2.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.2.1)
-   is published as a non-draft, non-prerelease release; the repository was
-   renamed after tagging and the release URL follows the rename (old URLs
-   301-redirect). The tag points at commit `ba8f05d`; the published npm
-   artifact was built from `8497300`, whose dist is byte-identical to the
-   gate build.
-2. [`dsh-completion-guard@0.2.1` on npm](https://www.npmjs.com/package/dsh-completion-guard)
-   is published and `latest` resolves to `0.2.1`. The registry packument
-   `gitHead` equals the rename commit `8497300`, maintainer `greenlv`.
-3. The committed `dist/` tree is byte-identical to the published npm tarball
-   (verified 2026-08-29 by diffing the registry tarball against the local
-   build; only `.DS_Store` is excluded and git-ignored).
+## Incomplete v0.3.0 identity
+
+`dsh-completion-guard@0.3.0` is publicly readable from npm and its tarball
+passed same-byte native macOS and Windows validation. The registry metadata
+omits the release contract's required `gitHead`, however, so `v0.3.0` is not
+listed as a completed destination and has no GitHub Release. The immutable npm
+version and annotated tag are retained for audit history; the npm version is
+deprecated with `Release metadata incomplete; use dsh-completion-guard@0.3.1.`
+Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
+
+## Published v0.3.1 destinations
+
+1. [GitHub Release `v0.3.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1)
+   is published as a non-draft, non-prerelease release. Its annotated tag
+   peels to release commit `00ed5c6456e15f0859c1ef7731157d07a3903af9`.
+   The attached frozen tgz has SHA-256
+   `df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`;
+   the separate `SHA256SUMS.txt` asset binds the same bytes.
+2. [`dsh-completion-guard@0.3.1` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.1)
+   is published and `latest` resolves to `0.3.1`. The registry packument
+   `gitHead` equals the release commit above, and a fresh registry download is
+   byte-identical to the frozen release tgz.
+3. Source commit, tag, CI, native macOS and Windows acceptance, npm metadata
+   and bytes, and both GitHub assets are reconciled in
+   [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
+
+## Earlier v0.2.1 destinations
+
+The [v0.2.1 GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.2.1)
+and [`dsh-completion-guard@0.2.1`](https://www.npmjs.com/package/dsh-completion-guard/v/0.2.1)
+remain publicly readable as historical identities. They are not the current
+install target.
 
 ## Community indexes
 
 | Channel | Entry | Status | Evidence |
 |---|---|---|---|
 | [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | `GreenLv/dsh-completion-guard` (category `security`) | Listed | Added via [PR #3693](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3693) (merge commit `299f0b5c`, 2026-08-29); read back live the same day from the generated `README.md` (line 2469, security-category section) and `README.zh.md`, the committed `data/plugins/GreenLv__dsh-completion-guard.yml`, and the published catalog at [`awesome-dsh-plugin.com/plugins.json`](https://awesome-dsh-plugin.com/plugins.json), which exposes the storefront page [`awesome-dsh-plugin.com/p/GreenLv/dsh-completion-guard/`](https://awesome-dsh-plugin.com/p/GreenLv/dsh-completion-guard/). Screenshots: declared in this repository's [`screenshots.json`](../screenshots.json) per the maintainer's post-#2937 convention (change images by pushing here; no listing PR needed). |
+| [dsh-market](https://dsh-market.com/) | `dsh-completion-guard` (Tools / Development workflow) | Listed | Added via [PR #1285](https://github.com/zhu1090093659/dsh-web/pull/1285) (merge commit `be426da`, 2026-08-31); read back on 2026-09-01 from the public [`manifest/plugins.json`](https://dsh-market.com/manifest/plugins.json) at rank 51. The market reads the listing text from its community index; npm download counts and likes are updated separately by the site. |
 | [Awesome DeepSeek Harness](https://github.com/Dominic789654/awesome-deepseek-harness#security--permissions) | `GreenLv/dsh-completion-guard` | Listed | Rows merged via [PR #332](https://github.com/Dominic789654/awesome-deepseek-harness/pull/332) (merge commit `ba414c4`, 2026-08-29) and read back live the same day from both generated READMEs (`README.md` line 940, `README.zh-CN.md` line 946), under **Security & Permissions** alongside the other fail-closed gates and verifier plugins. |
 
 ## Update route

package/docs/upstream-deltas.json

@@ -1,7 +1,7 @@
 {
   "ledgerVersion": "1",
   "description": "Delta ledger tracking how dsh-completion-guard adapts codex-context-guard protocol capabilities. Each entry separates the source fact from plan status, implementation status, deterministic tests, native platform acceptance, and release readback. A disposition of adapted/adopted with implementationStatus not-implemented is a planned alignment, not a shipped one.",
-  "snapshotBoundary": "Pre-release planning snapshot retained for historical traceability. Candidate labels and empty release readbacks describe the planning state when each row was recorded, not the current package status. Use CHANGELOG.md and docs/LOCAL_ACCEPTANCE.md for v0.3.0 release and validation state.",
+  "snapshotBoundary": "Pre-release planning snapshot retained for historical traceability. Candidate labels and empty release readbacks describe the planning state when each row was recorded, not the current package status. Use CHANGELOG.md and docs/LOCAL_ACCEPTANCE.md for the v0.3.0 publication attempt and v0.3.1 release-repair state.",
   "source": {
     "product": "codex-context-guard",
     "version": "v0.9.4",