dsh-completion-guard 0.3.1 → 0.4.0

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,6 +2,98 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
+## v0.4.0 release contract and pre-release history (2026-09-02)
+
+Version 0.4.0 targets DSH `0.1.2-alpha.3` with dshmarket `1.39.0` and Cordis `4.0.2`. The repository does not place a candidate's own commit, checksum, or public status inside that candidate's packaged documentation: those facts are generated after the package bytes are frozen and are attached to the GitHub Release.
+
+| Gate | Required evidence and location |
+| --- | --- |
+| Source and CI | one clean release commit; repository matrix plus Ubuntu, macOS, and Windows Node.js 22/24 CI |
+| Exact artifact | one deterministic 26-file tgz; full `gitHead`, SHA-256, npm shasum, integrity, size, and file count in `release-artifact.json` and `SHA256SUMS.txt` |
+| Native macOS and Windows | the same tgz on both platforms; separate machine-readable annexes covering isolated Web and Headless lifecycle, host-lock, restart, daily-profile preservation, and cleanup |
+| Tag, npm, and GitHub Release | annotated tag, npm manifest and downloaded package, Release target and assets, and anonymous public readback all resolve to the same commit and bytes |
+| Daily-profile upgrade | separate from release acceptance; never implied by a passing artifact run |
+
+### Superseded pre-release artifacts
+
+The first 26-file candidate, SHA-256 `33757ce11633ac167fa9c5a6fdb7a8938578fcb871edd9afdb2f89dcb51b4316`, was built from implementation baseline `ffc6fe9e1246a815f0bb630943c59d14b6505716`. Native macOS passed. Native Windows reached the restart endpoint but did not prove a changed boot ID, so its Headless phase correctly remained unrun. That candidate was superseded when packaged documentation changed.
+
+The next 26-file candidate, SHA-256 `f3489e0f1edbb81e0ebdbd33e43a14e46913496cb3e1c799115143a70d2ab4c9`, was built from `ae20bffd06af45d4a0c60519f5ab7a7af6076ec8`. Its exact bytes passed isolated native macOS and Windows Web and Headless acceptance; the Windows R2 record contained 25 passing gates. Publication was still rejected because the package itself repeated the superseded candidate's blocked status and said another package still had to be built. That documentation defect is why a later release candidate is required; the native results remain valid only for `f3489e0f...`.
+
+## v0.3.2 release gates (2026-09-01, passed)
+
+The release candidate is commit
+`22cde6106cdca511265bb4103375a263a0762b9c`. Its frozen
+`dsh-completion-guard-0.3.2.tgz` contains 26 files, is 181157 bytes, and has
+SHA-256
+`feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`.
+The package manifest carries the same full commit as `gitHead`. Candidate CI
+run 33461879125 passed Ubuntu, macOS, and Windows on Node.js 22 and 24.
+
+Those exact package bytes passed the required isolated Web and Headless
+lifecycle on native Windows and macOS: artifact and commit parity, clean
+install, strict Web reinstall no-op, installed-file parity, complete 34-row
+host checks, plugin load and configuration readback, real Web restart with
+403 rejection and 202 acceptance, changed boot ID, HTTP recovery, intentional
+Headless `MISSING_CREDENTIAL`, and scoped cleanup. The platform-specific host
+digests differ because platform identity is part of the lock; both match their
+own complete checked package graph. The optional credentialed model-session
+gate was not run and is not claimed.
+
+`inspect` and `verify-dump` answer different questions. `inspect` reports
+whether the active runtime and profile package graph is a supported complete
+set, so it can correctly return `supported` before injection. The pre-injection
+fail-closed check comes from reading the composed config and from
+`verify-dump`, which rejects missing or mismatched injected host-lock data.
+
+The annotated `v0.3.2` tag has tag-object SHA
+`753fd9625c58c03de2660464c7f7c86462a42eb1` and peels to the release commit
+above. Tag CI run 33474979019 passed the same six Ubuntu, macOS, and Windows
+Node.js 22/24 combinations. npm published this exact tgz at
+`2026-09-01T05:54:28.309Z`; anonymous registry readback returned
+`latest=0.3.2`, the expected `gitHead`, shasum and integrity, and a fresh
+download was byte-identical to the frozen file.
+
+The non-draft, non-prerelease
+[`v0.3.2` GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.2)
+was published at `2026-09-01T05:56:24Z`. Its 181157-byte tgz and 97-byte
+`SHA256SUMS.txt` have GitHub asset digests
+`sha256:feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`
+and
+`sha256:82f839d3ccf5f429b10ae18cc54350379097f0f59b01a462ed222a869886a451`.
+Anonymous downloads of both assets were byte-identical to the frozen files.
+
+This section is a post-candidate evidence record and is not part of the
+accepted tgz. Changing the package bytes or release commit would still require
+new artifact and native-platform acceptance. Consumer pin and managed runtime
+installation remain separate actions.
+
+### Earlier source and host-cohort gates
+
+Version 0.3.2 lets the Guard recognize either of two complete DSH package sets. It never combines packages from different sets, and a missing or mismatched package leaves the whole host unavailable. The initial host-cohort checks below were run on macOS from a working tree based on `844b62848c1e2685e0574b660dc4546b6bf6dbac`, which was `origin/main` when implementation began. They cover source behavior, not a release artifact.
+
+A later native Windows release-pack run exposed an archive-extraction portability defect: the packer passed absolute archive paths to tar. Commit `a3e77de6d8260f16f0723491495cacab57b9f62d` now runs tar from the temporary package directory with relative archive and output paths. GitHub Actions run `33413968461` passed that exact fix on Ubuntu, macOS, and Windows with Node.js 22 and 24. This is CI evidence for the packaging fix, not native alpha.2 host acceptance or final documentation-inclusive artifact evidence.
+
+Package sets checked:
+
+- The `dsh-0.1.1-rc.2` set has the same 34 package rows used by 0.3.1 and already checked on macOS and Windows.
+- The `dsh-0.1.2-alpha.2` set contains 34 exact package name, version, and integrity rows originally extracted from the active macOS runtime and Web profile with dshmarket `1.38.1`, then matched in full on native Windows. Tests confirm that the TypeScript and JSON copies match.
+- A source comparison found no change in the session events, Goal calls, tool definitions, or terminal results that the Guard uses. Internal DSH changes outside those inputs are not treated as compatibility evidence.
+
+Verified source gates (macOS, Node.js 25.1.0, pnpm 11.x):
+
+- Type checking, lint, build, and `git diff --check` pass. The 20-file suite passes 359 tests and skips one Windows-only test on macOS.
+- `pnpm run pack:check` lists the expected 26 package files. `pnpm run test:release-pack` passes exact-commit binding, repeatable package output, dirty-tree rejection, and the portable relative-path extraction flow; it does not establish a final release artifact from the current documentation-inclusive tree.
+- Read-only checking against the daily macOS Web profile reports `dsh-0.1.2-alpha.2` as supported with all 34 rows, Web control, and Goal support. The installed 0.2.1 plugin still rejects a generator-version mismatch as expected.
+
+Native Windows source evidence (2026-09-01, PowerShell 5.1):
+
+- Fresh checkout `a3e77de6d8260f16f0723491495cacab57b9f62d` passed install, build, release-pack (2/2), and `git diff --check`.
+- The active DSH `0.1.2-alpha.2` / dshmarket `1.38.1` graph matched all 34 candidate rows; missing, extra, and duplicate counts were zero. This authorizes the Windows cohort registration, but it is source/host evidence rather than final package evidence.
+
+The frozen artifact above closes the package and native-platform lifecycle
+gates. Release mutation and public readback remain separate.
+
 ## v0.3.1 release-repair gates
 
 Version 0.3.1 preserves the v0.3 runtime and digest behavior while repairing
@@ -22,6 +114,61 @@ host-lock, real restart, HTTP recovery, and cleanup lifecycle on native macOS
 and Windows before publication. CI, native-platform evidence, registry
 publication, tag identity, and GitHub Release remain separate gates.
 
+### v0.3.1 completed public release (2026-08-31)
+
+The release commit is
+`00ed5c6456e15f0859c1ef7731157d07a3903af9`. Candidate CI run
+33349603269, main CI run 33351918318, and tag CI run 33352017747 each
+passed the six Ubuntu, macOS, and Windows combinations for Node.js 22 and
+24. Public `main` readback returned the same commit. Annotated tag `v0.3.1`
+has tag-object SHA `88e6842b289a0bf0df68fcc25d09e5358d7f457d` and peels to that release
+commit.
+
+The frozen `dsh-completion-guard-0.3.1.tgz` contains 26 files and is 172923
+bytes. Its identities are:
+
+- SHA-256
+  `df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`;
+- npm shasum `b09f3844de9d957b5e15aa432833baf978483c55`;
+- npm integrity
+  `sha512-TgCFFzIoj4tpDKIGr3QrgVjUq+nPySEFWS3f9RJR9VuNqBiWUvOBZrzS5QSd4+jXp3ug7uq91fPgdh44yVROcw==`;
+- staged manifest `gitHead`
+  `00ed5c6456e15f0859c1ef7731157d07a3903af9`.
+
+That exact tgz passed isolated Web and Headless installation, strict second
+Web-install no-op, 26-of-26 package-byte parity, commit-blob parity, host-lock
+inspection/injection/dump verification, package import, intentional Headless
+`MISSING_CREDENTIAL`, fixed-port restart, HTTP recovery, and scoped cleanup on
+native macOS. Native Windows repeated the same exact-artifact lifecycle under
+an isolated supported DSH `0.1.1-rc.2` runtime after the daily runtime had
+advanced to an unsupported alpha cohort; the fail-closed version mismatch and
+the isolated rerun are both recorded in the Windows annex. The reported annex
+is 45531 bytes with SHA-256
+`5b46cac12973c287dd72445f7d0b118d91a9329d77fae1ad56e756f24a99365c`.
+The raw Windows annex remains on the Windows host, so this repository records
+its immutable identity and bounded result rather than claiming an independent
+macOS read of that file.
+
+The exact tgz was published as
+[`dsh-completion-guard@0.3.1`](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.1).
+Anonymous registry readback returned `latest=0.3.1`, the exact `gitHead`,
+shasum, integrity, 26-file count, and tarball URL. A fresh public-registry
+download had the expected SHA-256 and was byte-identical to the frozen tgz.
+
+The non-draft, non-prerelease
+[`v0.3.1` GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1)
+was published at `2026-08-31T03:04:09Z` and is the repository's latest public
+Release. Its only assets are the 172923-byte frozen tgz and the 97-byte
+`SHA256SUMS.txt`. Anonymous downloads of both assets were byte-identical to
+the frozen local files; the GitHub asset digests are respectively
+`sha256:df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`
+and
+`sha256:699764cfe8887f2a3abbaa35028abea18d6105794ea85983dff768d87239152f`.
+The release is therefore closed across source commit, annotated tag, CI,
+native-platform acceptance, npm metadata and bytes, GitHub metadata, and both
+public assets. These facts do not make the separate 0.3.0 npm publication a
+completed release and do not move or reuse its immutable identity.
+
 ## v0.3.0 incomplete publication (2026-08-31)
 
 Release preparation froze one canonical pre-release package from commit

package/docs/PORTING_NOTES.md

@@ -1,6 +1,9 @@
 # Porting Notes
 
-The DSH implementation ports deterministic Context Guard semantics from `GreenLv/codex-context-guard` v0.8.8 while replacing the platform layer.
+The DSH implementation started from `GreenLv/codex-context-guard` v0.8.8 and
+replaced the Codex platform layer. That version is provenance, not the current
+compatibility claim. Shared behavior now advances through pinned conformance
+fixtures and an explicit delta ledger.
 
 | Area | Treatment |
 | --- | --- |
@@ -9,6 +12,13 @@ The DSH implementation ports deterministic Context Guard semantics from `GreenLv
 | evidence and proof binding | Adapt to DSH durable tool-result events |
 | recovery and stop policy | Adapt to DSH agent lifecycle |
 | Codex hooks, cache manager, Python runtime | Delete from DSH runtime |
-| multimodal assets, subagent provenance, rollover | Defer beyond 0.1.0 |
+| portable protocol and digest fixtures | Mirror exact upstream bytes and verify their hashes |
+| product-specific or newer Codex behavior | Record explicitly in the delta ledger before porting |
 
-The DSH port derives all guard state from natively persisted DSH session events (`command/run`, `user/message`, `tool/call`, `tool/result`, `tool/code-dispatch*`) instead of the removed custom event vocabulary, wires the completion gate to Goal interception and agent scoping, and enforces fail-closed certification. Native isolated real-model acceptance has passed on macOS and Windows, and the public npm package has been loaded and exercised in a real macOS Web profile. These results cover the bounded v0.1 command subset; they do not broaden it into general shell or PowerShell analysis or claim a second Windows run from the public package.
+The DSH port derives guard state from native DSH session events, connects the
+completion gate to Goal handling, and fails closed when it cannot verify the
+host or evidence. Version 0.3.2 has passed same-package Web and Headless
+lifecycle checks on macOS and Windows. This does not make the two products
+interchangeable or imply full parity with Codex 0.9.5; current gaps are listed
+in [`SEMANTIC_COMPATIBILITY.md`](SEMANTIC_COMPATIBILITY.md) and
+[`upstream-deltas.json`](upstream-deltas.json).

package/docs/SEMANTIC_COMPATIBILITY.md

@@ -29,15 +29,15 @@ Authority rules:
   values are pinned in `tests/fixtures/conformance/UPSTREAM_PIN.json`; the
   vitest suite fails when any mirror drifts from its pinned hash.
 - `UPSTREAM_PIN.json` records the upstream head at mirror time, the mirror
-  date, and per-file hashes. The canonical files were created in an upstream
-  working tree pending commit, so `canonicalCommit` is `pending` until the
-  upstream commit that lands them exists; refresh the pin when re-syncing.
+  date, and per-file hashes. Its current `canonicalCommit` is the landed
+  upstream commit `b59fcfe1aaf8ead3f0438bc67dc7f725c869a473`; refresh the pin
+  whenever the mirrors are re-synced.
 - New protocol cases discovered on the DSH side are turned into
   platform-neutral fixture cases upstream first; host-specific expectations
   never enter the shared fixture.
-- `docs/UPSTREAM_BASE.md` records the historical v0.1.0 baseline. It is a
-  historical fact, not a claim that DSH implements Codex protocol versions;
-  current alignment status lives in this document and the delta ledger.
+- `docs/UPSTREAM_BASE.md` records the Codex v0.8.8 source used for the first
+  DSH v0.1.0 port. It is a historical fact, not the current alignment claim;
+  current status lives in this document and the delta ledger.
 
 ## Digest v3
 
@@ -79,9 +79,18 @@ event vocabulary `root_message`, `delegated_message`, `tool_result`,
 runner executes every mirrored case without skips and compares the bounded
 result contract; it does not translate a missing capability into a pass.
 
-## Current alignment status (honest boundaries)
+## Current 0.4.0 alignment status
 
-Implemented in v0.3.0:
+The semantic implementation described here entered the DSH `0.4.0` line from implementation baseline `ffc6fe9e1246a815f0bb630943c59d14b6505716`. The shared-contract reference is the Codex `0.10.0` source at `e4fccf690bcbc2be79d0b8d42a1a269f87072120`; this covers only the named contracts, not full product parity. Exact release commit, artifact, native-platform, and publication identities are recorded outside this semantic document because each is a separate evidence scope.
+
+The 0.4.0 implementation baseline keeps the v0.3 digest and conformance work and adds:
+
+- Proof obligations that must name a current pending item and use evidence matching the requested kind, surface, subject, operation, and outcome.
+- Bounded subject readback, scope coverage, state verification, and replayable `sessionQuery` state.
+- Fail-closed rejection for tampered asset or scope digests, empty subject sets, and evidence imported from another session.
+- The alpha.3 host cohort as the implementation baseline: DSH `0.1.2-alpha.3`, dshmarket `1.39.0`, and Cordis `4.0.2`.
+
+Retained from v0.3.0:
 
 - Digest v3 derivation, byte-mirror pinning, and 29-vector agreement.
 - All-case portable semantic fixture runner implemented as a thin adapter over production derive/checkpoint/boundary/Goal/stop functions, without fixture-ID rewrites or skipped cases.
@@ -94,14 +103,9 @@ Implemented in v0.3.0:
   the Guard-owned `update_goal(action=complete)` path.
 - Legacy generic-run and unprovable-authority fail-closed migration behavior.
 
-This is not a full product-parity claim. It does not copy the Codex private
-ledger, Hook lifecycle, cache, or installer, and it cannot prevent all trusted
-in-process Goal/session bypasses. Exact-artifact isolated Web/Headless install,
-host-lock readback, Web restart lifecycle, and Headless load were exercised on
-native macOS and Windows, with cross-platform CI and a bounded credentialed
-model-session evidence/boundary round. Source, native-platform, model-session,
-registry, tag, and GitHub Release evidence remain separate scopes; see
-`LOCAL_ACCEPTANCE.md`.
+This is not a full product-parity claim. It does not copy the Codex private ledger, Hook lifecycle, cache, or installer, and it cannot prevent all trusted in-process Goal/session bypasses.
+
+Main CI run `33540907051` passed the implementation baseline. The release commit adds the packaged documentation and must pass its own CI; its deterministic tgz must then pass same-byte native macOS and Windows acceptance before publication. Historical candidate results remain bound to their recorded SHA-256 values and never transfer to changed bytes; see [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
 
 ## Validation boundaries
 

package/docs/UPSTREAM_BASE.md

@@ -2,7 +2,7 @@
 
 This repository ports deterministic semantics from an existing Codex product; it is a new, independently owned repository with a fresh history.
 
-## Semantic baseline
+## Historical starting point
 
 - Repository: `https://github.com/GreenLv/codex-context-guard`
 - Version: `v0.8.8`
@@ -11,6 +11,13 @@ This repository ports deterministic semantics from an existing Codex product; it
 - License: Apache-2.0
 - Key contracts: private state schema 7, Proof protocol 1.0.0, Stop protocol 1.1.0
 
+These values identify the source used for the first DSH port. They do not say
+that current DSH behavior stops at Codex v0.8.8 or fully matches a later Codex
+release. Current shared behavior and remaining gaps are tracked in
+[`SEMANTIC_COMPATIBILITY.md`](SEMANTIC_COMPATIBILITY.md),
+[`upstream-deltas.json`](upstream-deltas.json), and the pinned conformance
+fixtures.
+
 ## Reused vs replaced
 
 Reused as behavior: canonicalization, hashing, stable identity, requirement/acceptance/prohibition capture, append-only supersession, evidence outcome classification, subject/surface matching, proof and stop semantics, recovery priority, completion classification.

package/docs/distribution.md

@@ -21,29 +21,55 @@ installed profiles keep their runtime identity. The previous npm package
 passed same-byte native macOS and Windows validation. The registry metadata
 omits the release contract's required `gitHead`, however, so `v0.3.0` is not
 listed as a completed destination and has no GitHub Release. The immutable npm
-version and annotated tag are retained for audit history. Version 0.3.1 repairs
-the provenance-bearing frozen-package workflow.
-
-## Published v0.2.1 destinations
-
-1. [GitHub Release `v0.2.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.2.1)
-   is published as a non-draft, non-prerelease release; the repository was
-   renamed after tagging and the release URL follows the rename (old URLs
-   301-redirect). The tag points at commit `ba8f05d`; the published npm
-   artifact was built from `8497300`, whose dist is byte-identical to the
-   gate build.
-2. [`dsh-completion-guard@0.2.1` on npm](https://www.npmjs.com/package/dsh-completion-guard)
-   is published and `latest` resolves to `0.2.1`. The registry packument
-   `gitHead` equals the rename commit `8497300`, maintainer `greenlv`.
-3. The committed `dist/` tree is byte-identical to the published npm tarball
-   (verified 2026-08-29 by diffing the registry tarball against the local
-   build; only `.DS_Store` is excluded and git-ignored).
+version and annotated tag are retained for audit history; the npm version is
+deprecated with `Release metadata incomplete; use dsh-completion-guard@0.3.1.`
+Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
+
+## Published v0.3.2 destinations
+
+1. [GitHub Release `v0.3.2`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.2)
+   is the latest non-draft, non-prerelease release. Its annotated tag peels to
+   release commit `22cde6106cdca511265bb4103375a263a0762b9c`. The attached
+   frozen tgz has SHA-256
+   `feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`;
+   the separate `SHA256SUMS.txt` asset binds the same bytes.
+2. [`dsh-completion-guard@0.3.2` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.2)
+   is published and `latest` resolves to `0.3.2`. The registry `gitHead`
+   equals the release commit, and a fresh registry download is byte-identical
+   to the frozen release tgz.
+3. Source commit, tag, CI, native macOS and Windows acceptance, npm metadata
+   and bytes, and both GitHub assets are reconciled in
+   [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
+
+## Earlier v0.3.1 destinations
+
+1. [GitHub Release `v0.3.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.1)
+   is published as a non-draft, non-prerelease release. Its annotated tag
+   peels to release commit `00ed5c6456e15f0859c1ef7731157d07a3903af9`.
+   The attached frozen tgz has SHA-256
+   `df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`;
+   the separate `SHA256SUMS.txt` asset binds the same bytes.
+2. [`dsh-completion-guard@0.3.1` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.1)
+   is published and `latest` resolves to `0.3.1`. The registry packument
+   `gitHead` equals the release commit above, and a fresh registry download is
+   byte-identical to the frozen release tgz.
+3. Source commit, tag, CI, native macOS and Windows acceptance, npm metadata
+   and bytes, and both GitHub assets are reconciled in
+   [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
+
+## Earlier v0.2.1 destinations
+
+The [v0.2.1 GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.2.1)
+and [`dsh-completion-guard@0.2.1`](https://www.npmjs.com/package/dsh-completion-guard/v/0.2.1)
+remain publicly readable as historical identities. They are not the current
+install target.
 
 ## Community indexes
 
 | Channel | Entry | Status | Evidence |
 |---|---|---|---|
-| [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | `GreenLv/dsh-completion-guard` (category `security`) | Listed | Added via [PR #3693](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3693) (merge commit `299f0b5c`, 2026-08-29); read back live the same day from the generated `README.md` (line 2469, security-category section) and `README.zh.md`, the committed `data/plugins/GreenLv__dsh-completion-guard.yml`, and the published catalog at [`awesome-dsh-plugin.com/plugins.json`](https://awesome-dsh-plugin.com/plugins.json), which exposes the storefront page [`awesome-dsh-plugin.com/p/GreenLv/dsh-completion-guard/`](https://awesome-dsh-plugin.com/p/GreenLv/dsh-completion-guard/). Screenshots: declared in this repository's [`screenshots.json`](../screenshots.json) per the maintainer's post-#2937 convention (change images by pushing here; no listing PR needed). |
+| [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | `GreenLv/dsh-completion-guard` (category `security`) | Listed | Added via [PR #3693](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3693) (merge commit `299f0b5c`, 2026-08-29). The shorter plain-language English and Chinese descriptions merged via [PR #3977](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3977) (merge commit `bdf5145`, 2026-09-01) and were read back from the current generated READMEs, source YAML, and public [`plugins.json`](https://awesome-dsh-plugin.com/plugins.json). The detail page still showed the earlier wording and GitHub install command at readback, so that page refresh remains pending. Screenshots are declared in this repository's [`screenshots.json`](../screenshots.json); image changes do not need a listing PR. |
+| [dsh-market](https://dsh-market.com/) | `dsh-completion-guard` (Tools / Development workflow) | Listed | Added via [PR #1285](https://github.com/zhu1090093659/dsh-web/pull/1285) (merge commit `be426da`, 2026-08-31); read back on 2026-09-01 from the public [`manifest/plugins.json`](https://dsh-market.com/manifest/plugins.json) at rank 51. The market reads the listing text from its community index; npm download counts and likes are updated separately by the site. |
 | [Awesome DeepSeek Harness](https://github.com/Dominic789654/awesome-deepseek-harness#security--permissions) | `GreenLv/dsh-completion-guard` | Listed | Rows merged via [PR #332](https://github.com/Dominic789654/awesome-deepseek-harness/pull/332) (merge commit `ba414c4`, 2026-08-29) and read back live the same day from both generated READMEs (`README.md` line 940, `README.zh-CN.md` line 946), under **Security & Permissions** alongside the other fail-closed gates and verifier plugins. |
 
 ## Update route

package/docs/upstream-deltas.json

@@ -199,11 +199,11 @@
     },
     {
       "capability": "surface-intent-and-capability-binding",
-      "sourceFact": "Codex v0.9.4 carries the deterministic proof contract surface classifier whose substring misclassification and capability adaptation gaps are scheduled for repair in v0.9.5/v0.10.0 (canonical locator, capability trust root, clause-level surface intent).",
+      "sourceFact": "Published Codex v0.9.5 narrows UI wording detection and binds task, file, Windows-path, and capability evidence to the exact item that was read.",
       "disposition": "deferred",
       "targetRelease": "dsh-completion-guard v0.4.0",
-      "rationale": "DSH Layer B reuses the Codex canonical locator, capability priority, and clause-derived surface tuple semantics via portable fixtures after the Codex repair lands; DSH must not fork its own binding rules.",
-      "planStatus": "deferred until Codex v0.9.5/v0.10.0 semantics freeze",
+      "rationale": "DSH should port the published Codex locator, capability priority, and clause-level binding rules through shared fixtures instead of creating different rules.",
+      "planStatus": "Codex v0.9.5 semantics are published; DSH implementation remains deferred to v0.4.0",
       "implementationStatus": "not-implemented",
       "tests": [],
       "plannedTests": [