dsh-completion-guard 0.3.2 → 0.4.0

package/dist/{index-CTFLYvNL.d.ts → index-AtjJOrK8.d.ts}

@@ -253,6 +253,8 @@ interface GuardProjection {
   hostLockDigest: string;
   hostStatus: HostStatus;
   hostReasonCode?: string;
+  /** Readback of the audited cohort bound into `hostLockDigest`. */
+  hostCohortId?: string;
   currentGoalRef?: GoalRef;
   currentGoalPhase?: "active" | "paused" | "blocked" | "complete";
   currentGoalActivation?: "armed" | "disarmed";
@@ -470,12 +472,29 @@ interface HostCohort {
   capabilities: CapabilityRow[];
 }
 /**
+* alpha.2 audited package identities (second registry cohort), hoisted so the
+* alpha.2 + dshmarket 1.39.0 cohort can reuse the exact natively audited rows
+* with only the dshmarket identity substituted.
+*/
+declare const ALPHA2_HOST_PACKAGES: PackageRow[];
+/**
+* The exact graph the Windows daily runtime realized when it upgraded
+* dshmarket to 1.39.0 on an otherwise alpha.2 install — the combination whose
+* rejection was Guard 0.3.2's real web_control failure. It is one audited
+* whole-graph cohort: alpha.2 rows keep their native macOS/Windows audit
+* identities and the dshmarket 1.39.0 identity is the authoritative row from
+* the 2026-09-01 alpha.3 annex audit. Guard 0.4.0 supports this combination.
+*/
+declare const ALPHA2_DSHMARKET_139_HOST_PACKAGES: PackageRow[];
+/**
 * Audited host cohort registry. The rc.2 cohort keeps the exact identities
 * audited for 0.3.0/0.3.1 on macOS and Windows. The alpha.2 cohort carries the
 * exact package graph extracted from native macOS and Windows DSH
-* `0.1.2-alpha.2` / dshmarket `1.38.1` runtimes. Graphs that mix cohorts,
-* lack rows, duplicate rows, or use
-* versions outside both cohorts fail closed.
+* `0.1.2-alpha.2` / dshmarket `1.38.1` runtimes. The alpha.2+dshmarket-1.39.0
+* cohort carries the exact upgraded-Windows graph. The alpha.3 cohort carries
+* the graph audited in the 2026-09-01 annex. Graphs that mix cohorts, lack
+* rows, duplicate rows, or use identities outside every registered cohort
+* fail closed.
 */
 declare const HOST_COHORTS: readonly HostCohort[];
 /**
@@ -944,6 +963,59 @@ declare function evidenceMatchesItem(item: GuardItem, evidence: GuardEvidence):
 */
 declare function bindingSatisfies(projection: GuardProjection, item: GuardItem, evidenceIds: string[]): boolean;
 //#endregion
+//#region src/domain/proof.d.ts
+declare const PROOF_PROTOCOL_VERSION = "0.4.0";
+declare const PROOF_KINDS: readonly ["subject_readback", "scope_coverage", "state_verification"];
+type ProofKind = (typeof PROOF_KINDS)[number];
+type ProofSurface = "artifact" | "ui" | "visual" | "scope";
+interface ProofObligation {
+  obligationId: string;
+  kind: ProofKind;
+  surface: ProofSurface;
+  subjectIds: string[];
+  evidenceIds: string[];
+  expectedScopeDigest?: string;
+  observedScopeDigest?: string;
+}
+interface ProofManifest {
+  proofProtocolVersion: typeof PROOF_PROTOCOL_VERSION;
+  obligations: ProofObligation[];
+  proofSha256: string;
+  assetSetSha256?: string;
+}
+interface SessionQuery {
+  sessionRefDigest: string;
+  epoch: number;
+  contractRevision: number;
+  state: "valid" | "unknown" | "corrupt";
+  proof?: ProofManifest;
+  cohortId?: string;
+  /** Set only when a presented proof made the query unverifiable. */
+  reasonCode?: "proof_invalid" | "proof_unbound";
+}
+/**
+* The manifest digest root includes every integrity-bearing field, so a
+* tampered asset-set digest is exactly as detectable as a tampered obligation.
+*/
+declare function proofDigest(obligations: readonly ProofObligation[], assetSetSha256?: string): string;
+declare function validateProofManifest(manifest: unknown): string[];
+declare function createProofManifest(obligations: readonly ProofObligation[], assetSetSha256?: string): ProofManifest;
+/**
+* Bind a structurally valid proof to the actual replayed projection: every
+* obligation must name a pending item, every evidence id must exist in the
+* projection, and every bound evidence must satisfy the obligation's kind,
+* surface, subject, and outcome constraints. An empty projection therefore
+* rejects any proof, and cross-item or foreign evidence can never bind.
+*/
+declare function bindProofToProjection(projection: GuardProjection, proof: ProofManifest): string[];
+declare function canonicalProjection(projection: GuardProjection): Record<string, unknown>;
+declare function sessionQuery(projection: GuardProjection, proof?: ProofManifest): SessionQuery;
+declare function proofEvidenceConstraints(evidence: GuardEvidence, obligation: ProofObligation): boolean;
+//#endregion
+//#region src/domain/alpha3-host.d.ts
+/** Exact 34-row alpha.3 runtime/web graph from the 2026-09-01 annex audit. */
+declare const ALPHA3_HOST_PACKAGES: PackageRow[];
+//#endregion
 //#region src/domain/recovery.d.ts
 interface RecoveryOptions {
   rejectedBindings?: Array<{
@@ -1004,4 +1076,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { gitCommandMatchesTarget as $, TargetCaptureReasonCode as $n, AuthorityBlockKind as $t, hostLockRowsFromComposedDump as A, DeferAuthorization as An, sanitizeUrl as Ar, HOST_CAPABILITY_PACKAGE_GROUPS as At, GitCommandManifest as B, ExternalOperation as Bn, HostLockStatus as Bt, CommandSurfaceManifest as C, GoalBoundaryAccess as Cn, semanticActionFromText as Cr, AuditedExecutable as Ct, ActiveProfileHostLock as D, qualifyBoundary as Dn, digestStrings as Dr, ExecutableIdentity as Dt, validateManifest as E, isCurrentAcceptedBoundary as En, canonicalizePath as Er, EXPECTED_HOST_PACKAGES as Et, resolveInstalledHostLock as F, EvidenceBinding as Fn, HostCohort as Ft, GitPrestateCheck as G, GuardIntegrity as Gn, bindLiveGoalCapability as Gt, GitCommandRejected as H, GuardBoundary as Hn, HostProfileKind as Ht, verifyComposedHostLockDump as I, EvidenceOutcome as In, HostCohortSelection as It, LinearCommitReadback as J, GuardItemStatus as Jn, evaluateHostLock as Jt, GitPrestateEnvelope as K, GuardItem as Kn, evaluateExternalWaitCapability as Kt, GIT_COMMAND_MANIFEST_IDS as L, EvidenceParseStatus as Ln, HostCohortSelectionReason as Lt, packageRowsFromActiveGraph as M, DeriveResult as Mn, HostCapabilityEvaluation as Mt, packageRowsFromPnpmLock as N, DeriveScope as Nn, HostCapabilityId as Nt, HostProfileError as O, BoundaryDisposition as On, normalizeClause as Or, ExecutableIdentityBinding as Ot, resolveActiveProfileHostLock as P, DerivedEnvelope as Pn, HostCapabilityRequest as Pt, executeRevalidatedGitEffect as Q, PersistenceAuthorization as Qn, AuthorityBlock as Qt, GitAdapterAction as R, EvidenceRole as Rn, HostLockContext as Rt, COMMAND_SURFACE_MANIFEST as S, GoalActivationState as Sn, semanticActionFromCommand as Sr, deriveProjection as St, OperationVerbEntry as T, effectuateBoundary as Tn, validateActionTarget as Tr, DEFAULT_HOST_LOCK as Tt, GitEffectExecution as U, GuardCheckpoint as Un, HostToolSurface as Ut, GitCommandParseResult as V, GoalRef as Vn, HostPlatform as Vt, GitEffectRunner as W, GuardEvidence as Wn, bindExecutableIdentity as Wt, commitTreeSnapshotDigest as X, GuardProjection as Xn, selectHostCohort as Xt, commitIndexSnapshotDigest as Y, GuardOperation as Yn, evaluateToolSurfaceCapability as Yt, createGitPrestateEnvelope as Z, HostStatus as Zn, currentContractDigest as Zt, EvidenceFacetCoverage as _, isInformationalMessage as _n, StatefulAction as _r, extractTextContent as _t, classifyCompletionClaim as a, CheckpointResult as an, createProjection as ar, ParsedShell as at, evidenceMatchesItem as b, BoundaryQualification as bn, requestedTargetAuthorizesMutation as br, withDurability as bt, isWholeTaskCompletionClaim as c, CaptureScope as cn, ACTION_MANIFEST_VERSION as cr, isRunExecutable as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, captureClause as dn, CERTIFICATE_VERSION as dr, goalCompletionDenial as dt, AuthorityKind as en, TargetCaptureStatus as er, parseGitCommandManifest as et, RecoveryOptions as f, captureItem as fn, SEMANTIC_ACTIONS as fr, hasCurrentCertificate as ft, renderRecoveryPacket as g, extractOperation as gn, SemanticAction as gr, evidenceFromPersistedToolResult as gt, recoveryDigest as h, extractMethod as hn, SUPPORTED_EVIDENCE_ADAPTERS as hr, ToolSubject as ht, TurnStoppingDecision as i, classifyUserInteraction as in, WaitAuthorization as ir, CanonicalCommandSurface as it, injectActiveProfileHostLock as j, DeriveConfig as jn, sha256 as jr, HOST_COHORTS as jt, hostLockContextFromComposedDump as k, BoundaryQualificationKind as kn, sanitizeClauseText as kr, GOAL_HOST_PACKAGES as kt, latestAssistantText as l, ClassifiedClause as ln, ActionManifest as lr, parsePwshCommand as lt, openItems as m, extractArtifactPaths as mn, STOP_PROTOCOL_VERSION as mr, ToolResultInput as mt, AssistantOutcomeObservation as n, segmentAuthorityBlocks as nn, TargetValue as nr, verifiedLinearCommitReadback as nt, decideTurnBoundary as o, RejectedBinding as on, PackageRow as or, ShellParseStatus as ot, closingHint as p, classifyClause as pn, STATEFUL_ACTIONS as pr, ToolCallInput as pt, GitTargetIdentity as q, GuardItemKind as qn, evaluateHostCapability as qt, CompletionDisposition as r, UserInteractionKind as rn, VerificationContract as rr, CanonicalArgv as rt, decideTurnStopping as s, certifyCheckpoint as sn, ACTION_MANIFEST as sr, canonicalArgvFromCommand as st, supersedeItem as t, authorityCaptureCounts as tn, TargetTuple as tr, revalidateGitPrestate as tt, observeAssistantOutcome as u, ClauseSegment as un, ActionSpec as ur, parseShellCommand as ut, bindingSatisfies as v, segmentClauses as vn, actionCompatible as vr, extractToolSubject as vt, ManifestIssue as w, availableBoundaryQualifications as wn, validateActionManifest as wr, BASE_HOST_PACKAGES as wt, isVerifyingCapability as x, BoundaryRequest as xn, requestedTargetMatchesResolved as xr, PROTOCOL_V3_NOTICE as xt, evidenceCoverage as y, BoundaryEffectuation as yn, isStatefulAction as yr, isDeterministicCheck as yt, GitCommandAccepted as z, ExpectedTransition as zn, HostLockEvaluation as zt };
+export { GitAdapterAction as $, EvidenceOutcome as $n, HostCohortSelection as $t, sessionQuery as A, classifyClause as An, STATEFUL_ACTIONS as Ar, ToolSubject as At, OperationVerbEntry as B, GoalBoundaryAccess as Bn, semanticActionFromText as Br, AuditedExecutable as Bt, ProofSurface as C, RejectedBinding as Cn, PackageRow as Cr, isRunExecutable as Ct, createProofManifest as D, ClauseSegment as Dn, ActionSpec as Dr, hasCurrentCertificate as Dt, canonicalProjection as E, ClassifiedClause as En, ActionManifest as Er, goalCompletionDenial as Et, evidenceMatchesItem as F, segmentClauses as Fn, actionCompatible as Fr, withDurability as Ft, hostLockRowsFromComposedDump as G, BoundaryDisposition as Gn, normalizeClause as Gr, ExecutableIdentityBinding as Gt, ActiveProfileHostLock as H, effectuateBoundary as Hn, validateActionTarget as Hr, DEFAULT_HOST_LOCK as Ht, isVerifyingCapability as I, BoundaryEffectuation as In, isStatefulAction as Ir, PROTOCOL_V3_NOTICE as It, packageRowsFromPnpmLock as J, DeriveConfig as Jn, sha256 as Jr, HOST_COHORTS as Jt, injectActiveProfileHostLock as K, BoundaryQualificationKind as Kn, sanitizeClauseText as Kr, GOAL_HOST_PACKAGES as Kt, COMMAND_SURFACE_MANIFEST as L, BoundaryQualification as Ln, requestedTargetAuthorizesMutation as Lr, deriveProjection as Lt, EvidenceFacetCoverage as M, extractMethod as Mn, SUPPORTED_EVIDENCE_ADAPTERS as Mr, extractTextContent as Mt, bindingSatisfies as N, extractOperation as Nn, SemanticAction as Nr, extractToolSubject as Nt, proofDigest as O, captureClause as On, CERTIFICATE_VERSION as Or, ToolCallInput as Ot, evidenceCoverage as P, isInformationalMessage as Pn, StatefulAction as Pr, isDeterministicCheck as Pt, GIT_COMMAND_MANIFEST_IDS as Q, EvidenceBinding as Qn, HostCohort as Qt, CommandSurfaceManifest as R, BoundaryRequest as Rn, requestedTargetMatchesResolved as Rr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Rt, ProofObligation as S, CheckpointResult as Sn, createProjection as Sr, canonicalArgvFromCommand as St, bindProofToProjection as T, CaptureScope as Tn, ACTION_MANIFEST_VERSION as Tr, parseShellCommand as Tt, HostProfileError as U, isCurrentAcceptedBoundary as Un, canonicalizePath as Ur, EXPECTED_HOST_PACKAGES as Ut, validateManifest as V, availableBoundaryQualifications as Vn, validateActionManifest as Vr, BASE_HOST_PACKAGES as Vt, hostLockContextFromComposedDump as W, qualifyBoundary as Wn, digestStrings as Wr, ExecutableIdentity as Wt, resolveInstalledHostLock as X, DeriveScope as Xn, HostCapabilityId as Xt, resolveActiveProfileHostLock as Y, DeriveResult as Yn, HostCapabilityEvaluation as Yt, verifyComposedHostLockDump as Z, DerivedEnvelope as Zn, HostCapabilityRequest as Zt, ALPHA3_HOST_PACKAGES as _, AuthorityKind as _n, TargetCaptureStatus as _r, verifiedLinearCommitReadback as _t, classifyCompletionClaim as a, HostProfileKind as an, GuardBoundary as ar, GitEffectRunner as at, ProofKind as b, UserInteractionKind as bn, VerificationContract as br, ParsedShell as bt, isWholeTaskCompletionClaim as c, bindLiveGoalCapability as cn, GuardIntegrity as cr, GitTargetIdentity as ct, DEFAULT_RECOVERY_CHAR_BUDGET as d, evaluateHostLock as dn, GuardItemStatus as dr, commitTreeSnapshotDigest as dt, HostCohortSelectionReason as en, EvidenceParseStatus as er, GitCommandAccepted as et, RecoveryOptions as f, evaluateToolSurfaceCapability as fn, GuardOperation as fr, createGitPrestateEnvelope as ft, renderRecoveryPacket as g, AuthorityBlockKind as gn, TargetCaptureReasonCode as gr, revalidateGitPrestate as gt, recoveryDigest as h, AuthorityBlock as hn, PersistenceAuthorization as hr, parseGitCommandManifest as ht, TurnStoppingDecision as i, HostPlatform as in, GoalRef as ir, GitEffectExecution as it, validateProofManifest as j, extractArtifactPaths as jn, STOP_PROTOCOL_VERSION as jr, evidenceFromPersistedToolResult as jt, proofEvidenceConstraints as k, captureItem as kn, SEMANTIC_ACTIONS as kr, ToolResultInput as kt, latestAssistantText as l, evaluateExternalWaitCapability as ln, GuardItem as lr, LinearCommitReadback as lt, openItems as m, currentContractDigest as mn, HostStatus as mr, gitCommandMatchesTarget as mt, AssistantOutcomeObservation as n, HostLockEvaluation as nn, ExpectedTransition as nr, GitCommandParseResult as nt, decideTurnBoundary as o, HostToolSurface as on, GuardCheckpoint as or, GitPrestateCheck as ot, closingHint as p, selectHostCohort as pn, GuardProjection as pr, executeRevalidatedGitEffect as pt, packageRowsFromActiveGraph as q, DeferAuthorization as qn, sanitizeUrl as qr, HOST_CAPABILITY_PACKAGE_GROUPS as qt, CompletionDisposition as r, HostLockStatus as rn, ExternalOperation as rr, GitCommandRejected as rt, decideTurnStopping as s, bindExecutableIdentity as sn, GuardEvidence as sr, GitPrestateEnvelope as st, supersedeItem as t, HostLockContext as tn, EvidenceRole as tr, GitCommandManifest as tt, observeAssistantOutcome as u, evaluateHostCapability as un, GuardItemKind as ur, commitIndexSnapshotDigest as ut, PROOF_KINDS as v, authorityCaptureCounts as vn, TargetTuple as vr, CanonicalArgv as vt, SessionQuery as w, certifyCheckpoint as wn, ACTION_MANIFEST as wr, parsePwshCommand as wt, ProofManifest as x, classifyUserInteraction as xn, WaitAuthorization as xr, ShellParseStatus as xt, PROOF_PROTOCOL_VERSION as y, segmentAuthorityBlocks as yn, TargetValue as yr, CanonicalCommandSurface as yt, ManifestIssue as z, GoalActivationState as zn, semanticActionFromCommand as zr, ALPHA2_HOST_PACKAGES as zt };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as gitCommandMatchesTarget, $n as TargetCaptureReasonCode, $t as AuthorityBlockKind, A as hostLockRowsFromComposedDump, An as DeferAuthorization, Ar as sanitizeUrl, At as HOST_CAPABILITY_PACKAGE_GROUPS, B as GitCommandManifest, Bn as ExternalOperation, Bt as HostLockStatus, C as CommandSurfaceManifest, Cn as GoalBoundaryAccess, Cr as semanticActionFromText, Ct as AuditedExecutable, D as ActiveProfileHostLock, Dn as qualifyBoundary, Dr as digestStrings, Dt as ExecutableIdentity, E as validateManifest, En as isCurrentAcceptedBoundary, Er as canonicalizePath, Et as EXPECTED_HOST_PACKAGES, F as resolveInstalledHostLock, Fn as EvidenceBinding, Ft as HostCohort, G as GitPrestateCheck, Gn as GuardIntegrity, Gt as bindLiveGoalCapability, H as GitCommandRejected, Hn as GuardBoundary, Ht as HostProfileKind, I as verifyComposedHostLockDump, In as EvidenceOutcome, It as HostCohortSelection, J as LinearCommitReadback, Jn as GuardItemStatus, Jt as evaluateHostLock, K as GitPrestateEnvelope, Kn as GuardItem, Kt as evaluateExternalWaitCapability, L as GIT_COMMAND_MANIFEST_IDS, Ln as EvidenceParseStatus, Lt as HostCohortSelectionReason, M as packageRowsFromActiveGraph, Mn as DeriveResult, Mt as HostCapabilityEvaluation, N as packageRowsFromPnpmLock, Nn as DeriveScope, Nt as HostCapabilityId, O as HostProfileError, On as BoundaryDisposition, Or as normalizeClause, Ot as ExecutableIdentityBinding, P as resolveActiveProfileHostLock, Pn as DerivedEnvelope, Pt as HostCapabilityRequest, Q as executeRevalidatedGitEffect, Qn as PersistenceAuthorization, Qt as AuthorityBlock, R as GitAdapterAction, Rn as EvidenceRole, Rt as HostLockContext, S as COMMAND_SURFACE_MANIFEST, Sn as GoalActivationState, Sr as semanticActionFromCommand, St as deriveProjection, T as OperationVerbEntry, Tn as effectuateBoundary, Tr as validateActionTarget, Tt as DEFAULT_HOST_LOCK, U as GitEffectExecution, Un as GuardCheckpoint, Ut as HostToolSurface, V as GitCommandParseResult, Vn as GoalRef, Vt as HostPlatform, W as GitEffectRunner, Wn as GuardEvidence, Wt as bindExecutableIdentity, X as commitTreeSnapshotDigest, Xn as GuardProjection, Xt as selectHostCohort, Y as commitIndexSnapshotDigest, Yn as GuardOperation, Yt as evaluateToolSurfaceCapability, Z as createGitPrestateEnvelope, Zn as HostStatus, Zt as currentContractDigest, _ as EvidenceFacetCoverage, _n as isInformationalMessage, _r as StatefulAction, _t as extractTextContent, a as classifyCompletionClaim, an as CheckpointResult, ar as createProjection, at as ParsedShell, b as evidenceMatchesItem, bn as BoundaryQualification, br as requestedTargetAuthorizesMutation, bt as withDurability, c as isWholeTaskCompletionClaim, cn as CaptureScope, cr as ACTION_MANIFEST_VERSION, ct as isRunExecutable, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as captureClause, dr as CERTIFICATE_VERSION, dt as goalCompletionDenial, en as AuthorityKind, er as TargetCaptureStatus, et as parseGitCommandManifest, f as RecoveryOptions, fn as captureItem, fr as SEMANTIC_ACTIONS, ft as hasCurrentCertificate, g as renderRecoveryPacket, gn as extractOperation, gr as SemanticAction, gt as evidenceFromPersistedToolResult, h as recoveryDigest, hn as extractMethod, hr as SUPPORTED_EVIDENCE_ADAPTERS, ht as ToolSubject, i as TurnStoppingDecision, in as classifyUserInteraction, ir as WaitAuthorization, it as CanonicalCommandSurface, j as injectActiveProfileHostLock, jn as DeriveConfig, jr as sha256, jt as HOST_COHORTS, k as hostLockContextFromComposedDump, kn as BoundaryQualificationKind, kr as sanitizeClauseText, kt as GOAL_HOST_PACKAGES, l as latestAssistantText, ln as ClassifiedClause, lr as ActionManifest, lt as parsePwshCommand, m as openItems, mn as extractArtifactPaths, mr as STOP_PROTOCOL_VERSION, mt as ToolResultInput, n as AssistantOutcomeObservation, nn as segmentAuthorityBlocks, nr as TargetValue, nt as verifiedLinearCommitReadback, o as decideTurnBoundary, on as RejectedBinding, or as PackageRow, ot as ShellParseStatus, p as closingHint, pn as classifyClause, pr as STATEFUL_ACTIONS, pt as ToolCallInput, q as GitTargetIdentity, qn as GuardItemKind, qt as evaluateHostCapability, r as CompletionDisposition, rn as UserInteractionKind, rr as VerificationContract, rt as CanonicalArgv, s as decideTurnStopping, sn as certifyCheckpoint, sr as ACTION_MANIFEST, st as canonicalArgvFromCommand, t as supersedeItem, tn as authorityCaptureCounts, tr as TargetTuple, tt as revalidateGitPrestate, u as observeAssistantOutcome, un as ClauseSegment, ur as ActionSpec, ut as parseShellCommand, v as bindingSatisfies, vn as segmentClauses, vr as actionCompatible, vt as extractToolSubject, w as ManifestIssue, wn as availableBoundaryQualifications, wr as validateActionManifest, wt as BASE_HOST_PACKAGES, x as isVerifyingCapability, xn as BoundaryRequest, xr as requestedTargetMatchesResolved, xt as PROTOCOL_V3_NOTICE, y as evidenceCoverage, yn as BoundaryEffectuation, yr as isStatefulAction, yt as isDeterministicCheck, z as GitCommandAccepted, zn as ExpectedTransition, zt as HostLockEvaluation } from "./index-CTFLYvNL.js";
+import { $ as GitAdapterAction, $n as EvidenceOutcome, $t as HostCohortSelection, A as sessionQuery, An as classifyClause, Ar as STATEFUL_ACTIONS, At as ToolSubject, B as OperationVerbEntry, Bn as GoalBoundaryAccess, Br as semanticActionFromText, Bt as AuditedExecutable, C as ProofSurface, Cn as RejectedBinding, Cr as PackageRow, Ct as isRunExecutable, D as createProofManifest, Dn as ClauseSegment, Dr as ActionSpec, Dt as hasCurrentCertificate, E as canonicalProjection, En as ClassifiedClause, Er as ActionManifest, Et as goalCompletionDenial, F as evidenceMatchesItem, Fn as segmentClauses, Fr as actionCompatible, Ft as withDurability, G as hostLockRowsFromComposedDump, Gn as BoundaryDisposition, Gr as normalizeClause, Gt as ExecutableIdentityBinding, H as ActiveProfileHostLock, Hn as effectuateBoundary, Hr as validateActionTarget, Ht as DEFAULT_HOST_LOCK, I as isVerifyingCapability, In as BoundaryEffectuation, Ir as isStatefulAction, It as PROTOCOL_V3_NOTICE, J as packageRowsFromPnpmLock, Jn as DeriveConfig, Jr as sha256, Jt as HOST_COHORTS, K as injectActiveProfileHostLock, Kn as BoundaryQualificationKind, Kr as sanitizeClauseText, Kt as GOAL_HOST_PACKAGES, L as COMMAND_SURFACE_MANIFEST, Ln as BoundaryQualification, Lr as requestedTargetAuthorizesMutation, Lt as deriveProjection, M as EvidenceFacetCoverage, Mn as extractMethod, Mr as SUPPORTED_EVIDENCE_ADAPTERS, Mt as extractTextContent, N as bindingSatisfies, Nn as extractOperation, Nr as SemanticAction, Nt as extractToolSubject, O as proofDigest, On as captureClause, Or as CERTIFICATE_VERSION, Ot as ToolCallInput, P as evidenceCoverage, Pn as isInformationalMessage, Pr as StatefulAction, Pt as isDeterministicCheck, Q as GIT_COMMAND_MANIFEST_IDS, Qn as EvidenceBinding, Qt as HostCohort, R as CommandSurfaceManifest, Rn as BoundaryRequest, Rr as requestedTargetMatchesResolved, Rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, S as ProofObligation, Sn as CheckpointResult, Sr as createProjection, St as canonicalArgvFromCommand, T as bindProofToProjection, Tn as CaptureScope, Tr as ACTION_MANIFEST_VERSION, Tt as parseShellCommand, U as HostProfileError, Un as isCurrentAcceptedBoundary, Ur as canonicalizePath, Ut as EXPECTED_HOST_PACKAGES, V as validateManifest, Vn as availableBoundaryQualifications, Vr as validateActionManifest, Vt as BASE_HOST_PACKAGES, W as hostLockContextFromComposedDump, Wn as qualifyBoundary, Wr as digestStrings, Wt as ExecutableIdentity, X as resolveInstalledHostLock, Xn as DeriveScope, Xt as HostCapabilityId, Y as resolveActiveProfileHostLock, Yn as DeriveResult, Yt as HostCapabilityEvaluation, Z as verifyComposedHostLockDump, Zn as DerivedEnvelope, Zt as HostCapabilityRequest, _ as ALPHA3_HOST_PACKAGES, _n as AuthorityKind, _r as TargetCaptureStatus, _t as verifiedLinearCommitReadback, a as classifyCompletionClaim, an as HostProfileKind, ar as GuardBoundary, at as GitEffectRunner, b as ProofKind, bn as UserInteractionKind, br as VerificationContract, bt as ParsedShell, c as isWholeTaskCompletionClaim, cn as bindLiveGoalCapability, cr as GuardIntegrity, ct as GitTargetIdentity, d as DEFAULT_RECOVERY_CHAR_BUDGET, dn as evaluateHostLock, dr as GuardItemStatus, dt as commitTreeSnapshotDigest, en as HostCohortSelectionReason, er as EvidenceParseStatus, et as GitCommandAccepted, f as RecoveryOptions, fn as evaluateToolSurfaceCapability, fr as GuardOperation, ft as createGitPrestateEnvelope, g as renderRecoveryPacket, gn as AuthorityBlockKind, gr as TargetCaptureReasonCode, gt as revalidateGitPrestate, h as recoveryDigest, hn as AuthorityBlock, hr as PersistenceAuthorization, ht as parseGitCommandManifest, i as TurnStoppingDecision, in as HostPlatform, ir as GoalRef, it as GitEffectExecution, j as validateProofManifest, jn as extractArtifactPaths, jr as STOP_PROTOCOL_VERSION, jt as evidenceFromPersistedToolResult, k as proofEvidenceConstraints, kn as captureItem, kr as SEMANTIC_ACTIONS, kt as ToolResultInput, l as latestAssistantText, ln as evaluateExternalWaitCapability, lr as GuardItem, lt as LinearCommitReadback, m as openItems, mn as currentContractDigest, mr as HostStatus, mt as gitCommandMatchesTarget, n as AssistantOutcomeObservation, nn as HostLockEvaluation, nr as ExpectedTransition, nt as GitCommandParseResult, o as decideTurnBoundary, on as HostToolSurface, or as GuardCheckpoint, ot as GitPrestateCheck, p as closingHint, pn as selectHostCohort, pr as GuardProjection, pt as executeRevalidatedGitEffect, q as packageRowsFromActiveGraph, qn as DeferAuthorization, qr as sanitizeUrl, qt as HOST_CAPABILITY_PACKAGE_GROUPS, r as CompletionDisposition, rn as HostLockStatus, rr as ExternalOperation, rt as GitCommandRejected, s as decideTurnStopping, sn as bindExecutableIdentity, sr as GuardEvidence, st as GitPrestateEnvelope, t as supersedeItem, tn as HostLockContext, tr as EvidenceRole, tt as GitCommandManifest, u as observeAssistantOutcome, un as evaluateHostCapability, ur as GuardItemKind, ut as commitIndexSnapshotDigest, v as PROOF_KINDS, vn as authorityCaptureCounts, vr as TargetTuple, vt as CanonicalArgv, w as SessionQuery, wn as certifyCheckpoint, wr as ACTION_MANIFEST, wt as parsePwshCommand, x as ProofManifest, xn as classifyUserInteraction, xr as WaitAuthorization, xt as ShellParseStatus, y as PROOF_PROTOCOL_VERSION, yn as segmentAuthorityBlocks, yr as TargetValue, yt as CanonicalCommandSurface, z as ManifestIssue, zn as GoalActivationState, zr as semanticActionFromCommand, zt as ALPHA2_HOST_PACKAGES } from "./index-AtjJOrK8.js";
 import "@deepseek-ai/dsh-tools";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
@@ -21,4 +21,4 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockProfile?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as segmentAuthorityBlocks, A as extractToolSubject, At as STATEFUL_ACTIONS, B as DEFAULT_HOST_LOCK, Bt as validateActionTarget, C as latestAssistantText, Ct as segmentClauses, D as supersedeItem, Dt as ACTION_MANIFEST_VERSION, E as deriveProjection, Et as ACTION_MANIFEST, F as parsePwshCommand, Ft as requestedTargetAuthorizesMutation, G as bindExecutableIdentity, Gt as normalizeClause, H as GOAL_HOST_PACKAGES, Ht as validateManifest, I as parseShellCommand, It as requestedTargetMatchesResolved, J as evaluateHostCapability, Jt as sha256, K as bindLiveGoalCapability, Kt as sanitizeClauseText, L as goalCompletionDenial, Lt as semanticActionFromCommand, M as withDurability, Mt as SUPPORTED_EVIDENCE_ADAPTERS, N as canonicalArgvFromCommand, Nt as actionCompatible, O as evidenceFromPersistedToolResult, Ot as CERTIFICATE_VERSION, P as isRunExecutable, Pt as isStatefulAction, Q as authorityCaptureCounts, R as hasCurrentCertificate, Rt as semanticActionFromText, S as isWholeTaskCompletionClaim, St as isInformationalMessage, T as PROTOCOL_V3_NOTICE, Tt as npmEscapedPackageName, U as HOST_CAPABILITY_PACKAGE_GROUPS, Ut as canonicalizePath, V as EXPECTED_HOST_PACKAGES, Vt as COMMAND_SURFACE_MANIFEST, W as HOST_COHORTS, Wt as digestStrings, X as evaluateToolSurfaceCapability, Y as evaluateHostLock, Yt as createProjection, Z as selectHostCohort, _ as revalidateGitPrestate, _t as captureItem, a as packageRowsFromActiveGraph, at as certifyCheckpoint, b as decideTurnBoundary, bt as extractMethod, c as resolveInstalledHostLock, ct as openItems, d as commitIndexSnapshotDigest, dt as bindingSatisfies, et as classifyUserInteraction, f as commitTreeSnapshotDigest, ft as evidenceCoverage, g as parseGitCommandManifest, gt as captureClause, h as gitCommandMatchesTarget, ht as currentContractDigest, i as injectActiveProfileHostLock, it as qualifyBoundary, j as isDeterministicCheck, jt as STOP_PROTOCOL_VERSION, k as extractTextContent, kt as SEMANTIC_ACTIONS, l as verifyComposedHostLockDump, lt as recoveryDigest, m as executeRevalidatedGitEffect, mt as isVerifyingCapability, n as hostLockContextFromComposedDump, nt as effectuateBoundary, o as packageRowsFromPnpmLock, ot as DEFAULT_RECOVERY_CHAR_BUDGET, p as createGitPrestateEnvelope, pt as evidenceMatchesItem, q as evaluateExternalWaitCapability, qt as sanitizeUrl, r as hostLockRowsFromComposedDump, rt as isCurrentAcceptedBoundary, s as resolveActiveProfileHostLock, st as closingHint, t as HostProfileError, tt as availableBoundaryQualifications, u as GIT_COMMAND_MANIFEST_IDS, ut as renderRecoveryPacket, v as verifiedLinearCommitReadback, vt as classifyClause, w as observeAssistantOutcome, wt as canonicalRegistryBase, x as decideTurnStopping, xt as extractOperation, y as classifyCompletionClaim, yt as extractArtifactPaths, z as BASE_HOST_PACKAGES, zt as validateActionManifest } from "./domain-DPPFAcbF.js";
+import { $ as GOAL_HOST_PACKAGES, $t as COMMAND_SURFACE_MANIFEST, A as decideTurnStopping, At as classifyClause, B as isDeterministicCheck, Bt as CERTIFICATE_VERSION, C as executeRevalidatedGitEffect, Ct as bindingSatisfies, D as verifiedLinearCommitReadback, Dt as currentContractDigest, E as revalidateGitPrestate, Et as isVerifyingCapability, F as deriveProjection, Ft as segmentClauses, G as parseShellCommand, Gt as actionCompatible, H as canonicalArgvFromCommand, Ht as STATEFUL_ACTIONS, I as supersedeItem, It as canonicalRegistryBase, J as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Jt as requestedTargetMatchesResolved, K as goalCompletionDenial, Kt as isStatefulAction, L as evidenceFromPersistedToolResult, Lt as npmEscapedPackageName, M as latestAssistantText, Mt as extractMethod, N as observeAssistantOutcome, Nt as extractOperation, O as classifyCompletionClaim, Ot as captureClause, P as PROTOCOL_V3_NOTICE, Pt as isInformationalMessage, Q as EXPECTED_HOST_PACKAGES, Qt as validateActionTarget, R as extractTextContent, Rt as ACTION_MANIFEST, S as createGitPrestateEnvelope, St as renderRecoveryPacket, T as parseGitCommandManifest, Tt as evidenceMatchesItem, U as isRunExecutable, Ut as STOP_PROTOCOL_VERSION, V as withDurability, Vt as SEMANTIC_ACTIONS, W as parsePwshCommand, Wt as SUPPORTED_EVIDENCE_ADAPTERS, X as BASE_HOST_PACKAGES, Xt as semanticActionFromText, Y as ALPHA2_HOST_PACKAGES, Yt as semanticActionFromCommand, Z as DEFAULT_HOST_LOCK, Zt as validateActionManifest, _ as resolveInstalledHostLock, _t as certifyCheckpoint, a as createProofManifest, an as sanitizeUrl, at as evaluateHostCapability, b as commitIndexSnapshotDigest, bt as openItems, c as sessionQuery, ct as selectHostCohort, d as hostLockContextFromComposedDump, dt as segmentAuthorityBlocks, en as validateManifest, et as HOST_CAPABILITY_PACKAGE_GROUPS, f as hostLockRowsFromComposedDump, ft as classifyUserInteraction, g as resolveActiveProfileHostLock, gt as qualifyBoundary, h as packageRowsFromPnpmLock, ht as isCurrentAcceptedBoundary, i as canonicalProjection, in as sanitizeClauseText, it as evaluateExternalWaitCapability, j as isWholeTaskCompletionClaim, jt as extractArtifactPaths, k as decideTurnBoundary, kt as captureItem, l as validateProofManifest, lt as ALPHA3_HOST_PACKAGES, m as packageRowsFromActiveGraph, mt as effectuateBoundary, n as PROOF_PROTOCOL_VERSION, nn as digestStrings, nt as bindExecutableIdentity, o as proofDigest, on as sha256, ot as evaluateHostLock, p as injectActiveProfileHostLock, pt as availableBoundaryQualifications, q as hasCurrentCertificate, qt as requestedTargetAuthorizesMutation, r as bindProofToProjection, rn as normalizeClause, rt as bindLiveGoalCapability, s as proofEvidenceConstraints, sn as createProjection, st as evaluateToolSurfaceCapability, t as PROOF_KINDS, tn as canonicalizePath, tt as HOST_COHORTS, u as HostProfileError, ut as authorityCaptureCounts, v as verifyComposedHostLockDump, vt as DEFAULT_RECOVERY_CHAR_BUDGET, w as gitCommandMatchesTarget, wt as evidenceCoverage, x as commitTreeSnapshotDigest, xt as recoveryDigest, y as GIT_COMMAND_MANIFEST_IDS, yt as closingHint, z as extractToolSubject, zt as ACTION_MANIFEST_VERSION } from "./domain-CHTQFIT8.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -3466,4 +3466,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindingSatisfies, canonicalArgvFromCommand, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/COMPATIBILITY.md

@@ -1,15 +1,49 @@
 # Compatibility
 
-The current development target is pinned, not a floating claim.
+Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
-## Target
+## Current 0.4.0 release baseline
 
-- DeepSeek Harness: `0.1.1-rc.2` with dshmarket `1.36.0`, or `0.1.2-alpha.2` with dshmarket `1.38.1` (both checked on macOS and Windows)
-- Cordis: `4.0.1` (rc.2 cohort) / `4.0.2` (alpha.2 cohort)
+- Plugin: `dsh-completion-guard` `0.4.0`
+- DeepSeek Harness: `0.1.2-alpha.3`
+- dshmarket: `1.39.0`
+- Cordis: `4.0.2`
 - Node: `>= 22`
 - pnpm: `>= 11`
 
-DSH is still a developer preview and may make breaking changes. Compatibility is therefore limited to two audited host sets in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). A host set is the complete list of required packages and their exact versions. Every row must match one set; missing, mixed, duplicate, unidentified, or unknown packages leave the Guard unavailable. The selected set is part of the host-lock digest, so changing sets invalidates earlier certificates. Platform support is registered only after the complete set is checked natively on that platform.
+DSH is still a developer preview and may make breaking changes. Version 0.4.0 therefore makes no floating alpha compatibility claim.
+
+## Upstream adaptation policy
+
+Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumes with the first DeepSeek Harness RC published after alpha.3; follow the upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) for that milestone.
+
+## Platform and release evidence
+
+- **Source and CI:** the release commit must pass the repository matrix and the Ubuntu, macOS, and Windows Node.js 22/24 CI jobs.
+- **Exact package:** the repository packer emits one deterministic 26-file tgz with its full source commit in `gitHead`. That same SHA-256 must be used on both native platforms and published to npm without repacking.
+- **Native scope:** macOS and Windows acceptance separately cover isolated Web and Headless installation, complete host-lock readback, repeated injection, Web restart and recovery, intentional Headless credential failure, daily-profile preservation, and scoped cleanup.
+- **Public identity:** the annotated tag, npm manifest and downloaded tgz, GitHub Release target, checksum, and platform annexes must all resolve to the same release commit and package bytes.
+- **Daily profiles:** upgrading a user's daily DSH profile is a separate action and is not implied by release acceptance.
+
+## Historical compatibility cohorts
+
+- DSH `0.1.1-rc.2` + dshmarket `1.36.0` + Cordis `4.0.1` is a retained, published-line cohort.
+- DSH `0.1.2-alpha.2` + dshmarket `1.38.1` + Cordis `4.0.2` is the published 0.3.2 cohort checked natively on macOS and Windows.
+- DSH `0.1.2-alpha.2` + dshmarket `1.39.0` + Cordis `4.0.2` remains a deterministic compatibility cohort. It is no longer a native 0.4.0 release blocker.
+
+## Rejection rules
+
+The four exact host sets are recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). Each set is a complete list of required packages and versions. Every row must match one set.
+
+Missing, mixed, duplicate, unidentified, unknown, or integrity-drifted rows leave the Guard unavailable. Unregistered substitutions such as alpha.3 with dshmarket `1.38.1` are rejected as mixed graphs. dshmarket is an authoritative lock input; skin-center is not.
+
+The selected set is part of the host-lock digest. Changing sets invalidates earlier certificates, and a platform is marked supported only after its complete set passes native checks there.
+
+## Evidence links
+
+- Candidate and historical-artifact evidence: [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md)
+- Shared Codex/DSH semantic scope: [`SEMANTIC_COMPATIBILITY.md`](SEMANTIC_COMPATIBILITY.md)
+- Exact host identities: [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json)
 
 ## Loader contract
 
@@ -17,11 +51,43 @@ The package exposes a named `apply(ctx)` function and a named `inject` array (`[
 
 The plugin accepts an `activation` configuration value of `opt-in` or `always`. The default is `opt-in`; `always` initializes the projection as enabled before the persisted session log is replayed. Invalid values fail during plugin configuration instead of silently falling back. A DSH profile can select `always` with an ID-targeted `config` override in its `cordis.patch.yml`; see the README quick start for the complete example and the replay implications for existing sessions.
 
-Version 0.3 additionally accepts `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile`, generated from the active DSH runtime and profile graphs. Each critical row carries the exact resolved version and registry tarball integrity. Missing, duplicate, multi-version, or drifted identity is not inferred from a nearby lockfile and fails closed. Capabilities are evaluated separately for base/Goal, agent loop, POSIX or Windows terminal, filesystem tools, DSH CLI, plugin inventory, Web control, and jobs; a missing platform- or action-specific group disables only the dependent path. The filesystem group freezes pinned `read`/`write`/`edit` registration, closed result and presentation shapes, the `ctx.fs` local/sandbox implementation, read-before-mutation observation policy, sandbox policy, and approval provider. Consequently a missing or drifted filesystem row disables only `create`/`modify` and ordinary filesystem facts, while a valid terminal or jobs capability remains usable. The audited identity is [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). The packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README is the supported generation and readback path; the default patch has no `hostLockPackages` and therefore fails closed until that flow succeeds.
+### Host-lock setup
+
+Before the Guard can certify work, generate and verify the host lock from the active DSH runtime and profile. Use the packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README. The default patch has no `hostLockPackages`, so the Guard fails closed until this flow succeeds.
+
+Version 0.3 accepts the generated `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` values. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate, multi-version, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
+
+### Capability groups
+
+The host lock evaluates these groups independently:
+
+- base and Goal;
+- agent loop;
+- POSIX or Windows terminal;
+- filesystem tools;
+- DSH CLI;
+- plugin inventory;
+- Web control; and
+- jobs.
+
+A missing platform- or action-specific group disables only the path that depends on it. For example, a valid terminal or jobs group remains usable when the filesystem group is unavailable.
+
+The filesystem group has a narrower contract of its own. It freezes the registered `read`, `write`, and `edit` tools; their closed result and presentation shapes; the local or sandbox `ctx.fs` implementation; the read-before-mutation observation policy; the sandbox policy; and the approval provider. A missing or drifted filesystem row disables `create`, `modify`, and ordinary filesystem facts without disabling unrelated capability groups.
 
 ## Peer dependencies
 
-Runtime packages are host-provided and declared as peer dependencies: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-agent`, `@deepseek-ai/dsh-commands`, `@deepseek-ai/dsh-llm`, `@deepseek-ai/dsh-session`, `@deepseek-ai/dsh-tools`. Goal uses two exact optional peers as one capability: `@deepseek-ai/dsh-goal` owns state, and `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name/schema/arguments. Both graph rows and the live Goal service/tool must agree. Profiles without this complete capability still load, but Goal-dependent integration is inactive. Peer ranges accept exactly the two audited cohort sets (`0.1.1-rc.2 || 0.1.2-alpha.2`; Cordis `4.0.1 || 4.0.2`) — never a floating range — while runtime acceptance is constrained by the exact injected host lock and its atomic cohort selection.
+The ordinary runtime packages are host-provided peers:
+
+- `@deepseek-ai/cordis`;
+- `@deepseek-ai/dsh-agent`;
+- `@deepseek-ai/dsh-commands`;
+- `@deepseek-ai/dsh-llm`;
+- `@deepseek-ai/dsh-session`; and
+- `@deepseek-ai/dsh-tools`.
+
+Goal support uses two exact optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
+
+Peer ranges accept only the registered DSH version lines: `0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3`, with Cordis `4.0.1 || 4.0.2`. These are not floating support claims. Runtime acceptance still requires an exact injected host lock and atomic selection of one complete cohort.
 
 ## Terminal outcome contract
 
@@ -51,10 +117,25 @@ certifying capability, and has unknown outcome.
 
 ## Verified surfaces
 
+### Current visible behavior
+
 - `dsh --profile web --dump-config` and `--profile headless --dump-config` both include `context-guard`.
-- A real headless boot loads the plugin (apply, `ctx.sessions` access, and listener registration succeed) and only stops at missing provider credentials.
+- A real Headless boot loads the plugin: `apply`, `ctx.sessions` access, and listener registration succeed before the run reaches the intentional missing-provider-credentials boundary.
+- The slash command appears in the Web command directory. Its `on`, `off`, `clear`, `status`, and `diagnose` subcommands produce the expected `command/run` and `command/done` events.
+
+`inspect` reports whether the active package graph matches a supported cohort, so it can correctly return `supported` before injection. Pre-injection failure is established by reading the composed configuration and by `verify-dump`, which rejects missing or mismatched injected host-lock data.
+
+Evidence and certificates are session-scoped. A later DSH session cannot import or certify evidence IDs from an earlier session. Any workflow that needs a certificate must therefore produce its evidence and checkpoint in the same session.
+
+### Historical 0.3.x evidence
 
-The slash command renders in the Web command directory and its on/off/clear/status/diagnose subcommands produce the expected `command/run`/`command/done`. The v0.3 runtime baseline exercises 360 deterministic tests in 20 files, including all 37 mirrored portable semantic cases and all 29 digest vectors: macOS passed 359 tests with the one Windows-only shim test capability-skipped, while native Windows passed all 352 tests of the earlier 19-file baseline with no skips. The same canonical pre-release tgz passed isolated Web/Headless install, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on both native platforms; Headless loaded to the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24. A credentialed model session verified an accepted evidence binding and persisted typed-boundary/disarm path; an intentionally over-broad prompt remained incomplete and received no false certificate. Version 0.3.1 preserves those runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. The final 0.3.1 tgz remains separately bound to native-platform and public registry readback, as recorded in `LOCAL_ACCEPTANCE.md`. The 0.3.2 source checks now cover both exact host sets on macOS and Windows; the Windows registration still needs a clean committed candidate and same-byte package acceptance, as recorded in `LOCAL_ACCEPTANCE.md`. Evidence and certificates are session-scoped: a later DSH session cannot import or certify evidence IDs from an earlier session, so a workflow requiring a certificate must produce its evidence and checkpoint in one session. The published 0.1.x and 0.2.x releases retain separate historical evidence. The fail-closed invariants below are asserted as regressions.
+- **0.3.0 runtime baseline:** 20 files exercise 360 deterministic tests, including all 37 mirrored portable semantic cases and all 29 digest vectors. macOS passed 359 tests with one Windows-only shim test capability-skipped; native Windows passed all 352 tests in the earlier 19-file baseline with no skips.
+- **0.3.0 native and CI evidence:** the same canonical pre-release tgz passed isolated Web and Headless installation, host-lock inspect/inject/dump/verify, real dshmarket restart readback, HTTP recovery, and cleanup on native macOS and Windows. Headless reached the intentional missing-credential boundary. CI covered Ubuntu, macOS, and Windows on Node.js 22 and 24.
+- **0.3.0 model-session evidence:** a credentialed session verified one accepted evidence binding and persisted typed-boundary/disarm path. A deliberately over-broad prompt remained incomplete and received no false certificate.
+- **0.3.1 provenance repair:** 0.3.1 preserves the 0.3.0 runtime bytes and repairs only the frozen-package provenance path after the 0.3.0 registry entry omitted `gitHead`. Its final tgz is separately bound to native-platform and public-registry readback.
+- **0.3.2 completed release:** the frozen package from commit `22cde610` passed the same-byte isolated lifecycle on native macOS and Windows. Its tag, npm publication, GitHub Release, and public downloads resolve to the same commit and bytes.
+
+Exact commands, artifact identities, and platform limits for these releases are recorded in [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md). The published 0.1.x and 0.2.x lines retain their own historical evidence there. The fail-closed invariants below remain covered as regressions.
 
 ## Session-layer capture filter and goal completion (v0.2.1)
 
@@ -88,9 +169,61 @@ new evidence, or a new contract revision always re-remind.
 
 The full `STATEFUL_ACTIONS` set is `install | apply | create | modify | restart | commit | push | publish | pull | fetch`. Each requires distinct resolution/effect/state evidence IDs, exact same-target closure, independent state readback, and a versioned expected-transition payload. An effect-only success is incomplete. Old v0.2 scope-run certificates are retained as `legacy_generic_run` audit facts and do not become current v0.3 authority; unprovable legacy authority is also non-certifiable.
 
-`context_guard_evidence` is a read-only producer for resolution, persisted-effect validation, and state readback. `context_guard_action` is the explicitly mutating surface for exact-tgz install/apply/publish, two-phase dshmarket restart, and exact Git commit/push/pull/fetch. It first flushes and replays the resolution/contract chain, then requires the exact target digest and id/revision of one current pending `root_instruction` or `root_adoption` requirement whose action and complete requested identity match this resolution; a matching pending root prohibition denies the mutation regardless of message order, while prohibitions and acceptance clauses never grant authority. Install/apply require exact package id, version, and profile; publish requires exact artifact id, version, and canonical registry (v0.3 does not authorize `latest` or ranges); push/pull/fetch require repository, remote, and canonical explicit full ref/refspec; restart requires the exact service id. Disabled, integrity-unknown, stale-host, missing, passed, superseded, clarification-required, incomplete-target, action-swapped, target-swapped, and unrebound legacy paths are rejected before executable inspection, command execution, HTTP, or intent persistence. Unknown selector, command-manifest, or Git argument keys are rejected. `install` requires package absence, while `apply` requires an existing package and a changed version/integrity. Publish executes the exact resolved tgz with `--ignore-scripts`; its registry is a canonical HTTPS base shared by capture, argv, and standard packument readback, with credentials, query, fragment, encoded separators, control characters, and ambiguous path segments rejected. Resolution and effect bind the same canonical executable realpath and version. Windows `.cmd`/`.bat` shims additionally bind the canonical `SystemRoot\\System32\\cmd.exe` realpath and version; arguments containing shell-control, expansion, quote, NUL, or newline characters are unsupported, and execution never performs a second `PATH` search or trusts a changed `ComSpec`. Modify re-hashes the source bytes against the frozen pre-digest before deriving the unique UTF-8 replacement post-digest. Restart persists an intent before POST and closes only after a restored process observes a changed boot ID. Git operations reject aliases, implicit/delete/wildcard/force refs, target substitution, and prestate drift. Commit certification additionally rejects root, merge, or substituted-parent commits; fetch certification requires its resolved pre-HEAD, post-HEAD readback, and predicate parameter to be equal. Pre-execute revalidation is a correctness gate rather than isolation from same-user concurrent tampering; any divergent post-action readback is not certified.
+### Read-only resolution and explicit mutation
+
+`context_guard_evidence` is read-only. It resolves the current target, checks a persisted effect, and reads the resulting state. `context_guard_action` is the explicitly mutating surface for exact-tgz install, apply, and publish; two-phase dshmarket restart; and exact Git commit, push, pull, and fetch.
+
+The normal flow is: resolve the current target, match that resolution to one authorized pending requirement, perform the exact action, and independently read the state back. A successful effect without matching state evidence remains incomplete.
+
+### Authorization and early rejection
+
+Before mutation, `context_guard_action` flushes and replays the resolution and contract chain. It then requires the exact target digest plus the id and revision of one current pending `root_instruction` or `root_adoption` requirement. The requirement's action and complete requested identity must match the resolution.
+
+A matching pending root prohibition denies the mutation regardless of message order. Prohibitions and acceptance clauses never grant authority.
+
+The action is rejected before executable inspection, command execution, HTTP, or intent persistence when the requirement is disabled, integrity-unknown, stale-host, missing, already passed, superseded, clarification-required, incomplete-target, action-swapped, target-swapped, or an unrebound legacy item. Unknown selector, command-manifest, or Git argument keys are also rejected.
+
+### Package operations
+
+- `install` requires the exact package id, version, and profile, and the package must be absent.
+- `apply` requires the exact package id, version, and profile, plus an existing package with a changed version or integrity.
+- `publish` requires the exact artifact id, version, and canonical registry. Version 0.3 does not authorize `latest` or a version range.
+
+Publish executes the exact resolved tgz with `--ignore-scripts`. Capture, argv, and standard packument readback use the same canonical HTTPS registry base. Registries containing credentials, a query, fragment, encoded separator, control character, or ambiguous path segment are rejected.
+
+The resolution and effect bind the same canonical executable realpath and version.
+
+### Git operations
+
+Push, pull, and fetch require the exact repository, remote, and canonical explicit full ref or refspec. Git aliases, implicit refs, deletion refs, wildcards, force refs, target substitution, and prestate drift are rejected.
+
+Commit certification additionally rejects root commits, merge commits, and substituted parents. Fetch certification requires its resolved pre-HEAD, post-HEAD readback, and predicate parameter to be equal.
+
+### File creation and modification
+
+Create and modify bind to the frozen target and expected transition described below. For modify, the Guard re-hashes the source bytes against the frozen pre-digest before deriving the unique UTF-8 replacement post-digest.
+
+### Restart
+
+Restart requires the exact service id. It persists an intent before POST and closes only after the restored process reports a changed boot ID.
+
+### Windows command shims
+
+Windows `.cmd` and `.bat` actions also bind the canonical `SystemRoot\\System32\\cmd.exe` realpath and version. Arguments containing shell control, expansion, quotes, NUL, or newline characters are unsupported. Execution never performs a second `PATH` search or trusts a changed `ComSpec`.
+
+### Concurrency limit
+
+Pre-execute revalidation is a correctness check, not isolation from another process running as the same user. Any divergent post-action readback is not certified.
+
+### Expected transitions and readback
+
+Every stateful resolution freezes its expected transition before the effect and binds a stable digest of that payload. Checkpoint diagnostics copy the immutable payload from the resolution fact. Callers cannot construct create or modify predicates from post-effect state.
+
+- **Create:** hash the exact UTF-8 content from the closed write manifest.
+- **Modify:** read the original bytes, require valid UTF-8 and exactly one `old_string` match, apply the pinned single replacement in memory, and hash the resulting bytes.
+- **Restart:** freeze `health=healthy` as a manifest constant.
 
-Every stateful resolution freezes its expected transition before effect and binds a stable digest of that payload. Checkpoint diagnostics copy this immutable payload from the resolution fact; callers cannot construct create/modify predicates from post-effect state. Create hashes the exact UTF-8 content from the closed write manifest. Modify first reads the original bytes, requires valid UTF-8 and exactly one `old_string` match, applies the pinned single replacement in memory, and hashes the resulting bytes. Restart freezes `health=healthy` as a manifest constant. A later successful effect whose independent state differs from these values remains incomplete.
+After the action, independent state readback must match the frozen transition. A successful effect with different state remains incomplete.
 
 ## Legacy v0.2 command parsing subset
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,7 +2,73 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
-## v0.3.2 source candidate gates (2026-08-31, in progress)
+## v0.4.0 release contract and pre-release history (2026-09-02)
+
+Version 0.4.0 targets DSH `0.1.2-alpha.3` with dshmarket `1.39.0` and Cordis `4.0.2`. The repository does not place a candidate's own commit, checksum, or public status inside that candidate's packaged documentation: those facts are generated after the package bytes are frozen and are attached to the GitHub Release.
+
+| Gate | Required evidence and location |
+| --- | --- |
+| Source and CI | one clean release commit; repository matrix plus Ubuntu, macOS, and Windows Node.js 22/24 CI |
+| Exact artifact | one deterministic 26-file tgz; full `gitHead`, SHA-256, npm shasum, integrity, size, and file count in `release-artifact.json` and `SHA256SUMS.txt` |
+| Native macOS and Windows | the same tgz on both platforms; separate machine-readable annexes covering isolated Web and Headless lifecycle, host-lock, restart, daily-profile preservation, and cleanup |
+| Tag, npm, and GitHub Release | annotated tag, npm manifest and downloaded package, Release target and assets, and anonymous public readback all resolve to the same commit and bytes |
+| Daily-profile upgrade | separate from release acceptance; never implied by a passing artifact run |
+
+### Superseded pre-release artifacts
+
+The first 26-file candidate, SHA-256 `33757ce11633ac167fa9c5a6fdb7a8938578fcb871edd9afdb2f89dcb51b4316`, was built from implementation baseline `ffc6fe9e1246a815f0bb630943c59d14b6505716`. Native macOS passed. Native Windows reached the restart endpoint but did not prove a changed boot ID, so its Headless phase correctly remained unrun. That candidate was superseded when packaged documentation changed.
+
+The next 26-file candidate, SHA-256 `f3489e0f1edbb81e0ebdbd33e43a14e46913496cb3e1c799115143a70d2ab4c9`, was built from `ae20bffd06af45d4a0c60519f5ab7a7af6076ec8`. Its exact bytes passed isolated native macOS and Windows Web and Headless acceptance; the Windows R2 record contained 25 passing gates. Publication was still rejected because the package itself repeated the superseded candidate's blocked status and said another package still had to be built. That documentation defect is why a later release candidate is required; the native results remain valid only for `f3489e0f...`.
+
+## v0.3.2 release gates (2026-09-01, passed)
+
+The release candidate is commit
+`22cde6106cdca511265bb4103375a263a0762b9c`. Its frozen
+`dsh-completion-guard-0.3.2.tgz` contains 26 files, is 181157 bytes, and has
+SHA-256
+`feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`.
+The package manifest carries the same full commit as `gitHead`. Candidate CI
+run 33461879125 passed Ubuntu, macOS, and Windows on Node.js 22 and 24.
+
+Those exact package bytes passed the required isolated Web and Headless
+lifecycle on native Windows and macOS: artifact and commit parity, clean
+install, strict Web reinstall no-op, installed-file parity, complete 34-row
+host checks, plugin load and configuration readback, real Web restart with
+403 rejection and 202 acceptance, changed boot ID, HTTP recovery, intentional
+Headless `MISSING_CREDENTIAL`, and scoped cleanup. The platform-specific host
+digests differ because platform identity is part of the lock; both match their
+own complete checked package graph. The optional credentialed model-session
+gate was not run and is not claimed.
+
+`inspect` and `verify-dump` answer different questions. `inspect` reports
+whether the active runtime and profile package graph is a supported complete
+set, so it can correctly return `supported` before injection. The pre-injection
+fail-closed check comes from reading the composed config and from
+`verify-dump`, which rejects missing or mismatched injected host-lock data.
+
+The annotated `v0.3.2` tag has tag-object SHA
+`753fd9625c58c03de2660464c7f7c86462a42eb1` and peels to the release commit
+above. Tag CI run 33474979019 passed the same six Ubuntu, macOS, and Windows
+Node.js 22/24 combinations. npm published this exact tgz at
+`2026-09-01T05:54:28.309Z`; anonymous registry readback returned
+`latest=0.3.2`, the expected `gitHead`, shasum and integrity, and a fresh
+download was byte-identical to the frozen file.
+
+The non-draft, non-prerelease
+[`v0.3.2` GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.2)
+was published at `2026-09-01T05:56:24Z`. Its 181157-byte tgz and 97-byte
+`SHA256SUMS.txt` have GitHub asset digests
+`sha256:feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`
+and
+`sha256:82f839d3ccf5f429b10ae18cc54350379097f0f59b01a462ed222a869886a451`.
+Anonymous downloads of both assets were byte-identical to the frozen files.
+
+This section is a post-candidate evidence record and is not part of the
+accepted tgz. Changing the package bytes or release commit would still require
+new artifact and native-platform acceptance. Consumer pin and managed runtime
+installation remain separate actions.
+
+### Earlier source and host-cohort gates
 
 Version 0.3.2 lets the Guard recognize either of two complete DSH package sets. It never combines packages from different sets, and a missing or mismatched package leaves the whole host unavailable. The initial host-cohort checks below were run on macOS from a working tree based on `844b62848c1e2685e0574b660dc4546b6bf6dbac`, which was `origin/main` when implementation began. They cover source behavior, not a release artifact.
 
@@ -25,10 +91,8 @@ Native Windows source evidence (2026-09-01, PowerShell 5.1):
 - Fresh checkout `a3e77de6d8260f16f0723491495cacab57b9f62d` passed install, build, release-pack (2/2), and `git diff --check`.
 - The active DSH `0.1.2-alpha.2` / dshmarket `1.38.1` graph matched all 34 candidate rows; missing, extra, and duplicate counts were zero. This authorizes the Windows cohort registration, but it is source/host evidence rather than final package evidence.
 
-Pending gates (each requires its own authorization and evidence):
-
-- A frozen package from a clean committed tree, followed by isolated Web and Headless install, no-op, package comparison, host check, restart, cleanup, and native macOS/Windows acceptance of those same bytes.
-- Final documentation-inclusive candidate CI, release readback, tag, npm publication, GitHub Release, and consumer pin updates.
+The frozen artifact above closes the package and native-platform lifecycle
+gates. Release mutation and public readback remain separate.
 
 ## v0.3.1 release-repair gates
 

package/docs/PORTING_NOTES.md

@@ -1,6 +1,9 @@
 # Porting Notes
 
-The DSH implementation ports deterministic Context Guard semantics from `GreenLv/codex-context-guard` v0.8.8 while replacing the platform layer.
+The DSH implementation started from `GreenLv/codex-context-guard` v0.8.8 and
+replaced the Codex platform layer. That version is provenance, not the current
+compatibility claim. Shared behavior now advances through pinned conformance
+fixtures and an explicit delta ledger.
 
 | Area | Treatment |
 | --- | --- |
@@ -9,6 +12,13 @@ The DSH implementation ports deterministic Context Guard semantics from `GreenLv
 | evidence and proof binding | Adapt to DSH durable tool-result events |
 | recovery and stop policy | Adapt to DSH agent lifecycle |
 | Codex hooks, cache manager, Python runtime | Delete from DSH runtime |
-| multimodal assets, subagent provenance, rollover | Defer beyond 0.1.0 |
+| portable protocol and digest fixtures | Mirror exact upstream bytes and verify their hashes |
+| product-specific or newer Codex behavior | Record explicitly in the delta ledger before porting |
 
-The DSH port derives all guard state from natively persisted DSH session events (`command/run`, `user/message`, `tool/call`, `tool/result`, `tool/code-dispatch*`) instead of the removed custom event vocabulary, wires the completion gate to Goal interception and agent scoping, and enforces fail-closed certification. Native isolated real-model acceptance has passed on macOS and Windows, and the public npm package has been loaded and exercised in a real macOS Web profile. These results cover the bounded v0.1 command subset; they do not broaden it into general shell or PowerShell analysis or claim a second Windows run from the public package.
+The DSH port derives guard state from native DSH session events, connects the
+completion gate to Goal handling, and fails closed when it cannot verify the
+host or evidence. Version 0.3.2 has passed same-package Web and Headless
+lifecycle checks on macOS and Windows. This does not make the two products
+interchangeable or imply full parity with Codex 0.9.5; current gaps are listed
+in [`SEMANTIC_COMPATIBILITY.md`](SEMANTIC_COMPATIBILITY.md) and
+[`upstream-deltas.json`](upstream-deltas.json).