dsh-completion-guard 0.4.0 → 0.4.2

package/docs/ARCHITECTURE.md

@@ -43,4 +43,22 @@ Evidence is produced only from persisted `tool/call` + `tool/result` pairs. Guar
 7. `goalCompletionDenial` rejects the Guard-owned `update_goal(action=complete)` model-tool path before the Goal mutation unless that certificate is current. A trusted in-process producer can bypass the tool guard; replay detects the durable `goal/change complete` without a certificate and records an integrity violation, but the plugin does not claim to prevent or roll it back.
 8. `context_guard_boundary` persists only qualified `user_wait`, `external_wait`, or `deferred` candidates. After the accepted tool result is flushed and replayed, the post-commit path reads the same active/armed Goal ref, calls `goals.disarm(agent)`, and independently reads the same ref as disarmed. Pre-effect, still-armed, and post-effect-unknown failures have separate fail-closed/fail-loud outcomes.
 9. `decideTurnBoundary` reads only structured Guard/Goal state. Assistant completion prose is diagnostic and never a stop or continuation control source; active/armed continuation belongs to the Goal Round Driver.
-10. `renderRecoveryPacket` re-injects open requirements after compaction, resume, enable, rejection, or integrity loss. Injection is content-deduplicated: a re-armed packet with unchanged content is injected once, while resume, compaction, an enablement transition, new evidence, or a new contract revision change or forget the digest and always re-remind.
+10. `renderRecoveryPacket` re-injects open requirements after compaction, resume, enable, rejection, or integrity loss. Injection is content-deduplicated: a re-armed packet with unchanged content is injected once, while resume, compaction, an enablement transition, relevant new evidence, or a new contract revision changes or forgets the digest. Unrelated historical evidence does not re-arm the same guidance.
+
+## 0.4.2 capture and rebinding
+
+A legal plugin `user/message` notice marks the 0.4.2 capture boundary. Earlier events keep the 0.4.1 clause segmentation and visual classification; the runtime does not rewrite old source events, pending items, evidence IDs, or historical certificates. New compound requests separate explicitly named actions and retain GUI/visual acceptance as non-certifiable work. Updating a package and recording a change do not automatically mean installing or committing it.
+
+`context_guard_rebind` accepts `operation: propose|query|withdraw`, `item_id`, `proposal_id`, `clauses`, and optional `clarification_item_ids`. It has no model confirmation flag. A proposal's 1–8 clauses must concatenate to the complete original normalized text, and its serialized body must fit 8 KiB. Each clarification ID is either empty (keep the source clause) or names a later pending direct-root item that explicitly includes that clause and preserves captured identities and method constraints. The proposal records both root sources, item/revision identities, session, epoch, contract revision, candidate action/target/acceptance, and a digest. A GUI clause cannot be mapped to an installation-only result.
+
+The tool returns a candidate without mutating the projection. A matching durable tool result registers the proposal on replay. Only a complete canonical root message `确认重绑定 <proposal ID>` commits it. Confirmation rechecks the proposal against the current contract; changed, withdrawn, cross-session, or non-durable inputs keep the old item pending. Every child is constructed before the original is marked superseded. `supersededByItems` preserves the one-to-many relation, and `reboundFrom` preserves the proposal and confirmation source. A later root clarification keeps its own authority; partitioning alone cannot authorize a new mutation. Duplicate confirmation is idempotent.
+
+No digest-v3 wire format or upstream fixture changes are needed. A replacement changes the item/status set and contract revision, invalidating the earlier certificate; evidence is never copied into a passed state. A fresh checkpoint must revalidate the exact action, target, executor, host lock, and transition. Evidence predating the authoritative root clause referenced by a replacement is rejected while retaining its historical ID.
+
+## Bounded queries and recovery
+
+Checkpoint certification runs over the complete contract before display filtering. Default pages contain at most eight current items/constraints and ten evidence rows. Each list has its own cursor, bound to the session, epoch, contract revision, query, bindings, and evidence snapshot. `history` includes unsupported evidence with an unavailable disposition; default evidence and binding templates share action/target matching. Unknown cursor state is an explicit query error.
+
+The serializer reserves metadata space before selecting rows and returns at most 12 KiB of valid UTF-8 JSON. Oversized rows identify omitted detail; `detail_id` retrieves bounded JSON-text chunks. Later chunks require the initial `snapshot` as `detail_snapshot`. A long ID may use a SHA-256 lookup token in the summary; its original ID remains unchanged in the detail. Explicit `item_ids` can inspect passed and superseded provenance as well as current work. None of these views changes the certificate's scope.
+
+Recovery reserves its rules, query pointer and folding totals before filling item summaries. Separate category slots retain a key prohibition and the newest pending requirement before optional rejection details or evidence; many constraints cannot hide the current work. Long IDs are summarized independently of the reason and next step. Small packets distinguish capability restoration from requirement rebinding. Its default budget is 4,000 characters; values below 512 or non-integers are rejected. The 512-character form keeps a constraint, the current limitation, and a query pointer. Full constraint enforcement remains in the ledger and execution checks. The runtime re-derives binding refusals from persisted calls and deduplicates guidance against the current contract and relevant evidence. A real compact/resume boundary always resets that context-local deduplication.

package/docs/COMPATIBILITY.md

@@ -2,7 +2,13 @@
 
 Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
-## Current 0.4.0 release baseline
+## 0.4.2 source candidate (unreleased)
+
+The repair candidate retains the existing five audited host cohorts and peer dependency ranges. It does not change the Codex upstream pin, host package identities, or digest-v3 fixtures. The package version is `0.4.2`; no CI, frozen-package, native-platform or publication result is implied by that version field.
+
+For old pending requirements, use the new proposal/confirmation flow rather than editing the session log. Old events remain under their recorded capture version. Checkpoint output is paged and byte-bounded; clients must follow each list's cursor or query an ID instead of assuming that `open_items` or `available_evidence` on the first page is exhaustive. `bindings` and the top-level `certified|incomplete|unknown` meanings are unchanged. Generic execution and GUI/visual checks still cannot certify user-level completion. See the [architecture](ARCHITECTURE.md) for the schema and the [acceptance record](LOCAL_ACCEPTANCE.md) for remaining gates.
+
+## Recorded 0.4.0 release baseline
 
 - Plugin: `dsh-completion-guard` `0.4.0`
 - DeepSeek Harness: `0.1.2-alpha.3`
@@ -13,9 +19,20 @@ Compatibility is pinned to exact host package sets. A nearby version or a partia
 
 DSH is still a developer preview and may make breaking changes. Version 0.4.0 therefore makes no floating alpha compatibility claim.
 
+## Published 0.4.1-rc.1 prerelease (`next`)
+
+- Plugin: `dsh-completion-guard` `0.4.1-rc.1` prerelease
+- DeepSeek Harness: `0.1.2-rc.1`
+- dshmarket: `1.41.0`
+- Cordis: `4.0.2`
+- Audited platforms: native macOS/posix runtime, plus the native Windows rc.1 host graph verified on the live Windows host (host-lock inspect/inject, composed-config verify-dump, cold Web boot)
+- Evidence boundary: host-graph audits are source/runtime-level evidence and do not replace the cross-platform exact-artifact acceptance of one frozen package; unregistered host cohorts keep failing closed
+
+DSH rc.1 replaces the public `Session.events` getter with `snapshotEvents()` and `eventAt()`. The candidate uses `snapshotEvents()` when present and retains `events` only for older registered cohorts. The underlying Guard-consumed event vocabulary, flush path, Goal disarm, and `update_goal` contract remain unchanged by the focused upstream source audit.
+
 ## Upstream adaptation policy
 
-Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumes with the first DeepSeek Harness RC published after alpha.3; follow the upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) for that milestone.
+Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumed with DSH `0.1.2-rc.1`; that cohort is included in the published `0.4.1-rc.1` prerelease and retained by the 0.4.2 candidate. The upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) tracks later releases; a newer tag does not establish support.
 
 ## Platform and release evidence
 
@@ -33,7 +50,7 @@ Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha
 
 ## Rejection rules
 
-The four exact host sets are recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). Each set is a complete list of required packages and versions. Every row must match one set.
+The five exact host sets are recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). Each set is a complete list of required packages and versions. Every row must match one set.
 
 Missing, mixed, duplicate, unidentified, unknown, or integrity-drifted rows leave the Guard unavailable. Unregistered substitutions such as alpha.3 with dshmarket `1.38.1` are rejected as mixed graphs. dshmarket is an authoritative lock input; skin-center is not.
 
@@ -87,7 +104,7 @@ The ordinary runtime packages are host-provided peers:
 
 Goal support uses two exact optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
 
-Peer ranges accept only the registered DSH version lines: `0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3`, with Cordis `4.0.1 || 4.0.2`. These are not floating support claims. Runtime acceptance still requires an exact injected host lock and atomic selection of one complete cohort.
+Peer ranges accept only the registered DSH version lines: `0.1.1-rc.2 || 0.1.2-alpha.2 || 0.1.2-alpha.3 || 0.1.2-rc.1`, with Cordis `4.0.1 || 4.0.2`. These are not floating support claims. Runtime acceptance still requires an exact injected host lock and atomic selection of one complete cohort.
 
 ## Terminal outcome contract
 
@@ -161,7 +178,7 @@ retained) so an empty-binding checkpoint can certify while the guard stays
 enabled, and `update_goal(action=blocked)` records the blocker truthfully.
 Recovery packet injection is content-deduplicated: an unchanged packet is
 injected once per re-arm, while resume, compaction, an enablement transition,
-new evidence, or a new contract revision always re-remind.
+relevant evidence, or a new contract revision triggers reevaluation. In 0.4.2, unrelated historical success does not repeat unchanged refusal guidance; every actual recovery still receives a current summary.
 
 ## v0.3 semantic action and binding contract
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,7 +2,29 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
-## v0.4.0 release contract and pre-release history (2026-09-02)
+## v0.4.2 repair candidate (unreleased)
+
+This source candidate adds bounded feedback and root-confirmed rebinding. Local regression tests exercise compound capture, source authority, one-to-many replacement, stale/partial replay, target matching, large pages, snapshot changes, small recovery budgets and qualified pending boundaries. Local tests and the existence of a host driver do not establish native DSH acceptance.
+
+The versioned entrypoint is `scripts/native_acceptance.py`. Its default `portable_artifact` profile checks exact source/tgz identity, isolated installation, installed-file parity, second-install no-op and JavaScript syntax. `--gate-profile host_bound --runtime-root <audited-runtime>` additionally creates isolated Web and Headless profiles, injects and reads back their host locks, then runs `scripts/native_host_probe.mjs` inside the real DSH composition. The probe uses the host AgentRegistry, ToolRuntime and durable Session services for nonempty test certification, generic refusal, rebind confirmation, history queries, compact/resume and a qualified pending boundary. Web checks also require wrong-origin restart denial, same-origin acceptance, changed boot/process identities and listener cleanup. The installed launcher shim is checked separately.
+
+The host driver deliberately makes no model request. It first checks that the normal Headless task driver stops with `MISSING_CREDENTIAL` in the isolated environment, then disables that task driver for the separate real-service probe. A required package-update probe installs an inert local fixture at version 1, then clarifies and confirms a generic requirement, applies version 2 through the real producer/action tools, independently reads it back and requires a nonempty certificate. Capability skips appear in the returned annex. Never treat a synthetic test or an empty probe case set as a passed native run.
+
+After exact-candidate portability CI passes and one clean commit's tgz has been frozen, a native owner can run the following with Python 3.11+ (the same artifact is used on both platforms):
+
+```text
+python scripts/native_acceptance.py --gate-profile host_bound --repo-root <clean-checkout> --runtime-root <audited-runtime> --artifact <frozen.tgz> --artifact-sha256 <sha256> --source-commit <full-commit> --output <outside-repository-annex.json>
+```
+
+The driver creates a new temporary DSH_HOME, explicit temporary HOME/USERPROFILE and credential-free environment; it does not select or enable a daily profile. It binds the annex to the artifact, source commit, host lock and probe bytes, and checks owned processes, ports and temporary-file cleanup. Do not run it from a dirty source tree, substitute a rebuilt package, or copy raw temporary logs into the repository.
+
+The earlier 0.4.2 candidate at `6b92b3b7a5eb642686df9f2a1b4d66d54455f503` passed [candidate CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/34128172642). Its frozen tgz SHA-256 was `9d3e0a0bb948b137f27303a98ad38d3ecc8a901c5c579ce7e3b3c664530c3b4a`. Native macOS and Windows each passed all 28 required host-bound gates, including the normal Headless credential boundary and package-update probe, with cleanup passed. Both annexes retained the `real_model_request` capability skip. These are historical candidate results, not a release or evidence for later package bytes.
+
+The annex uses `native-acceptance/v2` with the DSH-specific `capability_skips`, `host_driver_sha256`, and `host_lock_digests` fields. A generic closed v2 validator correctly rejects those extensions. A consumer that provides the explicit `dsh-host-bound/v1` contract profile must validate the original annex with independently supplied expected commit, artifact SHA-256, and probe SHA-256; do not remove fields to make it pass. `host_driver_sha256` identifies `native_host_probe.mjs`, not the Python wrapper. Windows checkout CRLF bytes can produce a different probe hash from macOS LF bytes; bind each platform to its actual reviewed file bytes. Failed probe annexes may additionally contain bounded `host_probe_failures` diagnostics. The profile consumer is separate tooling and is not installed by this npm package.
+
+Every subsequent frozen package needs its own CI and same-byte native annexes, recorded outside its packaged documentation. Publication and public readback are separate gates. A disabled daily installation remains disabled until the user separately requests an upgrade and enablement.
+
+## v0.4.0 release gates (2026-09-02, passed)
 
 Version 0.4.0 targets DSH `0.1.2-alpha.3` with dshmarket `1.39.0` and Cordis `4.0.2`. The repository does not place a candidate's own commit, checksum, or public status inside that candidate's packaged documentation: those facts are generated after the package bytes are frozen and are attached to the GitHub Release.
 
@@ -14,6 +36,46 @@ Version 0.4.0 targets DSH `0.1.2-alpha.3` with dshmarket `1.39.0` and Cordis `4.
 | Tag, npm, and GitHub Release | annotated tag, npm manifest and downloaded package, Release target and assets, and anonymous public readback all resolve to the same commit and bytes |
 | Daily-profile upgrade | separate from release acceptance; never implied by a passing artifact run |
 
+The release commit is
+`d5cd0ca17833d05bfdf41457ae203864bde8056b`. Candidate CI run
+33626069583, main CI run 33633570436, and tag CI run 33633866279 each
+passed Ubuntu, macOS, and Windows on Node.js 22 and 24. The annotated
+`v0.4.0` tag has tag-object SHA
+`6130d53bdede2399b01f05e75a91bf3fadecb34e` and peels to the release
+commit.
+
+The frozen `dsh-completion-guard-0.4.0.tgz` contains 26 files, is 196166
+bytes, and has SHA-256
+`71ce205dedeffe72566ad399e001f0b337d057cede297e1d2249acec67cde1f2`.
+The package manifest carries the release commit as `gitHead`. These exact
+bytes passed isolated Web and Headless acceptance on native macOS and
+Windows. Both platforms checked installed-file parity, strict Web reinstall
+no-op, the alpha.3 host lock, injection and dump readback, a real Web restart
+with wrong-origin rejection and same-origin acceptance, changed boot ID and
+listener PID, intentional Headless `MISSING_CREDENTIAL`, preservation of the
+daily profiles, and cleanup. The attached macOS annex records 11 required
+gates; the Windows R5 annex records 24. The macOS Web run used Chokidar's
+polling mode after the host hit its file-watcher limit; the annex keeps that
+environment detail visible.
+
+npm published this exact tgz at `2026-09-02T13:18:57.245Z`. Anonymous
+registry readback returned `latest=0.4.0`, the release commit as `gitHead`,
+shasum `0980d44fa21b1f6bc225c96a4c52dcf1c6b3834a`, and the expected
+integrity. A fresh registry download was byte-identical to the frozen file.
+
+The non-draft, non-prerelease
+[`v0.4.0` GitHub Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.4.0)
+was published at `2026-09-02T13:21:09Z`. Its five assets are the frozen tgz,
+`SHA256SUMS.txt`, `release-artifact.json`, and the macOS and Windows native
+annexes. Anonymous Release readback returned the expected target commit and
+asset digests; a fresh Release tgz download was byte-identical to the frozen
+and npm files.
+
+This is a post-candidate evidence record and is not part of the accepted tgz.
+Changing the package bytes or release commit would require new artifact and
+native-platform acceptance. No daily Web or Headless profile was upgraded,
+and no real model request was made; those remain separate actions.
+
 ### Superseded pre-release artifacts
 
 The first 26-file candidate, SHA-256 `33757ce11633ac167fa9c5a6fdb7a8938578fcb871edd9afdb2f89dcb51b4316`, was built from implementation baseline `ffc6fe9e1246a815f0bb630943c59d14b6505716`. Native macOS passed. Native Windows reached the restart endpoint but did not prove a changed boot ID, so its Headless phase correctly remained unrun. That candidate was superseded when packaged documentation changed.

package/docs/SEMANTIC_COMPATIBILITY.md

@@ -79,10 +79,23 @@ event vocabulary `root_message`, `delegated_message`, `tool_result`,
 runner executes every mirrored case without skips and compares the bounded
 result contract; it does not translate a missing capability into a pass.
 
-## Current 0.4.0 alignment status
+## Recorded 0.4.0 alignment status (2026-09-03)
 
 The semantic implementation described here entered the DSH `0.4.0` line from implementation baseline `ffc6fe9e1246a815f0bb630943c59d14b6505716`. The shared-contract reference is the Codex `0.10.0` source at `e4fccf690bcbc2be79d0b8d42a1a269f87072120`; this covers only the named contracts, not full product parity. Exact release commit, artifact, native-platform, and publication identities are recorded outside this semantic document because each is a separate evidence scope.
 
+In plain language, 0.4.0 aligned the rule that evidence must prove the exact unfinished operation and target. It did not copy every Codex feature, and it did not include changes introduced later in Codex 0.11.0.
+
+| Behavior | DSH 0.4.0 status |
+| --- | --- |
+| Evidence proves the requested operation, target, and result for a current open item | aligned with Codex 0.10.0 |
+| Waiting or deferral must have a saved, typed reason | implemented in the DSH boundary model; live external work is rechecked before yielding |
+| Quoted or reference text must not create executable requirements | implemented; Codex 0.11.0's more specific correction-target rules still need a separate regression review |
+| A mutation needs a current root-user instruction naming the action and exact target | implemented through DSH's native `context_guard_action` path |
+| A high-risk publication needs a one-shot ticket bound to the exact candidate | not implemented |
+| Cleanup and completion stay inside an explicit work unit | not implemented |
+| The four new 0.11.0 incident families and protocol-specific benchmark runners | not implemented; DSH currently consumes the reviewed portable fixture layer only |
+| Codex Hook cache, `PreToolUse` wiring, and installer recovery | not applicable to the DSH host; equivalent behavior must use DSH-native tools and lifecycle events |
+
 The 0.4.0 implementation baseline keeps the v0.3 digest and conformance work and adds:
 
 - Proof obligations that must name a current pending item and use evidence matching the requested kind, surface, subject, operation, and outcome.
@@ -105,7 +118,17 @@ Retained from v0.3.0:
 
 This is not a full product-parity claim. It does not copy the Codex private ledger, Hook lifecycle, cache, or installer, and it cannot prevent all trusted in-process Goal/session bypasses.
 
-Main CI run `33540907051` passed the implementation baseline. The release commit adds the packaged documentation and must pass its own CI; its deterministic tgz must then pass same-byte native macOS and Windows acceptance before publication. Historical candidate results remain bound to their recorded SHA-256 values and never transfer to changed bytes; see [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
+Main CI run `33540907051` passed the implementation baseline. The exact 0.4.0 package later passed same-byte native macOS and Windows acceptance and was published from annotated tag `v0.4.0`; exact release and public-readback identities are recorded in [`LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md). Historical candidate results remain bound to their recorded SHA-256 values and never transfer to changed bytes.
+
+## Follow-up identified against Codex 0.11.0
+
+DSH needs a deliberate follow-up, not a line-for-line port. The highest-value shared gap is execution-time authorization for public release identities. DSH already routes supported mutations through `context_guard_action`, so the next design should extend that native path with a one-shot authorization record bound to the exact candidate and input instead of copying the Codex `PreToolUse` Hook.
+
+Work-unit scope and correction attribution are also shared semantic gaps and should gain portable regression cases before implementation. Stop-disposition handling is partly equivalent already, so it should be compared with the 0.11.0 cases before code is changed. Codex cache repair, Hook trust, and plugin installation remain Codex-only. Incident-corpus tooling may remain owned by Codex, while reviewed platform-neutral cases continue to be mirrored here.
+
+## 0.4.2 candidate boundary
+
+The 0.4.2 candidate retains these exact mirrored fixtures and the recorded upstream pin. Its DSH-native rebinding, bounded checkpoint output, and recovery changes do not establish parity with later Codex releases. `upstream-deltas.json` is the dated 2026-09-03 comparison snapshot: its `currentRelease` fields name the releases compared then, not a live latest-version lookup. Refreshing that comparison requires a separate upstream audit; it does not happen merely because either product releases a newer version.
 
 ## Validation boundaries
 

package/docs/distribution.md

@@ -25,18 +25,33 @@ version and annotated tag are retained for audit history; the npm version is
 deprecated with `Release metadata incomplete; use dsh-completion-guard@0.3.1.`
 Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
 
-## Published v0.3.2 destinations
+## Published v0.4.0 destinations
 
-1. [GitHub Release `v0.3.2`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.2)
+1. [GitHub Release `v0.4.0`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.4.0)
    is the latest non-draft, non-prerelease release. Its annotated tag peels to
+   release commit `d5cd0ca17833d05bfdf41457ae203864bde8056b`. The Release
+   carries the frozen tgz, checksum, artifact manifest, and separate macOS and
+   Windows native-acceptance annexes. The tgz has SHA-256
+   `71ce205dedeffe72566ad399e001f0b337d057cede297e1d2249acec67cde1f2`.
+2. [`dsh-completion-guard@0.4.0` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.4.0)
+   is published and `latest` resolves to `0.4.0`. The registry `gitHead`
+   equals the release commit, and a fresh registry download is byte-identical
+   to the frozen Release tgz.
+3. Source commit, candidate/main/tag CI, native macOS and Windows acceptance,
+   npm metadata and bytes, and all five GitHub assets are reconciled in
+   [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
+
+## Earlier v0.3.2 destinations
+
+1. [GitHub Release `v0.3.2`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.3.2)
+   remains a non-draft, non-prerelease historical release. Its annotated tag peels to
    release commit `22cde6106cdca511265bb4103375a263a0762b9c`. The attached
    frozen tgz has SHA-256
    `feb7fc29799820e08dfe6d2bdb94823e745df9b5aa7c34d46262e5df30dabac4`;
    the separate `SHA256SUMS.txt` asset binds the same bytes.
 2. [`dsh-completion-guard@0.3.2` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.2)
-   is published and `latest` resolves to `0.3.2`. The registry `gitHead`
-   equals the release commit, and a fresh registry download is byte-identical
-   to the frozen release tgz.
+   remains published. The registry `gitHead` equals the release commit, and a
+   registry download is byte-identical to the frozen release tgz.
 3. Source commit, tag, CI, native macOS and Windows acceptance, npm metadata
    and bytes, and both GitHub assets are reconciled in
    [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).
@@ -50,9 +65,9 @@ Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
    `df3c0cae29fdfa0014d5cfdb6ade72c42386555779f9f4d8b59e37a2557c5d7e`;
    the separate `SHA256SUMS.txt` asset binds the same bytes.
 2. [`dsh-completion-guard@0.3.1` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.3.1)
-   is published and `latest` resolves to `0.3.1`. The registry packument
-   `gitHead` equals the release commit above, and a fresh registry download is
-   byte-identical to the frozen release tgz.
+   remains published. The registry packument `gitHead` equals the release
+   commit above, and a registry download is byte-identical to the frozen
+   release tgz.
 3. Source commit, tag, CI, native macOS and Windows acceptance, npm metadata
    and bytes, and both GitHub assets are reconciled in
    [`docs/LOCAL_ACCEPTANCE.md`](LOCAL_ACCEPTANCE.md).

package/docs/upstream-deltas.json

@@ -1,217 +1,118 @@
 {
-  "ledgerVersion": "1",
-  "description": "Delta ledger tracking how dsh-completion-guard adapts codex-context-guard protocol capabilities. Each entry separates the source fact from plan status, implementation status, deterministic tests, native platform acceptance, and release readback. A disposition of adapted/adopted with implementationStatus not-implemented is a planned alignment, not a shipped one.",
-  "snapshotBoundary": "Pre-release planning snapshot retained for historical traceability. Candidate labels and empty release readbacks describe the planning state when each row was recorded, not the current package status. Use CHANGELOG.md and docs/LOCAL_ACCEPTANCE.md for the v0.3.0 publication attempt and v0.3.1 release-repair state.",
+  "ledgerVersion": "2",
+  "description": "Current, evidence-bounded delta ledger for behavior shared between codex-context-guard and dsh-completion-guard. It separates aligned behavior, partial host-native equivalents, missing shared behavior, and Codex-only lifecycle features.",
+  "updatedAt": "2026-09-03",
   "source": {
     "product": "codex-context-guard",
-    "version": "v0.9.4",
-    "head": "0921dcd",
-    "stopProtocol": "2.0.0",
-    "proofProtocol": "1.0.0",
-    "executionProtocol": "1.0.0",
-    "stateSchema": 7
+    "currentRelease": "v0.11.0",
+    "currentReleaseHead": "558612b02826fab1e2ccb1e36f1a4e2c36caf2fd",
+    "alignedReference": "v0.10.0",
+    "alignedReferenceHead": "e4fccf690bcbc2be79d0b8d42a1a269f87072120"
   },
   "target": {
     "product": "dsh-completion-guard",
-    "codeBaseline": "v0.3.0 local candidate over prerequisite 55f694d2534147b7fb2aac1d5b795ae5b7ead50f",
-    "sourceHead": "uncommitted-local-candidate",
-    "host": "dsh 0.1.1-rc.2 / cordis 4.0.1",
-    "nextRelease": "v0.3.0"
+    "currentRelease": "v0.4.0",
+    "currentReleaseHead": "d5cd0ca17833d05bfdf41457ae203864bde8056b",
+    "implementationBaseline": "ffc6fe9e1246a815f0bb630943c59d14b6505716",
+    "host": "DSH 0.1.2-alpha.3 / dshmarket 1.39.0 / Cordis 4.0.2"
   },
+  "alignmentClaim": "DSH 0.4.0 aligns the named evidence and proof obligations with Codex 0.10.0. It does not claim full product parity and does not include all Codex 0.11.0 changes.",
   "dispositions": [
-    "adopted",
-    "adapted",
-    "already-equivalent",
-    "not-applicable",
-    "deferred",
-    "rejected"
+    "aligned",
+    "partial-equivalent",
+    "not-implemented",
+    "not-applicable"
   ],
   "entries": [
     {
-      "capability": "stop-protocol-2",
-      "sourceFact": "Stop protocol 2.0.0 (published v0.9.4): only an authenticated, current-turn, full-coverage checkpoint can mark a task complete; assistant completion prose is diagnostic and never a control source.",
-      "disposition": "adapted",
-      "targetRelease": "dsh-completion-guard v0.3.0",
-      "rationale": "DSH keeps its native Goal Round Driver scheduling; the stop decision table is rebuilt so prose classification only produces diagnostics and uncontrolled turns safe-yield with pending items preserved.",
-      "planStatus": "planned in DSH v0.3.0 stop policy split (observeAssistantOutcome / decideTurnBoundary)",
-      "implementationStatus": "local-candidate-implemented",
+      "capability": "requested-operation-proof-binding",
+      "introducedBy": "codex-context-guard v0.10.0",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.4.0",
+      "plainLanguage": "Evidence can close an item only when it belongs to work that is still open and proves the operation, target, and result the user requested.",
+      "implementation": "DSH proof obligations bind the current item, evidence kind, surface, subject, operation, outcome, scope, state readback, and session.",
       "tests": [
-        "tests/domain/v030-stop-boundary.test.ts",
-        "tests/domain/portable-semantics.test.ts (all 37 mirrored cases)"
-      ],
-      "plannedTests": [
-        "stop-prose-is-diagnostic",
-        "no-control-safe-yield",
-        "stop-metamorphic-equivalence",
-        "active-armed-goal-round-driver-only"
-      ],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/domain/v040-proof.test.ts",
+        "tests/tools/checkpoint.test.ts"
+      ]
     },
     {
-      "capability": "proof-protocol-1",
-      "sourceFact": "Proof protocol 1.0.0 (published v0.9.4): deterministic proof contracts bind obligations to evidence with hash-bound manifests.",
-      "disposition": "adapted",
-      "targetRelease": "dsh-completion-guard v0.3.0 (minimal state verification) and v0.4.0 (full proof manifest)",
-      "rationale": "v0.3 introduces effect plus independent state readback for the stateful action set with semantic action and target binding; the full versioned proof manifest (subject readback, scope coverage) follows in v0.4.",
-      "planStatus": "planned; minimal state_verification set is a v0.3.0 release gate",
-      "implementationStatus": "v0.3-minimal-state-verification-local-candidate-implemented",
+      "capability": "typed-stop-disposition-validation",
+      "introducedBy": "codex-context-guard v0.11.0",
+      "disposition": "partial-equivalent",
+      "targetRelease": "unassigned",
+      "plainLanguage": "A claimed wait or deferral must match a real saved reason; wording alone cannot end the work.",
+      "implementation": "DSH 0.4.0 already requires typed boundary qualifications and rechecks live external work before yielding. Differential 0.11.0 cases are still needed to prove equivalent owner and authorization handling.",
       "tests": [
-        "tests/domain/v030-certificate.test.ts (all ten STATEFUL_ACTIONS, role closure, cross-pairing, predicate mismatch)"
-      ],
-      "plannedTests": [
-        "stateful-actions-require-independent-readback",
-        "effect-only-certification-rejected",
-        "binding-state-closure-role-matrix"
-      ],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/domain/v030-stop-boundary.test.ts",
+        "tests/tools/boundary-integration.test.ts"
+      ]
     },
     {
-      "capability": "certificate-manifest-digest-v3",
-      "sourceFact": "Digest v3 canonical manifests (this repository, introduced with the semantic compatibility assets): session/host/evidence/binding/certification digests with golden vectors and a cross-language gate.",
-      "disposition": "adopted",
-      "targetRelease": "dsh-completion-guard v0.3.0",
-      "rationale": "DSH byte-mirrors tests/fixtures/conformance/digest_v3 and re-derives all 29 vectors with its own runner; digest identity inputs exclude telemetry refs by contract.",
-      "planStatus": "fixture gate frozen; DSH runner implemented against the byte mirror",
-      "implementationStatus": "codex-encoder-and-fixture-complete; dsh-runner-implemented (vitest re-derives all 29 vectors from the byte mirror)",
+      "capability": "supersession-attribution",
+      "introducedBy": "codex-context-guard v0.11.0",
+      "disposition": "partial-equivalent",
+      "targetRelease": "unassigned",
+      "plainLanguage": "Quoted examples and reply annotations must not replace the user's real requirements, and an unclear correction must not silently replace the previous item.",
+      "implementation": "DSH 0.4.0 excludes quoted, code, and reference blocks from executable requirement capture. Its replacement targeting has not yet been proven against the full Codex 0.11.0 regression set.",
       "tests": [
-        "codex-context-guard tests/test_reference_digest_encoder.py (29/29 golden vectors, fail-closed negatives, --check gate)",
-        "dsh-completion-guard tests/domain/digest-v3.test.ts (byte-mirror pin and 29/29 cross-language vectors)"
-      ],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/domain/v030-contract-segment.test.ts",
+        "tests/domain/core.test.ts"
+      ]
     },
     {
-      "capability": "execution-protocol-1",
-      "sourceFact": "Execution protocol 1.0.0 exists in Codex v0.9.4; not all surfaces are enabled through PreToolUse in Codex itself.",
-      "disposition": "deferred",
+      "capability": "pre-action-authorization",
+      "introducedBy": "codex-context-guard v0.11.0",
+      "disposition": "partial-equivalent",
       "targetRelease": "unassigned",
-      "rationale": "DSH first needs a host coverage matrix (tools guard, permissions, sandbox, tool input digest, agent lineage, Goal CAS, high-risk write surfaces); an execution contract is only built against confirmed gaps.",
-      "planStatus": "deferred pending host coverage matrix",
-      "implementationStatus": "local-candidate-implemented-diagnostic-only",
+      "plainLanguage": "A high-risk release action must be stopped before execution unless the user authorized that exact candidate and input.",
+      "implementation": "DSH 0.4.0 routes supported mutations through context_guard_action and requires a current root-owned requirement with the exact action and target. It has no one-shot candidate-bound authorization ticket and no equivalent coverage for every release identity surface.",
       "tests": [
-        "tests/domain/v030-stop-boundary.test.ts",
-        "tests/domain/portable-semantics.test.ts"
-      ],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/tools/evidence.test.ts",
+        "tests/runtime.test.ts"
+      ]
     },
     {
-      "capability": "classifier-2.3.2-quoted-completion",
-      "sourceFact": "Classifier 2.3.2 (v0.8.12/0.9.4) keeps quoted completion phrases and meta-discussion diagnostic; direct completion assertions stay gated.",
-      "disposition": "adapted",
-      "targetRelease": "dsh-completion-guard v0.3.0",
-      "rationale": "The DSH stop policy rebuild keeps whole-completion and quote/assumption classification as diagnostic outcome codes only.",
-      "planStatus": "planned with stop-protocol-2",
-      "implementationStatus": "not-implemented",
-      "tests": [],
-      "plannedTests": [
-        "quoted-completion-diagnostic-only"
-      ],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
-    },
-    {
-      "capability": "utf8-stdin-decoding",
-      "sourceFact": "v0.9.4 decodes Hook stdin as UTF-8 explicitly, independent of host locale, rejecting invalid bytes fail-closed.",
-      "disposition": "already-equivalent",
-      "targetRelease": "none",
-      "rationale": "DSH has no Hook stdin surface; it reads persisted structured session logs, so non-ASCII prompt text is preserved natively.",
-      "planStatus": "satisfied by native host design",
-      "implementationStatus": "already-equivalent",
-      "tests": [],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
-    },
-    {
-      "capability": "managed-cache-fallback",
-      "sourceFact": "v0.8.11 Hooks fall back to the newest valid managed plugin cache when the original cache directory is removed, with strict version validation and a repair hint when nothing valid survives.",
-      "disposition": "not-applicable",
-      "targetRelease": "none",
-      "rationale": "DSH has no installed Hook cache lifecycle; plugin loading and lifecycle belong to the Cordis host.",
-      "planStatus": "not applicable to the DSH host model",
-      "implementationStatus": "not-applicable",
-      "tests": [],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
-    },
-    {
-      "capability": "installer-missing-cache-messaging",
-      "sourceFact": "v0.8.11 installer explains missing historical caches and how to restore them instead of failing silently.",
-      "disposition": "not-applicable",
-      "targetRelease": "none",
-      "rationale": "Same host-model boundary as managed-cache-fallback.",
-      "planStatus": "not applicable to the DSH host model",
-      "implementationStatus": "not-applicable",
-      "tests": [],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+      "capability": "work-unit-scope",
+      "introducedBy": "codex-context-guard v0.11.0",
+      "disposition": "not-implemented",
+      "targetRelease": "unassigned",
+      "plainLanguage": "Completing or cleaning up one part of a task must not close or expand unrelated work.",
+      "implementation": "DSH has no work-unit record equivalent to Codex work-unit/v1.",
+      "tests": []
     },
     {
-      "capability": "privacy-token-value-classifier",
-      "sourceFact": "v0.8.11 privacy classification inspects serialized token field values, allowing redaction placeholders and readable examples while blocking real-looking values.",
-      "disposition": "already-equivalent",
-      "targetRelease": "none",
-      "rationale": "DSH sanitizes clause text by value patterns (bearer tokens, header values, quoted and bare secret assignments) before items are stored; value-based redaction is the existing behavior.",
-      "planStatus": "satisfied by existing DSH sanitization",
-      "implementationStatus": "already-equivalent",
+      "capability": "incident-taxonomy-and-benchmark-routing",
+      "introducedBy": "codex-context-guard v0.11.0",
+      "disposition": "not-implemented",
+      "targetRelease": "unassigned",
+      "plainLanguage": "Execution authorization, Stop disposition, correction attribution, and scope transitions need separate regression families instead of one generic Stop test.",
+      "implementation": "The private incident corpus remains Codex-owned. DSH mirrors reviewed platform-neutral fixtures, but the new 0.11.0 families and protocol-specific runners have not been imported.",
       "tests": [
-        "tests/domain/core.test.ts sanitizeClauseText coverage (existing DSH suite)"
-      ],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/domain/portable-semantics.test.ts",
+        "tests/domain/digest-v3.test.ts"
+      ]
     },
     {
-      "capability": "incident-corpus",
-      "sourceFact": "v0.9.4 adds a standard-library incident corpus tool with reviewed, sanitized public fixtures used by CI.",
-      "disposition": "adapted",
-      "targetRelease": "dsh-completion-guard v0.3.0 (fixture layer only)",
-      "rationale": "Cross-platform protocol regressions are expressed as portable conformance cases in the shared fixture; the corpus tooling itself stays Codex-only.",
-      "planStatus": "portable fixture layer established; case growth is continuous",
-      "implementationStatus": "fixture-schema-first-batch-and-all-case-dsh-runner-present",
+      "capability": "portable-conformance-and-digest-v3",
+      "introducedBy": "codex-context-guard v0.9.x",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.3.0 and later",
+      "plainLanguage": "Both implementations answer to the same reviewed portable cases and canonical digest bytes for the shared protocol surface.",
+      "implementation": "DSH byte-mirrors the pinned portable fixture and 29 digest-v3 vectors and runs every mirrored case without skips.",
       "tests": [
-        "tests/domain/portable-semantics.test.ts (37/37, no skips)",
-        "tests/domain/digest-v3.test.ts (pin and digest mirror integrity)"
-      ],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+        "tests/domain/portable-semantics.test.ts",
+        "tests/domain/digest-v3.test.ts"
+      ]
     },
     {
-      "capability": "schema-7-private-ledger",
-      "sourceFact": "Codex persists a private schema-7 state ledger across the eight-Hook lifecycle.",
+      "capability": "codex-hook-cache-and-installer-lifecycle",
+      "introducedBy": "codex-context-guard",
       "disposition": "not-applicable",
       "targetRelease": "none",
-      "rationale": "DSH persists in the native session log by design; the plan explicitly excludes porting the Codex private ledger.",
-      "planStatus": "not applicable; shared semantics carried by fixtures instead",
-      "implementationStatus": "not-applicable",
-      "tests": [],
-      "plannedTests": [],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
-    },
-    {
-      "capability": "surface-intent-and-capability-binding",
-      "sourceFact": "Published Codex v0.9.5 narrows UI wording detection and binds task, file, Windows-path, and capability evidence to the exact item that was read.",
-      "disposition": "deferred",
-      "targetRelease": "dsh-completion-guard v0.4.0",
-      "rationale": "DSH should port the published Codex locator, capability priority, and clause-level binding rules through shared fixtures instead of creating different rules.",
-      "planStatus": "Codex v0.9.5 semantics are published; DSH implementation remains deferred to v0.4.0",
-      "implementationStatus": "not-implemented",
-      "tests": [],
-      "plannedTests": [
-        "canonical-locator-subject-identity",
-        "capability-trust-root-priority"
-      ],
-      "nativeAcceptance": "none",
-      "releaseReadback": "none"
+      "plainLanguage": "Codex Hook trust, plugin-cache recovery, and the Codex installer do not exist in the DSH host model.",
+      "implementation": "DSH uses Cordis bundles, DSH profiles, host-lock checks, and DSH-native lifecycle events. Shared safety behavior must be adapted through those mechanisms rather than copied.",
+      "tests": []
     }
   ]
 }