dsh-completion-guard 0.4.3 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to this project are documented here. The project is pre-1.0; release versions track the plugin lifecycle, not stabilised API promises.
 
+## 0.5.1 - 2026-09-10
+
+### Changed
+
+- **Support DSH >= 0.1.5-rc.1, with no backward compatibility.** The DSH Session V2 API, the V2 event vocabulary, and every older host package set were removed rather than kept behind a fallback. A session object that does not expose the V3 `snapshotEvents()` API is refused loudly instead of being projected as an empty log, and a header that is not session format 3 is refused instead of being hashed as a guessed identity. `0.1.5-rc.1` is the version this release was built and tested against; it is the baseline, not a ceiling. Upgrading from DSH `0.1.2-rc.1` means starting a **new session**; old logs, proposals and certificates are never migrated, promoted, or deleted.
+- **The support policy is a range, and the host check is still an exact graph.** `peerDependencies` publish `>=0.1.5-rc.1` (Cordis `^4.0.2`), so `0.1.4`, `0.1.5-alpha.9` and anything older are refused. Because npm resolves a prerelease from a range only when its `major.minor.patch` tuple matches the bound, `0.1.5-rc.2` and `0.1.5` resolve while `0.1.6-rc.1` and `0.2.0-rc.1` do not; that limitation is documented and tested rather than hidden behind a wildcard. A newer host that is not a registered cohort is still reported as unverified, so the range never substitutes for the graph lock.
+- **Register separate exact host sets for DSH 0.1.5-rc.1 and 0.1.5-rc.2.** Each set contains 33 core packages bound to their published npm identities; mixing rows from different versions is refused. The registry-derived provenance stays in the host-lock digest, while native acceptance is recorded separately for each exact artifact and platform. Older host sets remain historical and unsupported. `dshmarket` is checked independently by the action adapter.
+- **Guard never restarts a Goal the user stopped.** When a current Goal is paused, blocked, completed, or its phase has not been read back, turn stopping yields with `goal_paused_by_user_safe_yield` / `goal_not_continuable_safe_yield` instead of spending the one allowed correction steer. Guard's Goal access surface has no resume entry point at all: it can only disarm at an accepted boundary, and only a human `resume` re-arms a goal.
+- **Terminal marker classification was re-verified against the shipped 0.1.5-rc.1 renderers.** The two session renderers registered by `@deepseek-ai/dsh-base` append markers only for negative facts and non-zero exits — unchanged between host versions — so an unmarked completed foreground result remains a clean success for those two names under a supported host lock. The out-of-bundle persistent renderer added `[Command finished with exit code N]` and `[Command timed out or OOM]`; both are now classified explicitly, so such a result is read by its own marker instead of falling through to the unmarked rule.
+- **The renamed PTC dispatch events are the only dispatch vocabulary.** `tool/ptc-dispatch-start` and `tool/ptc-dispatch` replaced `tool/code-dispatch-start` and `tool/code-dispatch`; the retired names are ignored and produce no evidence.
+- Package version is `0.5.1`, verified unused on npm before it was written.
+- Pending root confirmations remain explicit after checkpoint and recovery: the saved resume condition is shown before target or evidence-collection advice, and the reserved action stays blocked.
+
+### Unchanged
+
+- The 29 byte-mirrored digest-v3 cross-language vectors are byte-identical: the V3 session identity feeds the inherited-prefix length into the existing `seedLength` digest token, and V3's `isSeeded` marker was deliberately left out of the shared digest domain so a host upgrade cannot silently change another repository's parity contract.
+- The 0.5.0 confirmation, prepare, diagnosis and no-certification-gain behaviours, the first-message protection boundary, and durable-evidence-only certification.
+
+### Not yet established
+
+- At candidate preparation, deterministic tests cover a real host loop with a simulated model, including stopping and disk recovery. Cross-platform CI, native application acceptance, real-model behaviour and publication still require separate evidence.
+
+## 0.5.0 - 2026-09-10
+
+### Changed
+
+- **`always` mode now protects from your first message instead of writing into brand-new sessions.** A freshly created session stays completely empty: the Guard no longer appends context messages when the session starts, so the session still looks new and a DSH session mode (standard, minimal, or a custom preset) can be chosen before anything is sent. Protection begins in the same step as the first real user message, ahead of that message — the first task, including its first file changes, is covered. A first message that only carries an image or an attachment also starts protection; a blank message starts nothing and creates no empty contract.
+- **A confirmation can carry follow-up text in the same reply.** The confirmation line `确认重绑定 <proposal ID>` may stand alone as the first line; an explanation request or a new task after a blank line keeps its own meaning, and a new task is captured like any other instruction. A confirmation buried inside a sentence, inside quotes, inside a code block, or followed by a reversal such as "先不要确认", does nothing — a reply either confirms cleanly or stays pending, never partially.
+- **Useless rebind confirmations are refused up front.** Splitting one uncertifiable requirement into clauses that are all equally uncertifiable returns "no certification gain" instead of producing a proposal that would spend a user confirmation without improving certification.
+- **Diagnosis names what is possible before what is missing.** Checkpoint, recovery, rebind, and status share one diagnosis per item: what kind of work it is, whether the current adapters can certify it, which target fields or evidence facets are missing, and one concrete next action. Questions such as "是否有更新" stay recorded with their source but report honestly that they cannot be machine-certified — finish them and report the answer — instead of being pushed into a rebind loop. Repeating an identical rejected attempt returns the same stable "unchanged" answer instead of a fresh rejection each time.
+
+### Added
+
+- **`context_guard_prepare` (read-only).** Before a stateful action it reports the supported command shape (from the same audited parser the executor uses), the required resolution/effect/state evidence order, reusable evidence references, the host capability verdict, and the exact missing target fields. It performs no action, and a guessed or default target is never treated as user authority.
+- **An action that already happened without its prestate evidence is reported as a historical gap**: the observed state can be read back, and repeating the action to mint missing evidence is explicitly not suggested.
+
+### Compatibility
+
+- Recognize pnpm hoisted installations when checking a dependency-free Headless profile. Bare package-name entries now work alongside versioned entries; installed versions, lockfile integrity, unique identities, and actual package locations remain mandatory.
+- The supported DSH target is exactly `0.1.2-rc.1` (with Cordis `4.0.2`). The active host allowlist contains that one audited core graph; alpha and older RC package sets are recorded as historical identities only, and an installed graph from those sets fails closed instead of certifying. npm peer dependencies accept only `0.1.2-rc.1`.
+- Sessions created before this version keep their stored messages, proposals, and certificates under their historical rules. The first message this version writes into such a session carries an explicit protocol boundary marking the cut; duties and certificates from before the cut are never reinterpreted. Upgrading does not remove previously injected messages.
+
 ## 0.4.3 - 2026-09-08
 
 - Separate the exact DSH core lock from optional market versions. Recheck the active core graph during replay; changed, missing or duplicate core dependencies still fail closed.

package/CHANGELOG.zh-CN.md

@@ -2,6 +2,48 @@
 
 本项目的重要变化记录在这里。项目仍处于 1.0 之前；版本号跟踪插件生命周期，不代表 API 已稳定。
 
+## 0.5.1 - 2026-09-10
+
+### 变化
+
+- **支持 DSH >= 0.1.5-rc.1，且不向后兼容。** DSH Session V2 API、V2 事件词表和所有更早的宿主包组合都已删除，不再保留 fallback。不暴露 V3 `snapshotEvents()` 的会话对象会被明确拒绝，而不会被当作空日志投影；不是会话格式 3 的头部也会被拒绝，而不会被当作猜测出的身份参与哈希。`0.1.5-rc.1` 是本版本实际开发与验证的基线，不是支持上限。从 DSH `0.1.2-rc.1` 升级意味着**新建会话**；旧日志、提案和证书既不迁移、也不提升为当前证据，更不会删除。
+- **支持政策是范围，宿主校验仍是精确图。** `peerDependencies` 发布 `>=0.1.5-rc.1`（Cordis `^4.0.2`），因此 `0.1.4`、`0.1.5-alpha.9` 及更早版本都会被拒绝。由于 npm 只有在预发布版本的 `major.minor.patch` 与下界一致时才会从范围中解析，`0.1.5-rc.2` 与 `0.1.5` 可解析，而 `0.1.6-rc.1` 与 `0.2.0-rc.1` 不会；这一限制被记录下来并写进决策测试，而不是用通配符掩盖。未注册为队列的更新宿主仍报告为未验证，范围绝不替代宿主图校验。
+- **分别注册 DSH 0.1.5-rc.1 和 0.1.5-rc.2 的精确宿主组合。** 每组包含 33 个核心包，绑定各自已发布的 npm 身份；跨版本混装会被拒绝。宿主锁摘要保留注册表来源标记，原生验收则按确切制品和平台单独记录。更早的宿主组合仅保留历史身份，不再支持。`dshmarket` 由动作适配器独立校验。
+- **Guard 绝不重启用户已停止的 Goal。** 当前 Goal 处于暂停、阻塞、已完成，或其阶段尚未回读时，回合停止会以 `goal_paused_by_user_safe_yield` / `goal_not_continuable_safe_yield` 让出，而不是消耗唯一一次纠正引导。Guard 的 Goal 访问面根本没有 resume 入口：它只能在已接受的边界上 disarm，只有人类执行 `resume` 才能重新武装。
+- **终端标记分类已针对 0.1.5-rc.1 实际渲染器重新核对。** `@deepseek-ai/dsh-base` 注册的两个会话渲染器只在否定事实和非零退出时追加标记（两个宿主版本一致），因此在受支持的宿主锁下，这两个名字的"完成的前台结果且无标记"仍是干净成功。不在默认 bundle 内的常驻渲染器新增了 `[Command finished with exit code N]` 与 `[Command timed out or OOM]`；两者现在都被显式分类，因此这类结果按自身标记判定，而不会落入无标记规则。
+- **重命名后的 PTC 派发事件是唯一的派发词表。** `tool/ptc-dispatch-start`、`tool/ptc-dispatch` 取代了 `tool/code-dispatch-start`、`tool/code-dispatch`；旧名称被忽略，不产生任何证据。
+- 包版本为 `0.5.1`，写入前已确认该版本在 npm 上未被占用。
+- 等待根用户确认的要求在 checkpoint 和恢复提示中仍明确可见：先显示原有恢复条件，再处理目标或证据收集问题；保留动作仍不可执行。
+
+### 未改变
+
+- 29 条字节镜像的 digest-v3 跨语言向量逐字节保持一致：V3 会话身份把继承前缀长度写入既有的 `seedLength` 摘要字段，而 V3 的 `isSeeded` 标记被有意排除在共享摘要域之外，避免宿主升级悄悄改变另一个仓库的一致性契约。
+- 0.5.0 的确认、prepare、诊断与"无认证收益"行为、首条消息保护边界，以及"仅持久化证据可认证"的原则。
+
+### 尚未确立
+
+- 候选准备时，确定性测试已通过真实宿主循环与模拟模型，覆盖停止和磁盘恢复。跨平台 CI、原生应用验收、真实模型行为和发布仍需要各自的独立证据。
+
+## 0.5.0 - 2026-09-10
+
+### 变化
+
+- **`always` 模式改为从你的第一条消息开始保护，而不是在全新会话里提前写入内容。** 新建会话保持完全空白：Guard 不再在会话开始时追加上下文消息，会话仍然显示为"新会话"，可以先选择 DSH 会话模式（standard、minimal 或自定义 preset）再发送任何内容。保护与第一条真实用户消息进入同一步骤、且位于该消息之前——第一个任务连同它的第一次文件修改都在覆盖范围内。首条消息只有图片或附件时同样开始保护；纯空白消息不启动任何内容，也不会生成空合同。
+- **一次回复可以同时包含确认和后续内容。** 确认行 `确认重绑定 <提案 ID>` 单独作为首行即可；空行之后的解释请求或新任务保留各自含义，新任务照常采集。嵌在句子中间、引号或代码块里的确认，以及后面跟着"先不要确认"等反转表述的确认，都不会生效——一条回复要么干净地确认，要么保持待确认，绝不部分生效。
+- **无收益的重绑定确认会被直接拒绝。** 把一条本就不可认证的要求拆成同样不可认证的片段时，工具返回"无认证收益"，而不是生成一个只会消耗用户确认的提案。
+- **诊断先说明能做什么，再说缺什么。** checkpoint、恢复、rebind 和 status 共用同一份诊断：这条工作属于什么类型、当前适配器能否认证、缺哪些目标字段或证据面、下一步做什么。诸如"是否有更新"的提问会保留原文和来源，同时如实说明无法机器认证——完成调查并如实回答即可，不会再被推进无意义的重绑定循环。同一内容被重复提交的拒绝尝试会返回同一个稳定的"无变化"答复，而不是每次都给出新的拒绝。
+
+### 新增
+
+- **`context_guard_prepare`（只读）。** 在执行有状态动作前，报告受支持的命令形状（与执行器使用同一套已审计解析规则）、所需的 resolution/effect/state 证据顺序、可复用的证据引用、宿主能力判定以及精确缺失的目标字段。它不执行任何动作，猜测或默认值也不会被当作用户授权。
+- **动作已发生但缺少前态证据时，按"历史缺口"报告**：可以只读回读观测到的状态，并明确不建议为补证据而重复执行动作。
+
+### 兼容性
+
+- 修复 pnpm hoisted 安装方式下，未声明外部依赖的 Headless profile 被误判为不支持的问题。包映射使用裸包名或带版本的键均可识别，仍严格核对安装版本、锁文件完整性、唯一身份和实际包位置。
+- 支持的 DSH 目标为 `0.1.2-rc.1`（配合 Cordis `4.0.2`）。活跃宿主白名单只包含这一个已审计核心图；alpha 与更早 RC 的包组合仅作为历史身份保留，安装了这些组合的宿主按 fail-closed 拒绝认证。npm peer 依赖只接受 `0.1.2-rc.1`。
+- 在本版本之前创建的会话，其消息、提案和证书继续按历史规则解释。本版本向这类会话写入的第一条消息带有显式协议边界作为切点；切点之前的义务和证书不会被重新解释。升级不会删除此前注入的消息。
+
 ## 0.4.3 - 2026-09-08
 
 - 将精确的 DSH 核心锁与可选 market 版本分离。回放时重新读取实际核心依赖图；核心依赖变化、缺失或重复仍拒绝认证。

package/README.md

@@ -8,15 +8,19 @@ An add-on for DeepSeek Harness (DSH) that keeps a task's requirements and checks
 
 ## Quick start
 
-These instructions target 0.4.3. Until that version is published, use the accepted candidate archive in place of the package name below; the published 0.4.2 does not support the new core-lock workflow.
+These instructions describe the **unpublished 0.5.1 candidate**. To evaluate it, use the frozen candidate package supplied with its checksum and acceptance records:
 
-Install the plugin into the DSH Web environment:
+```sh
+dsh plugin --profile web add /absolute/path/to/dsh-completion-guard-0.5.1.tgz
+```
+
+Once 0.5.1 is published, install that exact version into the DSH Web environment:
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard
+dsh plugin --profile web add dsh-completion-guard@0.5.1
 ```
 
-Before restarting DSH, record and verify the DSH program directory and the Web settings directory. Replace the example paths with the absolute paths on your machine:
+**Run this block after DSH is already upgraded and restarted, not before.** `inject` records the absolute runtime and profile roots and binds the graph it finds there, and the runtime re-reads those same roots later; injecting against the old runtime writes a lock describing a graph the new runtime no longer has. `inject` also **writes Guard's managed block into `<profile>/cordis.patch.yml`**, so back that file up first. Read each command's verdict from the `status` field in its JSON output — `inspect`, `inject` and `verify-dump` exit `0` even when it says `unsupported`, so a `$?` check alone does not tell you the graph was accepted.
 
 ```sh
 DSH_RUNTIME_ROOT=/absolute/path/to/.dsh-runtime
@@ -28,7 +32,7 @@ GUARD_HOST_LOCK="$DSH_PROFILE_ROOT/node_modules/.bin/dsh-completion-guard-host-l
 dsh --profile web --dump-config | "$GUARD_HOST_LOCK" verify-dump --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT" --dump-config -
 ```
 
-On Windows, run the same three subcommands through `dsh-completion-guard-host-lock.cmd` in the Web settings directory's `node_modules\.bin` directory and use Windows absolute paths. Repeat this check after changing DSH, Guard or the profile location; an ordinary market-only update does not require reinjection. The Guard stays unavailable if the active package set is missing, mixed, duplicated, or different from a checked setup.
+On Windows, run the same three subcommands through `dsh-completion-guard-host-lock.cmd` in the Web settings directory's `node_modules\.bin` directory and use Windows absolute paths. **Windows is accepted for evaluation but has not been natively audited for this cohort**, so treat a Windows result as unverified until the native gate runs. Repeat this check after changing DSH, Guard or the profile location; an ordinary market-only update does not require reinjection. The Guard stays unavailable if the active package set is missing, mixed, duplicated, or different from a checked setup.
 
 Restart DSH Web, open a session, and enable the Guard:
 
@@ -37,7 +41,7 @@ Restart DSH Web, open a session, and enable the Guard:
 /context-guard status
 ```
 
-Activation is opt-in by default. `status` shows whether the Guard is on and how many checks remain. `off` stops protection for the current session without deleting its history. `clear` closes the current checklist while keeping prohibitions. `diagnose` explains why a completion check passed or failed.
+Activation is opt-in by default. `status` shows whether the Guard is on, its startup phase (`armed` means waiting for your first message), and how many checks remain. `off` stops protection for the current session without deleting its history. `clear` closes the current checklist while keeping prohibitions. `diagnose` explains why a completion check passed or failed.
 
 ## What it protects
 
@@ -49,7 +53,11 @@ Activation is opt-in by default. `status` shows whether the Guard is on and how
 
 ## Status and compatibility
 
-The 0.4.3 line checks the exact DSH core separately from optional dshmarket. An ordinary market upgrade does not require a Guard release or core-lock reinjection. If a plugin changes the resolved core dependencies, certification still fails closed. Headless does not need market installed.
+Version 0.5.1 supports **DSH >= 0.1.5-rc.1** with Cordis `4.0.2`, and has no backward compatibility: the previous Session API, the V2 event vocabulary, and every older host package set were removed rather than kept behind a fallback. `0.1.5-rc.1` is the version this release was built and tested against, not a ceiling. If you are upgrading from DSH `0.1.2-rc.1`, **start a new session**: Guard does not migrate old logs, proposals or certificates, and it never deletes or reinterprets your old data.
+
+The version range and the host check are separate. The range `>=0.1.5-rc.1` refuses anything older, including `0.1.4` and `0.1.5-alpha.9`. Whether a specific installed host actually works is decided by the exact 33-package DSH core graph: a graph that is not registered is reported as unverified, never as supported. Alpha and older RC sets stay recorded as historical identities only, so a runtime built from one of them is reported as unsupported instead of certified.
+
+The registered host sets are **DSH `0.1.5-rc.1` and `0.1.5-rc.2`**, each with its own exact 33-package graph. Their identities come from published npm tarballs; mixed versions fail the host check. Registry identity and native acceptance are separate: use the annex for the exact Guard artifact, host version and platform to establish a native pass. See the [compatibility guide](docs/COMPATIBILITY.md) for version rules and host-lock provenance.
 
 Restart is a separate capability. Current DSH does not supply independently verified bindings for market's loaded instance, so the Guard market restart adapter is unavailable. A requested restart remains pending; core protection and unrelated operations continue. Installing or applying a package on disk does not prove that a running process or UI has adopted it.
 
@@ -64,9 +72,9 @@ The project was renamed from `dsh-context-guard` on 2026-08-29; its internal bun
 Context Guard has two activation modes:
 
 - `opt-in` (default): protection is off when a session starts. Run `/context-guard on` in that session to turn it on, and `/context-guard off` to turn it off again. This changes only the current session.
-- `always`: DSH sessions are protected automatically. Running `/context-guard off` turns protection off only for that session; other sessions start with protection on.
+- `always`: DSH sessions are protected automatically from the first real message. A brand-new session stays completely empty — the Guard writes nothing into it — so you can still pick the DSH session mode (standard, minimal, or a custom preset) before sending anything. The moment your first real message enters a step, protection begins in that same step and ahead of your message: the first task, including its first file changes, is covered. A first message that only carries an image or an attachment starts protection too and leaves an unresolved asset item until its meaning is clarified; a blank message starts nothing. Running `/context-guard off` turns protection off for that session until you run `on` again.
 
-These modes only control Guard protection. They are not the DSH session mode (for example, the standard or minimal mode) that a session starts with. With `always`, the Guard loads before each DSH session starts. DSH currently cannot switch a session's mode after the session has started, so a session protected this way keeps the DSH session mode it started with. `/context-guard on` and `/context-guard off` turn Guard protection on or off; they never change the DSH session mode.
+These modes only control Guard protection. They are not the DSH session mode (for example, the standard or minimal mode) that a session starts with. Because the Guard no longer writes into sessions before the first message, a session's DSH mode can be selected while the session is still new. `/context-guard on` and `/context-guard off` turn Guard protection on or off; they never change the DSH session mode.
 
 To make DSH sessions start with protection on, add this entry to the `cordis.patch.yml` used by the way you start DSH:
 
@@ -96,15 +104,15 @@ After the change, restart DSH.
 
 ## How completion is checked
 
-Once enabled, the Guard saves direct user requirements and acceptance checks. A saved tool result counts only when it matches the requested command, file, or other target. Before claiming the whole task complete, the model must pass the Guard's checkpoint; missing, stale, or mismatched evidence leaves the task open.
+Once enabled, the Guard saves direct user requirements and acceptance checks. A saved tool result counts only when it matches the requested command, file, or other target. A machine-certified completion requires the Guard's checkpoint; missing, stale, or mismatched evidence leaves the task uncertified. Investigations and explanations outside the supported evidence rules can still end with an honest answer, without a completion certificate.
 
 Read-only evidence collection and actions that change packages, files, services, or Git state use separate tools. A successful lookup never grants permission to make a change. Exact command limits and platform evidence are documented in [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md).
 
 ### When a requirement stays incomplete
 
-“Update the plugin and check the GUI” can contain work the Guard cannot certify. The checkpoint reports a reason and a next step for each item. A `generic_run_non_certifiable` result means that changing the binding or running another ordinary command cannot close that item.
+“Update the plugin and check the GUI” can contain work the Guard cannot certify, and questions such as “是否有更新” are inquiries: they stay recorded with their source, but no checkpoint or rebind can machine-certify an answer — complete the investigation and report the result. The checkpoint reports a reason and one concrete next action per item, and `context_guard_prepare` (read-only) shows, before a stateful action, the supported command shape, the required resolution/effect/state evidence order, and the exact missing target fields.
 
-Use `context_guard_rebind` to propose an exact, complete split of the old text. If the action or target needs clarification, first ask the root user for an explicit instruction that includes the original clause; the proposal can reference that new item's ID. The tool returns a proposal ID and a comparison. Only the user's exact reply `确认重绑定 <proposal ID>` applies it. Quoted text, tool output, and model confirmation flags do not count. Unsupported parts remain pending, and a qualified safe end does not mean all work is complete.
+Use `context_guard_rebind` to propose an exact, complete split of the old text. If the action or target needs clarification, first ask the root user for an explicit instruction that includes the original clause; the proposal can reference that new item's ID. The tool returns a proposal ID and a comparison. The user applies it with the confirmation line `确认重绑定 <proposal ID>` as the first line of a reply; an explanation request or a new task after a blank line keeps its own meaning, and a new task is captured normally. A confirmation buried in a sentence, quotes, or a code block, or followed by a reversal, does nothing. Splitting a requirement into equally uncertifiable pieces returns “no certification gain” instead of asking for a pointless confirmation. Unsupported parts remain pending, and a qualified safe end does not mean all work is complete.
 
 The default `context_guard_checkpoint` call uses `bindings: []` for diagnosis. It shows at most eight current items/constraints and ten evidence rows, within 12 KiB of plugin JSON. `pagination` reports totals and a separate `next_cursor` for each list; the first page is not the whole contract. Use `item_ids` or `evidence_ids` to focus a query, or `evidence_scope: "history"` for the complete evidence history, including rows marked unavailable. Keep the query unchanged when following a cursor; a changed contract or evidence snapshot requires a fresh query. Large rows expose `detail_id`; retrieve chunks with `detail_offset` and return the first response's `snapshot` as `detail_snapshot` on later chunks. All queries remain read-only and never shrink the certification set.
 

package/README.zh-CN.md

@@ -8,15 +8,19 @@
 
 ## 快速开始
 
-以下步骤适用于 0.4.3。该版本发布前，请用已验收候选包的路径替换下面的包名；已发布的 0.4.2 不支持新的核心锁流程。
+以下步骤面向**尚未发布的 0.5.1 候选版本**。评估候选版本时，请使用随校验和与验收记录提供的冻结包：
 
-将插件安装到 DSH 的 Web 运行环境：
+```sh
+dsh plugin --profile web add /absolute/path/to/dsh-completion-guard-0.5.1.tgz
+```
+
+0.5.1 发布后，再安装这个确切版本到 DSH 的 Web 运行环境：
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard
+dsh plugin --profile web add dsh-completion-guard@0.5.1
 ```
 
-重启 DSH 前，先记录并验证 DSH 程序目录和 Web 配置目录。请把示例路径替换为本机绝对路径：
+**请先升级并重启 DSH，再执行下面这一段。** `inject` 会记录运行目录与 profile 的绝对路径，并绑定它在当地读到的图；运行时之后会重新读取同一批根目录，因此在旧运行时上执行 inject 会写下一份描述"新运行时不复存在的那张图"的锁。`inject` 还会**把 Guard 的托管块写入 `<profile>/cordis.patch.yml`**，请先备份该文件。判定结果请读 JSON 输出里的 `status` 字段——**即使它是 `unsupported`，`inspect`、`inject`、`verify-dump` 的退出码仍是 `0`**，所以只看 `$?` 无法判断图是否被接受。
 
 ```sh
 DSH_RUNTIME_ROOT=/absolute/path/to/.dsh-runtime
@@ -28,7 +32,7 @@ GUARD_HOST_LOCK="$DSH_PROFILE_ROOT/node_modules/.bin/dsh-completion-guard-host-l
 dsh --profile web --dump-config | "$GUARD_HOST_LOCK" verify-dump --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT" --dump-config -
 ```
 
-Windows 请通过 Web 配置目录下的 `node_modules\.bin\dsh-completion-guard-host-lock.cmd` 运行相同的三个子命令，并使用 Windows 绝对路径。DSH、Guard 或 profile 路径变化后需要重新检查；仅 market 普通升级不需要重新注入。如果当前包集合缺失、混装、重复或不属于已检查环境，Guard 会保持不可用。
+Windows 请通过 Web 配置目录下的 `node_modules\.bin\dsh-completion-guard-host-lock.cmd` 运行相同的三个子命令，并使用 Windows 绝对路径。**Windows 可接受判定，但本队列尚未经过原生审计**，因此原生门执行前应把 Windows 结果视为未验证。DSH、Guard 或 profile 路径变化后需要重新检查；仅 market 普通升级不需要重新注入。如果当前包集合缺失、混装、重复或不属于已检查环境，Guard 会保持不可用。
 
 然后重启 DSH Web，打开会话并启用 Guard：
 
@@ -37,7 +41,7 @@ Windows 请通过 Web 配置目录下的 `node_modules\.bin\dsh-completion-guard
 /context-guard status
 ```
 
-默认采用 opt-in。`status` 显示 Guard 是否开启以及还有多少检查项。`off` 停止保护当前会话，但不删除历史。`clear` 关闭当前待办，同时保留禁止项。`diagnose` 说明完成检查为什么通过或失败。
+默认采用 opt-in。`status` 显示 Guard 是否开启、启动阶段（`armed` 表示已就绪、等待你的第一条消息）以及还有多少检查项。`off` 停止保护当前会话，但不删除历史。`clear` 关闭当前待办，同时保留禁止项。`diagnose` 说明完成检查为什么通过或失败。
 
 ## 它保护什么
 
@@ -49,7 +53,11 @@ Windows 请通过 Web 配置目录下的 `node_modules\.bin\dsh-completion-guard
 
 ## 状态与兼容性
 
-0.4.3 将 DSH 核心依赖与可选的 dshmarket 分开检查。market 的普通升级不再要求 Guard 发版或重新注入核心锁；如果它改变了实际解析到的核心依赖，Guard 仍会拒绝认证。Headless 不需要安装 market。
+0.5.1 支持 **DSH >= 0.1.5-rc.1**（配合 Cordis `4.0.2`），且不向后兼容：旧的 Session API、V2 事件词表和所有更早的宿主包组合都已删除，不再保留 fallback。`0.1.5-rc.1` 是本版本实际开发与验证的基线，不是支持上限。如果你从 DSH `0.1.2-rc.1` 升级，请**新建会话**：Guard 不迁移旧日志、提案或证书，也不会删除或重新解释你的旧数据。
+
+版本范围与宿主校验是两层判断。范围 `>=0.1.5-rc.1` 会拒绝更早的版本，包括 `0.1.4` 与 `0.1.5-alpha.9`；而某个已安装宿主是否真正可用，由精确的 33 包 DSH 核心图决定：未注册的图会被报告为未验证，绝不报告为受支持。alpha 与更早 RC 的包组合只作为历史身份保留，由这些组合构成的运行环境会被报告为不受支持，而不会通过认证。
+
+已注册的宿主组合是 **DSH `0.1.5-rc.1` 和 `0.1.5-rc.2`**，各自绑定完整的 33 个核心包。包身份取自已发布的 npm tarball；两个版本混装会被拒绝。注册表身份和原生验收是不同证据：原生通过需要匹配 Guard 制品、宿主版本和平台的验收附件。版本规则和宿主锁来源详见[兼容性说明](docs/COMPATIBILITY.md)。
 
 重启属于单独能力。当前 DSH 没有提供可独立验证的 market 已加载实例绑定，因此 Guard 的 market 重启适配器返回不可用；已有重启要求仍保持未完成。核心保护和不依赖该接口的操作继续工作。磁盘上的插件安装/应用不等于运行进程或 UI 已生效。
 
@@ -64,9 +72,9 @@ Windows 请通过 Web 配置目录下的 `node_modules\.bin\dsh-completion-guard
 Context Guard 有两种启用模式：
 
 - `opt-in`（默认）：打开会话时不会自动保护。你需要在这个会话中执行 `/context-guard on` 才会启用；执行 `/context-guard off` 可以再次关闭。开关只影响当前会话。
-- `always`：DSH 会话会自动启用保护。如果你在某个会话中执行 `/context-guard off`，只会关闭这个会话；其他会话会自动开启保护。
+- `always`：DSH 会话从第一条真实消息开始自动保护。全新会话保持完全空白——Guard 不写入任何内容——因此你仍然可以在发送任何内容之前选择 DSH 会话模式（standard、minimal 或自定义 preset）。第一条真实消息进入执行步骤的那一刻，保护在同一步骤内、且位于该消息之前开始：第一个任务连同它的第一次文件修改都在覆盖范围内。首条消息只有图片或附件时同样开始保护，并保留待解释的资产项；纯空白消息不启动任何内容。在某个会话中执行 `/context-guard off` 后，该会话关闭保护，直到再次执行 `on`。
 
-启用模式只控制 Guard 是否保护会话，不是 DSH 的会话模式（例如会话开始时所选的标准模式、极简模式）。选择 `always` 后，Guard 会在每个 DSH 会话开始前自动加载。DSH 当前不支持在会话开始后切换会话模式，因此受这样保护的会话会一直使用它开始时的 DSH 会话模式。`/context-guard on` 和 `/context-guard off` 只负责开启或关闭 Guard 保护，不会改变 DSH 会话模式。
+启用模式只控制 Guard 是否保护会话，不是 DSH 的会话模式（例如会话开始时所选的标准模式、极简模式）。Guard 不再在第一条消息之前写入任何内容，因此 DSH 会话模式可以在会话尚为新会话时选择。`/context-guard on` 和 `/context-guard off` 只负责开启或关闭 Guard 保护，不会改变 DSH 会话模式。
 
 如果希望 DSH 会话自动启用保护，请在当前 DSH 启动方式使用的 `cordis.patch.yml` 中增加：
 
@@ -96,15 +104,15 @@ DSH 有两种运行方式：**Web** 是在浏览器的网页界面里使用 DSH
 
 ## 如何检查完成状态
 
-启用后，Guard 会保存用户直接给出的要求和验收条件。只有已保存的工具结果与指定命令、文件或其他目标一致时，才能作为证据。模型在报告整个任务完成前必须通过 Guard 检查；证据缺失、过期或对象不一致时，任务会保持未完成。
+启用后，Guard 会保存用户直接给出的要求和验收条件。只有已保存的工具结果与指定命令、文件或其他目标一致时，才能作为证据。取得机器完成认证需要通过 Guard 检查；证据缺失、过期或对象不一致时，任务保持未认证。当前证据规则未覆盖的调查或解释仍可如实回答并结束，但不会取得完成证书。
 
 只读证据收集与修改包、文件、服务或 Git 状态的操作使用不同工具。查询成功不会自动产生变更权限。精确命令限制和平台证据见 [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md)。
 
 ### 要求一直未完成时
 
-“更新插件并检查 GUI”可能包含 Guard 尚不能认证的部分。checkpoint 会逐项说明原因和下一步。`generic_run_non_certifiable` 表示普通命令成功不能关闭该项，反复换绑定或再跑一条命令也无效。
+“更新插件并检查 GUI”可能包含 Guard 尚不能认证的部分；而“是否有更新”这类提问属于调查：Guard 会保留原文和来源，但如实说明无法机器认证——完成调查并如实回答即可。checkpoint 会逐项给出原因和一个具体的下一步；`context_guard_prepare`（只读）可以在执行有状态动作之前，展示受支持的命令形状、所需的 resolution/effect/state 证据顺序以及精确缺失的目标字段。
 
-用 `context_guard_rebind` 提出完整的原文拆分方案。动作或对象不明确时，先请根用户给出包含原条款的明确澄清要求，再在提案中引用新要求的 ID。工具会返回提案 ID 和原项/替代项对照；只有用户精确回复 `确认重绑定 <proposal ID>` 才会应用。引用文字、工具输出和模型自称确认都无效。未支持的部分继续保留 pending；按结构化边界安全结束也不表示全部完成。
+用 `context_guard_rebind` 提出完整的原文拆分方案。动作或对象不明确时，先请根用户给出包含原条款的明确澄清要求，再在提案中引用新要求的 ID。工具会返回提案 ID 和原项/替代项对照；用户把确认行 `确认重绑定 <proposal ID>` 作为回复的第一行即可应用，空行之后的解释请求或新任务保留各自含义，新任务照常采集。嵌在句子、引号或代码块里的确认，以及后面跟反转表述的确认，都无效。把要求拆成同样不可认证的片段会得到“无认证收益”，而不是要求一次无意义的确认。未支持的部分继续保留 pending；按结构化边界安全结束也不表示全部完成。
 
 用 `bindings: []` 调用 `context_guard_checkpoint` 可查询诊断。默认最多展示八个当前要求/限制和十条证据，插件 JSON 不超过 12 KiB。`pagination` 给出总数及各列表独立的 `next_cursor`，首页不代表完整合同。`item_ids`、`evidence_ids` 可按 ID 查询；`evidence_scope: "history"` 可查看完整证据历史，其中不可引用项会明确标记。翻页时保持查询条件不变，合同或证据快照变化后需重新查询。超长行提供 `detail_id`，用 `detail_offset` 取分片；后续分片需把首次返回的 `snapshot` 作为 `detail_snapshot` 传回。分页只改变展示，不会减少认证时检查的要求。
 

package/bin/dsh-completion-guard-host-lock.mjs

@@ -25,6 +25,22 @@ function summary(evaluation) {
     goal_available: evaluation.goalAvailable,
     platform: evaluation.platform,
     profile: evaluation.profileKind,
+    // How the cohort's rows were established. Without this in the READBACK, an
+    // operator (or a native-acceptance annex built from it) sees "supported"
+    // and a digest but cannot tell a natively audited graph from one that was
+    // only resolved from the registry. The value is already bound into the
+    // digest; this surfaces it so it cannot be read as a native pass.
+    audit_provenance: evaluation.auditProvenance,
+    // The version policy is a separate fact from the graph audit, so it is
+    // read back separately: an operator must be able to tell "this host is too
+    // old" from "this graph was never audited", and neither may be reported as
+    // the other.
+    host_version: evaluation.hostVersion ? {
+      version: evaluation.hostVersion.version,
+      minimum: evaluation.hostVersion.minimum,
+      status: evaluation.hostVersion.status,
+      reason_code: evaluation.hostVersion.reasonCode,
+    } : { status: 'unrecorded', reason_code: 'host_version_not_recorded' },
     capabilities: Object.fromEntries(Object.entries(evaluation.capabilities)
       .map(([id, result]) => [id, result.status])),
     package_count: evaluation.packages.filter((row) => row.version && row.integrity).length,

package/dist/domain/index.d.ts

@@ -1,2 +1,2 @@
-import { $ as packageRowsFromPnpmLock, $n as BoundaryDisposition, $r as normalizeClause, $t as GOAL_HOST_PACKAGES, A as createProofManifest, An as CheckpointResult, Ar as createProjection, At as parsePwshCommand, B as COMMAND_SURFACE_MANIFEST, Bn as extractMethod, Br as SUPPORTED_EVIDENCE_ADAPTERS, Bt as isDeterministicCheck, C as ProofKind, Cn as AuthorityBlock, Cr as PersistenceAuthorization, Ct as verifiedLinearCommitReadback, D as SessionQuery, Dn as segmentAuthorityBlocks, Dr as TargetValue, Dt as ShellParseStatus, E as ProofSurface, En as authorityCaptureCounts, Er as TargetTuple, Et as ParsedShell, F as EvidenceFacetCoverage, Fn as ClauseSegment, Fr as ActionSpec, Ft as ToolResultInput, G as ActiveProfileHostLock, Gn as BoundaryQualification, Gr as requestedTargetAuthorizesMutation, Gt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, H as ManifestIssue, Hn as isInformationalMessage, Hr as StatefulAction, Ht as CAPTURE_V042_NOTICE, I as bindingSatisfies, In as captureClause, Ir as CERTIFICATE_VERSION, It as ToolSubject, J as hostLockContextFromComposedDump, Jn as GoalBoundaryAccess, Jr as semanticActionFromText, Jt as BASE_HOST_PACKAGES, K as HostProfileError, Kn as BoundaryRequest, Kr as requestedTargetMatchesResolved, Kt as ALPHA2_HOST_PACKAGES, L as evidenceCoverage, Ln as captureItem, Lr as SEMANTIC_ACTIONS, Lt as evidenceFromPersistedToolResult, M as proofEvidenceConstraints, Mn as certifyCheckpoint, Mr as ACTION_MANIFEST, Mt as goalCompletionDenial, N as sessionQuery, Nn as CaptureScope, Nr as ACTION_MANIFEST_VERSION, Nt as hasCurrentCertificate, O as bindProofToProjection, On as UserInteractionKind, Or as VerificationContract, Ot as canonicalArgvFromCommand, P as validateProofManifest, Pn as ClassifiedClause, Pr as ActionManifest, Pt as ToolCallInput, Q as packageRowsFromActiveGraph, Qn as qualifyBoundary, Qr as digestStrings, Qt as ExecutableIdentityBinding, R as evidenceMatchesItem, Rn as classifyClause, Rr as STATEFUL_ACTIONS, Rt as extractTextContent, S as PROOF_PROTOCOL_VERSION, Sn as currentContractDigest, Sr as HostStatus, St as revalidateGitPrestate, T as ProofObligation, Tn as AuthorityKind, Tr as TargetCaptureStatus, Tt as CanonicalCommandSurface, U as OperationVerbEntry, Un as segmentClauses, Ur as actionCompatible, Ut as PROTOCOL_V3_NOTICE, V as CommandSurfaceManifest, Vn as extractOperation, Vr as SemanticAction, Vt as withDurability, W as validateManifest, Wn as BoundaryEffectuation, Wr as isStatefulAction, Wt as deriveProjection, X as injectActiveProfileHostLock, Xn as effectuateBoundary, Xr as validateActionTarget, Xt as EXPECTED_HOST_PACKAGES, Y as hostLockRowsFromComposedDump, Yn as availableBoundaryQualifications, Yr as validateActionManifest, Yt as DEFAULT_HOST_LOCK, Z as inspectTargetHostGraph, Zn as isCurrentAcceptedBoundary, Zr as canonicalizePath, Zt as ExecutableIdentity, _ as openItems, _n as evaluateExternalWaitCapability, _r as GuardItem, _t as commitTreeSnapshotDigest, a as classifyCompletionClaim, an as HostCohort, ar as DerivedEnvelope, at as GitAdapterAction, b as ALPHA3_HOST_PACKAGES, bn as evaluateToolSurfaceCapability, br as GuardOperation, bt as gitCommandMatchesTarget, c as isWholeTaskCompletionClaim, cn as HostLockContext, cr as EvidenceParseStatus, ct as GitCommandParseResult, d as snapshotSessionEvents, dn as HostPlatform, dr as ExternalOperation, dt as GitEffectRunner, ei as sanitizeClauseText, en as HOST_CAPABILITY_PACKAGE_GROUPS, er as BoundaryQualificationKind, et as readActiveHostGraph, f as RC1_HOST_PACKAGES, fn as HostProfileKind, fr as GoalRef, ft as GitPrestateCheck, g as closingHint, gn as bindLiveGoalCapability, gr as GuardIntegrity, gt as commitIndexSnapshotDigest, h as RecoveryOptions, hn as bindExecutableIdentity, hr as GuardEvidence, ht as LinearCommitReadback, i as TurnStoppingDecision, in as HostCapabilityRequest, ir as DeriveScope, it as GIT_COMMAND_MANIFEST_IDS, j as proofDigest, jn as RejectedBinding, jt as parseShellCommand, k as canonicalProjection, kn as classifyUserInteraction, kr as WaitAuthorization, kt as isRunExecutable, l as latestAssistantText, ln as HostLockEvaluation, lr as EvidenceRole, lt as GitCommandRejected, m as MIN_RECOVERY_CHAR_BUDGET, mn as LEGACY_HOST_COHORTS, mr as GuardCheckpoint, mt as GitTargetIdentity, n as AssistantOutcomeObservation, ni as sha256, nn as HostCapabilityEvaluation, nr as DeriveConfig, nt as resolveInstalledHostLock, o as decideTurnBoundary, on as HostCohortSelection, or as EvidenceBinding, ot as GitCommandAccepted, p as DEFAULT_RECOVERY_CHAR_BUDGET, pn as HostToolSurface, pr as GuardBoundary, pt as GitPrestateEnvelope, q as TargetHostGraph, qn as GoalActivationState, qr as semanticActionFromCommand, qt as AuditedExecutable, r as CompletionDisposition, rn as HostCapabilityId, rr as DeriveResult, rt as verifyComposedHostLockDump, s as decideTurnStopping, sn as HostCohortSelectionReason, sr as EvidenceOutcome, st as GitCommandManifest, t as supersedeItem, ti as sanitizeUrl, tn as HOST_COHORTS, tr as DeferAuthorization, tt as resolveActiveProfileHostLock, u as observeAssistantOutcome, un as HostLockStatus, ur as ExpectedTransition, ut as GitEffectExecution, v as recoveryDigest, vn as evaluateHostCapability, vr as GuardItemKind, vt as createGitPrestateEnvelope, w as ProofManifest, wn as AuthorityBlockKind, wr as TargetCaptureReasonCode, wt as CanonicalArgv, x as PROOF_KINDS, xn as selectHostCohort, xr as GuardProjection, xt as parseGitCommandManifest, y as renderRecoveryPacket, yn as evaluateHostLock, yr as GuardItemStatus, yt as executeRevalidatedGitEffect, z as isVerifyingCapability, zn as extractArtifactPaths, zr as STOP_PROTOCOL_VERSION, zt as extractToolSubject } from "../index-BZYtgqlu.js";
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LEGACY_HOST_COHORTS, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RC1_HOST_PACKAGES, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, readActiveHostGraph, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+import { $ as COMMAND_SURFACE_MANIFEST, $i as namedActions, $n as bindLiveGoalCapability, $r as BoundaryQualificationKind, $t as parsePwshCommand, A as openItems, An as BASE_HOST_PACKAGES, Ar as RejectedBinding, At as GitCommandManifest, B as SessionQuery, Bi as rebindResponse, Bn as HostCapabilityId, Br as isInformationalMessage, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as normalizeClause, Ci as TargetCaptureReasonCode, Cn as deriveProjection, Cr as classifyTaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Di as VerificationContract, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as isFrozenV042RebindResponse, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sha256, Ei as TargetValue, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as ParsedConfirmation, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as confirmRebind, Fn as GOAL_HOST_PACKAGES, Fr as captureItem, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as InterpretOptions, Gn as HostLockContext, Gr as GoalActivationState, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as AuthorityDisposition, Hn as HostCohort, Hr as BoundaryEffectuation, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as proposeRebind, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as classifyClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as interpretMessage, Jn as HostPlatform, Jr as effectuateBoundary, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as ScopeInterpretation, Kn as HostLockEvaluation, Kr as GoalBoundaryAccess, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as proposeRebindOutcome, Ln as HOST_COHORTS, Lr as extractArtifactPaths, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as ProposeOutcome, Mn as EXPECTED_HOST_PACKAGES, Mr as CaptureScope, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as RebindArgs, Nn as ExecutableIdentity, Nr as ClauseSegment, Nt as GitEffectExecution, O as RecoveryOptions, Oi as WaitAuthorization, On as ALPHA2_HOST_PACKAGES, Or as parseConfirmationMessage, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as RebindProposal, Pn as ExecutableIdentityBinding, Pr as captureClause, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as maskCodeSpans, Qn as bindExecutableIdentity, Qr as BoundaryDisposition, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebindV042, Rn as HostAuditProvenance, Rr as extractMethod, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as digestStrings, Si as PersistenceAuthorization, Sn as PROTOCOL_V4_NOTICE, Sr as UserInteractionKind, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as sanitizeUrl, Ti as TargetTuple, Tn as ACTIVE_HOST_COHORT_IDS, Tr as CONFIRM_LINE_PATTERN, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as DirectiveClass, Un as HostCohortSelection, Ur as BoundaryQualification, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as replayRebindResult, Vn as HostCapabilityRequest, Vr as segmentClauses, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as Executee, Wn as HostCohortSelectionReason, Wr as BoundaryRequest, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as isOpenObligation, Xn as HostToolSurface, Xr as qualifyBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as isExecutableItem, Yn as HostProfileKind, Yr as isCurrentAcceptedBoundary, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as kindOfScope, Zn as LEGACY_HOST_COHORTS, Zr as BindingActionClosure, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as semanticActionFromCommand, _i as GuardItemKind, _n as evidenceAvailabilityReason, _r as AuthorityBlockKind, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ActionSpec, ai as EvidenceBinding, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as validateActionTarget, bi as GuardProjection, bn as CAPTURE_V042_NOTICE, br as segmentAuthorityBlocks, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as STATEFUL_ACTIONS, ci as EvidenceRole, cn as extractToolSubject, cr as MIN_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as SemanticAction, di as GoalRef, dn as CertificationSupport, dr as compareHostVersions, dt as previewFirstStepInjection, ea as semanticActionOfScope, ei as DeferAuthorization, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as StatefulAction, fi as GuardBoundary, fn as DiagnosisNextAction, fr as evaluateMinimumHostVersion, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as requestedTargetMatchesResolved, gi as GuardItem, gn as deriveItemDiagnosis, gr as AuthorityBlock, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as requestedTargetAuthorizesMutation, hi as GuardIntegrity, hn as UnifiedItemDiagnosis, hr as currentContractDigest, ht as combineHostPolicy, i as CompletionDisposition, ia as ActionManifest, ii as DerivedEnvelope, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as BoundedSource, jn as DEFAULT_HOST_LOCK, jr as certifyCheckpoint, jt as GitCommandParseResult, k as closingHint, ki as createProjection, kn as AuditedExecutable, kr as CheckpointResult, kt as GitCommandAccepted, l as decideTurnBoundary, la as STOP_PROTOCOL_VERSION, li as ExpectedTransition, ln as isDeterministicCheck, lr as ParsedHostVersion, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as isStatefulAction, mi as GuardEvidence, mn as TaskKind, mr as satisfiesSupportedHostRange, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as ACTION_MANIFEST, ni as DeriveResult, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as CERTIFICATE_VERSION, oi as EvidenceOutcome, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as actionCompatible, pi as GuardCheckpoint, pn as Repairability, pr as parseHostVersion, pt as HostProfileError, q as validateProofManifest, qi as interpretClause, qn as HostLockStatus, qr as availableBoundaryQualifications, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as ACTION_MANIFEST_VERSION, ri as DeriveScope, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as SEMANTIC_ACTIONS, si as EvidenceParseStatus, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as statefulActionsOfScope, ti as DeriveConfig, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as SUPPORTED_EVIDENCE_ADAPTERS, ui as ExternalOperation, un as withDurability, ur as SUPPORTED_HOST_RANGE, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as semanticActionFromText, vi as GuardItemStatus, vn as itemDiagnosis, vr as AuthorityKind, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as sanitizeClauseText, wi as TargetCaptureStatus, wn as ACTIVE_HOST_COHORT_ID, wr as classifyUserInteraction, wt as resolveInstalledHostLock, x as V3SessionLike, xa as canonicalizePath, xi as HostStatus, xn as PROTOCOL_V3_NOTICE, xr as TaskIntent, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as validateActionManifest, yi as GuardOperation, yn as relevantEvidence, yr as authorityCaptureCounts, yt as inspectTargetHostGraph, z as ProofSurface, zi as rebindAttemptKey, zn as HostCapabilityEvaluation, zr as extractOperation, zt as commitIndexSnapshotDigest } from "../index-Dcee_NYF.js";
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/domain/index.js

@@ -1,3 +1,3 @@
-import { $ as ALPHA2_HOST_PACKAGES, $t as SEMANTIC_ACTIONS, A as verifiedLinearCommitReadback, B as supersedeItem, Bt as captureClause, C as commitIndexSnapshotDigest, Ct as certifyCheckpoint, D as gitCommandMatchesTarget, Dt as openItems, E as executeRevalidatedGitEffect, Et as closingHint, F as latestAssistantText, Ft as evidenceMatchesItem, G as withDurability, Gt as extractOperation, H as extractTextContent, Ht as classifyClause, I as observeAssistantOutcome, It as isVerifyingCapability, J as parsePwshCommand, K as canonicalArgvFromCommand, Kt as isInformationalMessage, L as CAPTURE_V042_NOTICE, Lt as currentContractDigest, M as decideTurnBoundary, N as decideTurnStopping, Nt as bindingSatisfies, O as parseGitCommandManifest, Ot as recoveryDigest, P as isWholeTaskCompletionClaim, Pt as evidenceCoverage, Q as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Qt as CERTIFICATE_VERSION, R as PROTOCOL_V3_NOTICE, Rt as createProjection, S as GIT_COMMAND_MANIFEST_IDS, St as qualifyBoundary, T as createGitPrestateEnvelope, Tt as MIN_RECOVERY_CHAR_BUDGET, U as extractToolSubject, Ut as extractArtifactPaths, V as evidenceFromPersistedToolResult, Vt as captureItem, W as isDeterministicCheck, Wt as extractMethod, X as goalCompletionDenial, Xt as ACTION_MANIFEST, Y as parseShellCommand, Z as hasCurrentCertificate, Zt as ACTION_MANIFEST_VERSION, _ as readActiveHostGraph, _n as sanitizeUrl, _t as segmentAuthorityBlocks, a as createProofManifest, an as requestedTargetAuthorizesMutation, at as HOST_COHORTS, b as verifyComposedHostLockDump, bt as effectuateBoundary, c as sessionQuery, cn as semanticActionFromText, ct as bindLiveGoalCapability, d as hostLockContextFromComposedDump, dn as COMMAND_SURFACE_MANIFEST, dt as evaluateHostLock, en as STATEFUL_ACTIONS, et as BASE_HOST_PACKAGES, f as hostLockRowsFromComposedDump, fn as validateManifest, ft as evaluateToolSurfaceCapability, g as packageRowsFromPnpmLock, gn as sanitizeClauseText, gt as authorityCaptureCounts, h as packageRowsFromActiveGraph, hn as normalizeClause, ht as ALPHA3_HOST_PACKAGES, i as canonicalProjection, in as isStatefulAction, it as HOST_CAPABILITY_PACKAGE_GROUPS, j as classifyCompletionClaim, k as revalidateGitPrestate, kt as renderRecoveryPacket, l as validateProofManifest, ln as validateActionManifest, lt as evaluateExternalWaitCapability, m as inspectTargetHostGraph, mn as digestStrings, mt as RC1_HOST_PACKAGES, n as PROOF_PROTOCOL_VERSION, nn as SUPPORTED_EVIDENCE_ADAPTERS, nt as EXPECTED_HOST_PACKAGES, o as proofDigest, on as requestedTargetMatchesResolved, ot as LEGACY_HOST_COHORTS, p as injectActiveProfileHostLock, pn as canonicalizePath, pt as selectHostCohort, q as isRunExecutable, qt as segmentClauses, r as bindProofToProjection, rn as actionCompatible, rt as GOAL_HOST_PACKAGES, s as proofEvidenceConstraints, sn as semanticActionFromCommand, st as bindExecutableIdentity, t as PROOF_KINDS, tn as STOP_PROTOCOL_VERSION, tt as DEFAULT_HOST_LOCK, u as HostProfileError, un as validateActionTarget, ut as evaluateHostCapability, v as resolveActiveProfileHostLock, vn as sha256, vt as classifyUserInteraction, w as commitTreeSnapshotDigest, wt as DEFAULT_RECOVERY_CHAR_BUDGET, x as snapshotSessionEvents, xt as isCurrentAcceptedBoundary, y as resolveInstalledHostLock, yt as availableBoundaryQualifications, z as deriveProjection } from "../domain-DebMrpyX.js";
+import { $ as parseShellCommand, $n as requestedTargetMatchesResolved, $t as latestRootInstruction, A as createGitPrestateEnvelope, An as isInformationalMessage, At as authorityCaptureCounts, B as CAPTURE_V042_NOTICE, Bn as statefulActionsOfScope, Bt as evidenceCoverage, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as relevantEvidence, Ct as evaluateMinimumHostVersion, D as GIT_COMMAND_TEMPLATES, Dn as extractArtifactPaths, Dt as RC015_HOST_PACKAGES, E as GIT_COMMAND_MANIFEST_IDS, En as classifyClause, Et as RC015_RC2_HOST_PACKAGES, F as verifiedLinearCommitReadback, Fn as isOpenObligation, Ft as closingHint, G as evidenceFromPersistedToolResult, Gn as CERTIFICATE_VERSION, Gt as NO_PROGRESS_TURNS_BEFORE_STOP, H as PROTOCOL_V4_NOTICE, Ht as isVerifyingCapability, I as FIRST_STEP_GUIDANCE, In as kindOfScope, It as openItems, J as isDeterministicCheck, Jn as STOP_PROTOCOL_VERSION, Jt as decideTurnStopping, K as extractTextContent, Kn as SEMANTIC_ACTIONS, Kt as classifyCompletionClaim, L as claimedBatchHasRealRootInput, Ln as maskCodeSpans, Lt as recoveryDigest, M as gitCommandMatchesTarget, Mn as interpretClause, Mt as certifyCheckpoint, N as parseGitCommandManifest, Nn as interpretMessage, Nt as DEFAULT_RECOVERY_CHAR_BUDGET, O as commitIndexSnapshotDigest, On as extractMethod, Ot as RC1_HOST_PACKAGES, P as revalidateGitPrestate, Pn as isExecutableItem, Pt as MIN_RECOVERY_CHAR_BUDGET, Q as parsePwshCommand, Qn as requestedTargetAuthorizesMutation, Qt as latestAssistantText, R as lifecyclePhase, Rn as namedActions, Rt as renderRecoveryPacket, S as SESSION_API_UNSUPPORTED, Sn as itemDiagnosis, St as compareHostVersions, T as snapshotSessionEvents, Tn as captureItem, Tt as satisfiesSupportedHostRange, U as deriveProjection, Un as ACTION_MANIFEST, Ut as CONTROL_RECORD_PREFIX, V as PROTOCOL_V3_NOTICE, Vt as evidenceMatchesItem, W as supersedeItem, Wn as ACTION_MANIFEST_VERSION, Wt as NO_PROGRESS_RECORD_PREFIX, X as canonicalArgvFromCommand, Xn as actionCompatible, Xt as isRootPauseRequest, Y as withDurability, Yn as SUPPORTED_EVIDENCE_ADAPTERS, Yt as decisionBoundaryKey, Z as isRunExecutable, Zn as isStatefulAction, Zt as isWholeTaskCompletionClaim, _ as packageRowsFromPnpmLock, _n as CONFIRM_LINE_PATTERN, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as effectuateBoundary, ar as validateManifest, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as deriveItemDiagnosis, bt as MIN_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as currentContractDigest, cr as canonicalizePath, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as proposeRebind, dr as sanitizeClauseText, dt as LEGACY_HOST_COHORTS, en as observeAssistantOutcome, er as semanticActionFromCommand, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as proposeRebindOutcome, fr as sanitizeUrl, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as replayRebindResult, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as rebindResponse, ht as evaluateHostCapability, i as canonicalProjection, in as availableBoundaryQualifications, ir as COMMAND_SURFACE_MANIFEST, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as segmentClauses, jt as segmentAuthorityBlocks, k as commitTreeSnapshotDigest, kn as extractOperation, kt as ALPHA3_HOST_PACKAGES, l as validateProofManifest, ln as createProjection, lr as digestStrings, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as rebindAttemptKey, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as goalCompletionDenial, nr as validateActionManifest, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as isCurrentAcceptedBoundary, or as classifyTaskIntent, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebindV042, pr as sha256, pt as bindLiveGoalCapability, q as extractToolSubject, qn as STATEFUL_ACTIONS, qt as decideTurnBoundary, r as bindProofToProjection, rn as hasCurrentCertificate, rr as validateActionTarget, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as qualifyBoundary, sr as classifyUserInteraction, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as progressFingerprint, tr as semanticActionFromText, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as confirmRebind, ur as normalizeClause, ut as HOST_COHORTS, v as readActiveHostGraph, vn as isFrozenV042RebindResponse, vt as hostVersionFromPackages, w as SessionApiError, wn as captureClause, wt as parseHostVersion, x as verifyComposedHostLockDump, xn as evidenceAvailabilityReason, xt as SUPPORTED_HOST_RANGE, y as resolveActiveProfileHostLock, yn as parseConfirmationMessage, yt as selectHostCohort, z as previewFirstStepInjection, zn as semanticActionOfScope, zt as bindingSatisfies } from "../domain-BqmJLHcu.js";
 
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, readActiveHostGraph, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SessionApiError, actionCompatible, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };