dsh-completion-guard 0.5.1 → 0.5.3

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as COMMAND_SURFACE_MANIFEST, $i as namedActions, $n as bindLiveGoalCapability, $r as BoundaryQualificationKind, $t as parsePwshCommand, A as openItems, Ai as PackageRow, An as BASE_HOST_PACKAGES, Ar as RejectedBinding, At as GitCommandManifest, B as SessionQuery, Bi as rebindResponse, Bn as HostCapabilityId, Br as isInformationalMessage, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as normalizeClause, Ci as TargetCaptureReasonCode, Cn as deriveProjection, Cr as classifyTaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Di as VerificationContract, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as isFrozenV042RebindResponse, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sha256, Ei as TargetValue, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as ParsedConfirmation, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as confirmRebind, Fn as GOAL_HOST_PACKAGES, Fr as captureItem, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as InterpretOptions, Gn as HostLockContext, Gr as GoalActivationState, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as AuthorityDisposition, Hn as HostCohort, Hr as BoundaryEffectuation, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as proposeRebind, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as classifyClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as interpretMessage, Jn as HostPlatform, Jr as effectuateBoundary, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as ScopeInterpretation, Kn as HostLockEvaluation, Kr as GoalBoundaryAccess, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as proposeRebindOutcome, Ln as HOST_COHORTS, Lr as extractArtifactPaths, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as ProposeOutcome, Mn as EXPECTED_HOST_PACKAGES, Mr as CaptureScope, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as RebindArgs, Nn as ExecutableIdentity, Nr as ClauseSegment, Nt as GitEffectExecution, O as RecoveryOptions, Oi as WaitAuthorization, On as ALPHA2_HOST_PACKAGES, Or as parseConfirmationMessage, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as RebindProposal, Pn as ExecutableIdentityBinding, Pr as captureClause, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as maskCodeSpans, Qn as bindExecutableIdentity, Qr as BoundaryDisposition, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebindV042, Rn as HostAuditProvenance, Rr as extractMethod, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as digestStrings, Si as PersistenceAuthorization, Sn as PROTOCOL_V4_NOTICE, Sr as UserInteractionKind, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as sanitizeUrl, Ti as TargetTuple, Tn as ACTIVE_HOST_COHORT_IDS, Tr as CONFIRM_LINE_PATTERN, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as DirectiveClass, Un as HostCohortSelection, Ur as BoundaryQualification, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as replayRebindResult, Vn as HostCapabilityRequest, Vr as segmentClauses, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as Executee, Wn as HostCohortSelectionReason, Wr as BoundaryRequest, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as isOpenObligation, Xn as HostToolSurface, Xr as qualifyBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as isExecutableItem, Yn as HostProfileKind, Yr as isCurrentAcceptedBoundary, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as kindOfScope, Zn as LEGACY_HOST_COHORTS, Zr as BindingActionClosure, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as semanticActionFromCommand, _i as GuardItemKind, _n as evidenceAvailabilityReason, _r as AuthorityBlockKind, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ActionSpec, ai as EvidenceBinding, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as validateActionTarget, bi as GuardProjection, bn as CAPTURE_V042_NOTICE, br as segmentAuthorityBlocks, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as STATEFUL_ACTIONS, ci as EvidenceRole, cn as extractToolSubject, cr as MIN_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as SemanticAction, di as GoalRef, dn as CertificationSupport, dr as compareHostVersions, dt as previewFirstStepInjection, ea as semanticActionOfScope, ei as DeferAuthorization, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as StatefulAction, fi as GuardBoundary, fn as DiagnosisNextAction, fr as evaluateMinimumHostVersion, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as requestedTargetMatchesResolved, gi as GuardItem, gn as deriveItemDiagnosis, gr as AuthorityBlock, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as requestedTargetAuthorizesMutation, hi as GuardIntegrity, hn as UnifiedItemDiagnosis, hr as currentContractDigest, ht as combineHostPolicy, i as CompletionDisposition, ia as ActionManifest, ii as DerivedEnvelope, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as BoundedSource, jn as DEFAULT_HOST_LOCK, jr as certifyCheckpoint, jt as GitCommandParseResult, k as closingHint, ki as createProjection, kn as AuditedExecutable, kr as CheckpointResult, kt as GitCommandAccepted, l as decideTurnBoundary, la as STOP_PROTOCOL_VERSION, li as ExpectedTransition, ln as isDeterministicCheck, lr as ParsedHostVersion, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as isStatefulAction, mi as GuardEvidence, mn as TaskKind, mr as satisfiesSupportedHostRange, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as ACTION_MANIFEST, ni as DeriveResult, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as CERTIFICATE_VERSION, oi as EvidenceOutcome, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as actionCompatible, pi as GuardCheckpoint, pn as Repairability, pr as parseHostVersion, pt as HostProfileError, q as validateProofManifest, qi as interpretClause, qn as HostLockStatus, qr as availableBoundaryQualifications, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as ACTION_MANIFEST_VERSION, ri as DeriveScope, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as SEMANTIC_ACTIONS, si as EvidenceParseStatus, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as statefulActionsOfScope, ti as DeriveConfig, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as SUPPORTED_EVIDENCE_ADAPTERS, ui as ExternalOperation, un as withDurability, ur as SUPPORTED_HOST_RANGE, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as semanticActionFromText, vi as GuardItemStatus, vn as itemDiagnosis, vr as AuthorityKind, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as sanitizeClauseText, wi as TargetCaptureStatus, wn as ACTIVE_HOST_COHORT_ID, wr as classifyUserInteraction, wt as resolveInstalledHostLock, x as V3SessionLike, xa as canonicalizePath, xi as HostStatus, xn as PROTOCOL_V3_NOTICE, xr as TaskIntent, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as validateActionManifest, yi as GuardOperation, yn as relevantEvidence, yr as authorityCaptureCounts, yt as inspectTargetHostGraph, z as ProofSurface, zi as rebindAttemptKey, zn as HostCapabilityEvaluation, zr as extractOperation, zt as commitIndexSnapshotDigest } from "./index-Dcee_NYF.js";
+import { $ as COMMAND_SURFACE_MANIFEST, $i as kindOfScope, $n as bindLiveGoalCapability, $r as BindingActionClosure, $t as parsePwshCommand, A as openItems, Ai as WaitAuthorization, An as BASE_HOST_PACKAGES, Ar as parseConfirmationMessage, At as GitCommandManifest, B as SessionQuery, Bi as proposeRebindV042, Bn as HostCapabilityId, Br as extractMethod, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as canonicalizePath, Ci as HostStatus, Cn as deriveProjection, Cr as TaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Da as sanitizeUrl, Di as TargetTuple, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as CONFIRM_LINE_PATTERN, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sanitizeClauseText, Ei as TargetCaptureStatus, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as classifyUserInteraction, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as RebindArgs, Fn as GOAL_HOST_PACKAGES, Fr as ClauseSegment, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as DirectiveClass, Gn as HostLockContext, Gr as BoundaryQualification, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as rebindResponse, Hn as HostCohort, Hr as isInformationalMessage, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as RebindProposal, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as captureClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as ScopeInterpretation, Jn as HostPlatform, Jr as GoalBoundaryAccess, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as Executee, Kn as HostLockEvaluation, Kr as BoundaryRequest, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as confirmRebind, Ln as HOST_COHORTS, Lr as captureItem, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as PackageRow, Mn as EXPECTED_HOST_PACKAGES, Mr as RejectedBinding, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as BoundedSource, Nn as ExecutableIdentity, Nr as certifyCheckpoint, Nt as GitEffectExecution, O as RecoveryOptions, Oa as sha256, Oi as TargetValue, On as ALPHA2_HOST_PACKAGES, Or as ParsedConfirmation, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as ProposeOutcome, Pn as ExecutableIdentityBinding, Pr as CaptureScope, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as isOpenObligation, Qn as bindExecutableIdentity, Qr as qualifyBoundary, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebind, Rn as HostAuditProvenance, Rr as classifyClause, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as validateActionTarget, Si as GuardProjection, Sn as PROTOCOL_V4_NOTICE, Sr as segmentAuthorityBlocks, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as normalizeClause, Ti as TargetCaptureReasonCode, Tn as ACTIVE_HOST_COHORT_IDS, Tr as classifyTaskIntent, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as replayRebindResult, Un as HostCohortSelection, Ur as segmentClauses, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as rebindAttemptKey, Vn as HostCapabilityRequest, Vr as extractOperation, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as AuthorityDisposition, Wn as HostCohortSelectionReason, Wr as BoundaryEffectuation, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as interpretMessage, Xn as HostToolSurface, Xr as effectuateBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as interpretClause, Yn as HostProfileKind, Yr as availableBoundaryQualifications, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as isExecutableItem, Zn as LEGACY_HOST_COHORTS, Zr as isCurrentAcceptedBoundary, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as requestedTargetAuthorizesMutation, _i as GuardIntegrity, _n as evidenceAvailabilityReason, _r as currentContractDigest, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ACTION_MANIFEST_VERSION, ai as DeriveScope, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as semanticActionFromText, bi as GuardItemStatus, bn as CAPTURE_V042_NOTICE, br as AuthorityKind, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as CERTIFICATE_VERSION, ci as EvidenceOutcome, cn as extractToolSubject, cr as LATEST_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as STOP_PROTOCOL_VERSION, di as ExpectedTransition, dn as CertificationSupport, dr as SUPPORTED_HOST_RANGE, dt as previewFirstStepInjection, ea as maskCodeSpans, ei as BoundaryDisposition, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as SUPPORTED_EVIDENCE_ADAPTERS, fi as ExternalOperation, fn as DiagnosisNextAction, fr as SUPPORTED_HOST_VERSIONS, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as isStatefulAction, gi as GuardEvidence, gn as deriveItemDiagnosis, gr as satisfiesSupportedHostRange, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as actionCompatible, hi as GuardCheckpoint, hn as UnifiedItemDiagnosis, hr as parseHostVersion, ht as combineHostPolicy, i as CompletionDisposition, ia as ACTION_MANIFEST, ii as DeriveResult, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as createProjection, jn as DEFAULT_HOST_LOCK, jr as CheckpointResult, jt as GitCommandParseResult, k as closingHint, ki as VerificationContract, kn as AuditedExecutable, kr as isFrozenV042RebindResponse, kt as GitCommandAccepted, l as decideTurnBoundary, la as SEMANTIC_ACTIONS, li as EvidenceParseStatus, ln as isDeterministicCheck, lr as MIN_SUPPORTED_HOST_VERSION, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as StatefulAction, mi as GuardBoundary, mn as TaskKind, mr as evaluateMinimumHostVersion, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as semanticActionOfScope, ni as DeferAuthorization, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as ActionManifest, oi as DerivedEnvelope, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as SemanticAction, pi as GoalRef, pn as Repairability, pr as compareHostVersions, pt as HostProfileError, q as validateProofManifest, qi as InterpretOptions, qn as HostLockStatus, qr as GoalActivationState, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as statefulActionsOfScope, ri as DeriveConfig, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as ActionSpec, si as EvidenceBinding, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as namedActions, ti as BoundaryQualificationKind, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as STATEFUL_ACTIONS, ui as EvidenceRole, un as withDurability, ur as ParsedHostVersion, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as requestedTargetMatchesResolved, vi as GuardItem, vn as itemDiagnosis, vr as AuthorityBlock, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as digestStrings, wi as PersistenceAuthorization, wn as ACTIVE_HOST_COHORT_ID, wr as UserInteractionKind, wt as resolveInstalledHostLock, x as V3SessionLike, xa as validateActionManifest, xi as GuardOperation, xn as PROTOCOL_V3_NOTICE, xr as authorityCaptureCounts, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as semanticActionFromCommand, yi as GuardItemKind, yn as relevantEvidence, yr as AuthorityBlockKind, yt as inspectTargetHostGraph, z as ProofSurface, zi as proposeRebindOutcome, zn as HostCapabilityEvaluation, zr as extractArtifactPaths, zt as commitIndexSnapshotDigest } from "./index-BTaiOcE-.js";
 import "@deepseek-ai/dsh-tools";
 import "@deepseek-ai/dsh-session";
 import { Context } from "@deepseek-ai/cordis";
@@ -28,4 +28,4 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockProfileRoot?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as parseShellCommand, $n as requestedTargetMatchesResolved, $t as latestRootInstruction, A as createGitPrestateEnvelope, An as isInformationalMessage, At as authorityCaptureCounts, B as CAPTURE_V042_NOTICE, Bn as statefulActionsOfScope, Bt as evidenceCoverage, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as relevantEvidence, Ct as evaluateMinimumHostVersion, D as GIT_COMMAND_TEMPLATES, Dn as extractArtifactPaths, Dt as RC015_HOST_PACKAGES, E as GIT_COMMAND_MANIFEST_IDS, En as classifyClause, Et as RC015_RC2_HOST_PACKAGES, F as verifiedLinearCommitReadback, Fn as isOpenObligation, Ft as closingHint, G as evidenceFromPersistedToolResult, Gn as CERTIFICATE_VERSION, Gt as NO_PROGRESS_TURNS_BEFORE_STOP, H as PROTOCOL_V4_NOTICE, Hn as npmEscapedPackageName, Ht as isVerifyingCapability, I as FIRST_STEP_GUIDANCE, In as kindOfScope, It as openItems, J as isDeterministicCheck, Jn as STOP_PROTOCOL_VERSION, Jt as decideTurnStopping, K as extractTextContent, Kn as SEMANTIC_ACTIONS, Kt as classifyCompletionClaim, L as claimedBatchHasRealRootInput, Ln as maskCodeSpans, Lt as recoveryDigest, M as gitCommandMatchesTarget, Mn as interpretClause, Mt as certifyCheckpoint, N as parseGitCommandManifest, Nn as interpretMessage, Nt as DEFAULT_RECOVERY_CHAR_BUDGET, O as commitIndexSnapshotDigest, On as extractMethod, Ot as RC1_HOST_PACKAGES, P as revalidateGitPrestate, Pn as isExecutableItem, Pt as MIN_RECOVERY_CHAR_BUDGET, Q as parsePwshCommand, Qn as requestedTargetAuthorizesMutation, Qt as latestAssistantText, R as lifecyclePhase, Rn as namedActions, Rt as renderRecoveryPacket, S as SESSION_API_UNSUPPORTED, Sn as itemDiagnosis, St as compareHostVersions, T as snapshotSessionEvents, Tn as captureItem, Tt as satisfiesSupportedHostRange, U as deriveProjection, Un as ACTION_MANIFEST, Ut as CONTROL_RECORD_PREFIX, V as PROTOCOL_V3_NOTICE, Vn as canonicalRegistryBase, Vt as evidenceMatchesItem, W as supersedeItem, Wn as ACTION_MANIFEST_VERSION, Wt as NO_PROGRESS_RECORD_PREFIX, X as canonicalArgvFromCommand, Xn as actionCompatible, Xt as isRootPauseRequest, Y as withDurability, Yn as SUPPORTED_EVIDENCE_ADAPTERS, Yt as decisionBoundaryKey, Z as isRunExecutable, Zn as isStatefulAction, Zt as isWholeTaskCompletionClaim, _ as packageRowsFromPnpmLock, _n as CONFIRM_LINE_PATTERN, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as effectuateBoundary, ar as validateManifest, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as deriveItemDiagnosis, bt as MIN_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as currentContractDigest, cr as canonicalizePath, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as proposeRebind, dr as sanitizeClauseText, dt as LEGACY_HOST_COHORTS, en as observeAssistantOutcome, er as semanticActionFromCommand, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as proposeRebindOutcome, fr as sanitizeUrl, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as replayRebindResult, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as rebindResponse, ht as evaluateHostCapability, i as canonicalProjection, in as availableBoundaryQualifications, ir as COMMAND_SURFACE_MANIFEST, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as segmentClauses, jt as segmentAuthorityBlocks, k as commitTreeSnapshotDigest, kn as extractOperation, kt as ALPHA3_HOST_PACKAGES, l as validateProofManifest, ln as createProjection, lr as digestStrings, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as rebindAttemptKey, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as goalCompletionDenial, nr as validateActionManifest, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as isCurrentAcceptedBoundary, or as classifyTaskIntent, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebindV042, pr as sha256, pt as bindLiveGoalCapability, q as extractToolSubject, qn as STATEFUL_ACTIONS, qt as decideTurnBoundary, r as bindProofToProjection, rn as hasCurrentCertificate, rr as validateActionTarget, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as qualifyBoundary, sr as classifyUserInteraction, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as progressFingerprint, tr as semanticActionFromText, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as confirmRebind, ur as normalizeClause, ut as HOST_COHORTS, v as readActiveHostGraph, vn as isFrozenV042RebindResponse, vt as hostVersionFromPackages, w as SessionApiError, wn as captureClause, wt as parseHostVersion, x as verifyComposedHostLockDump, xn as evidenceAvailabilityReason, xt as SUPPORTED_HOST_RANGE, y as resolveActiveProfileHostLock, yn as parseConfirmationMessage, yt as selectHostCohort, z as previewFirstStepInjection, zn as semanticActionOfScope, zt as bindingSatisfies } from "./domain-BqmJLHcu.js";
+import { $ as parseShellCommand, $n as isStatefulAction, $t as isWholeTaskCompletionClaim, A as createGitPrestateEnvelope, An as extractMethod, At as RC1_HOST_PACKAGES, B as CAPTURE_V042_NOTICE, Bn as namedActions, Bt as renderRecoveryPacket, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as evidenceAvailabilityReason, Ct as SUPPORTED_HOST_VERSIONS, D as GIT_COMMAND_TEMPLATES, Dn as captureItem, Dt as satisfiesSupportedHostRange, E as GIT_COMMAND_MANIFEST_IDS, En as captureClause, Et as parseHostVersion, F as verifiedLinearCommitReadback, Fn as interpretMessage, Ft as DEFAULT_RECOVERY_CHAR_BUDGET, G as evidenceFromPersistedToolResult, Gn as ACTION_MANIFEST, Gt as CONTROL_RECORD_PREFIX, H as PROTOCOL_V4_NOTICE, Hn as statefulActionsOfScope, Ht as evidenceCoverage, I as FIRST_STEP_GUIDANCE, In as isExecutableItem, It as MIN_RECOVERY_CHAR_BUDGET, J as isDeterministicCheck, Jn as SEMANTIC_ACTIONS, Jt as classifyCompletionClaim, K as extractTextContent, Kn as ACTION_MANIFEST_VERSION, Kt as NO_PROGRESS_RECORD_PREFIX, L as claimedBatchHasRealRootInput, Ln as isOpenObligation, Lt as closingHint, M as gitCommandMatchesTarget, Mn as isInformationalMessage, Mt as authorityCaptureCounts, N as parseGitCommandManifest, Nn as segmentClauses, Nt as segmentAuthorityBlocks, O as commitIndexSnapshotDigest, On as classifyClause, Ot as RC015_RC2_HOST_PACKAGES, P as revalidateGitPrestate, Pn as interpretClause, Pt as certifyCheckpoint, Q as parsePwshCommand, Qn as actionCompatible, Qt as isRootPauseRequest, R as lifecyclePhase, Rn as kindOfScope, Rt as openItems, S as SESSION_API_UNSUPPORTED, Sn as deriveItemDiagnosis, St as SUPPORTED_HOST_RANGE, T as snapshotSessionEvents, Tn as relevantEvidence, Tt as evaluateMinimumHostVersion, U as deriveProjection, Un as canonicalRegistryBase, Ut as evidenceMatchesItem, V as PROTOCOL_V3_NOTICE, Vn as semanticActionOfScope, Vt as bindingSatisfies, W as supersedeItem, Wn as npmEscapedPackageName, Wt as isVerifyingCapability, X as canonicalArgvFromCommand, Xn as STOP_PROTOCOL_VERSION, Xt as decideTurnStopping, Y as withDurability, Yn as STATEFUL_ACTIONS, Yt as decideTurnBoundary, Z as isRunExecutable, Zn as SUPPORTED_EVIDENCE_ADAPTERS, Zt as decisionBoundaryKey, _ as packageRowsFromPnpmLock, _n as rebindResponse, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as hasCurrentCertificate, ar as validateActionTarget, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as isFrozenV042RebindResponse, bt as LATEST_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as isCurrentAcceptedBoundary, cr as classifyTaskIntent, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as createProjection, dr as digestStrings, dt as LEGACY_HOST_COHORTS, en as latestAssistantText, er as requestedTargetAuthorizesMutation, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as confirmRebind, fr as normalizeClause, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as rebindAttemptKey, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as proposeRebindV042, hr as sha256, ht as evaluateHostCapability, i as canonicalProjection, in as goalCompletionDenial, ir as validateActionManifest, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as extractOperation, jt as ALPHA3_HOST_PACKAGES, k as commitTreeSnapshotDigest, kn as extractArtifactPaths, kt as RC015_HOST_PACKAGES, l as validateProofManifest, ln as qualifyBoundary, lr as classifyUserInteraction, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as proposeRebindOutcome, mr as sanitizeUrl, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as observeAssistantOutcome, nr as semanticActionFromCommand, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as availableBoundaryQualifications, or as COMMAND_SURFACE_MANIFEST, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebind, pr as sanitizeClauseText, pt as bindLiveGoalCapability, q as extractToolSubject, qn as CERTIFICATE_VERSION, qt as NO_PROGRESS_TURNS_BEFORE_STOP, r as bindProofToProjection, rn as progressFingerprint, rr as semanticActionFromText, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as effectuateBoundary, sr as validateManifest, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as latestRootInstruction, tr as requestedTargetMatchesResolved, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as currentContractDigest, ur as canonicalizePath, ut as HOST_COHORTS, v as readActiveHostGraph, vn as replayRebindResult, vt as hostVersionFromPackages, w as SessionApiError, wn as itemDiagnosis, wt as compareHostVersions, x as verifyComposedHostLockDump, xn as parseConfirmationMessage, xt as MIN_SUPPORTED_HOST_VERSION, y as resolveActiveProfileHostLock, yn as CONFIRM_LINE_PATTERN, yt as selectHostCohort, z as previewFirstStepInjection, zn as maskCodeSpans, zt as recoveryDigest } from "./domain-RuX9l07o.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -848,6 +848,35 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 	});
 }
 
+//#endregion
+//#region src/tools/git-preparation.ts
+/** Input recipes are guidance only; live resolution remains authoritative. */
+function gitPreparation(action) {
+	if (![
+		"commit",
+		"push",
+		"fetch",
+		"pull"
+	].includes(action)) return void 0;
+	return {
+		selector_fields: action === "commit" ? ["repository", "branch"] : [
+			"repository",
+			"remote",
+			"refspec"
+		],
+		command_manifest_fields: ["planned_tool", "planned_arguments"],
+		planned_tools: ["bash", "pwsh"],
+		planned_argument_fields: ["command", "workdir"],
+		steps: [
+			"Before execution: context_guard_evidence with evidence_role=resolution, selector and command_manifest. Keep the successful tool call ID and target_digest.",
+			"Execute once with context_guard_action, semantic_action, resolution_call_id, target_digest, contract_item_id and contract_item_revision.",
+			"Collect effect and state separately with context_guard_evidence, using the same resolution_call_id and the successful action call ID as effect_call_id.",
+			"Checkpoint the matching resolution/effect/state evidence IDs. Call IDs identify tool events; evidence IDs identify checkpoint facts.",
+			"If the action already ran without resolution, report the historical evidence gap and read back state. Do not repeat a mutation to create missing prestate evidence."
+		]
+	};
+}
+
 //#endregion
 //#region src/tools/prepare.ts
 /**
@@ -920,7 +949,8 @@ function createPrepareTool(options) {
 				"effect (the exact planned change)",
 				"state (independent post-state readback)"
 			] : ["state (matching durable evidence for the requested verification)"];
-			const missingTargetFields = manifestEntry?.stateful && plannedAction ? manifestEntry.resolvedTargetKeys.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
+			const recipe = plannedAction ? gitPreparation(plannedAction) : void 0;
+			const missingTargetFields = manifestEntry?.stateful && plannedAction ? (recipe?.selector_fields ?? manifestEntry.resolvedTargetKeys).filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
 			const capability = plannedAction && options.hostCapability ? options.hostCapability(plannedAction) : void 0;
 			const commandShape = options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) : void 0;
 			return {
@@ -937,8 +967,9 @@ function createPrepareTool(options) {
 				missing_target_fields: missingTargetFields,
 				...capability ? { host_capability: {
 					status: capability.status,
-					reason_code: capability.reasonCode
+					...capability.reasonCode !== void 0 ? { reason_code: capability.reasonCode } : {}
 				} } : {},
+				...recipe ? { evidence_input_contract: recipe } : {},
 				note: "Preparation performs no action. A default or guessed target is not user authority; explicit root instruction is required for missing target fields."
 			};
 		}
@@ -1037,12 +1068,14 @@ function adapterId(action) {
 	if (action === "publish") return "context-guard.registry.v1";
 	return "context-guard.git.v1";
 }
-function unavailable(action, role, reason) {
+function unavailable(action, role, reason, missingFields, nextStep) {
 	return {
 		status: "unavailable",
 		reason_code: reason,
 		semantic_action: action,
 		evidence_role: role,
+		...missingFields?.length ? { missing_fields: missingFields } : {},
+		...nextStep ? { next_step: nextStep } : {},
 		resolved_target: {},
 		observed_state: {},
 		adapter_id: adapterId(action),
@@ -2292,6 +2325,11 @@ function createEvidenceTool(options = {}) {
 						type: "string",
 						required: true
 					},
+					missing_fields: {
+						type: "array",
+						items: { type: "string" }
+					},
+					next_step: { type: "string" },
 					evidence_role: {
 						type: "string",
 						required: true,
@@ -2414,6 +2452,18 @@ function createEvidenceTool(options = {}) {
 			if (!agent) return unavailable(action, role, "producer_agent_unavailable");
 			try {
 				if (role === "resolution") {
+					const recipe = gitPreparation(action);
+					if (recipe) {
+						const manifest = record(args.command_manifest);
+						const plannedArgs = record(manifest?.planned_arguments);
+						const selector = record(args.selector);
+						const missing = [
+							...recipe.selector_fields.filter((key) => !requireString(selector ?? {}, key)).map((key) => `selector.${key}`),
+							...!requireString(manifest ?? {}, "planned_tool") ? ["command_manifest.planned_tool"] : [],
+							...recipe.planned_argument_fields.filter((key) => !requireString(plannedArgs ?? {}, key)).map((key) => `command_manifest.planned_arguments.${key}`)
+						];
+						if (missing.length) return unavailable(action, role, "resolution_input_missing", missing, "Supply the listed resolution inputs before execution. Use context_guard_prepare for the exact Git input contract. A manifest_id alone does not describe a planned tool call.");
+					}
 					const executable$1 = executableFor(action);
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
 					if (executable$1 && !executableBinding) return unavailable(action, role, "executable_identity_unavailable");
@@ -2425,7 +2475,7 @@ function createEvidenceTool(options = {}) {
 					if (!expectedTransition) return unavailable(action, role, "expected_transition_unavailable");
 					return supported(action, role, resolved.target, {}, commandManifest, gitBinding, executableBinding, expectedTransition);
 				}
-				if (!args.resolution_call_id) return unavailable(action, role, "producer_reference_missing");
+				if (!args.resolution_call_id) return unavailable(action, role, "producer_reference_missing", ["resolution_call_id", ...!args.effect_call_id ? ["effect_call_id"] : []], "Use the successful pre-action resolution call ID and matching action call ID. Selectors and evidence IDs cannot replace call IDs. If execution already happened without resolution, report the historical gap; do not repeat the mutation.");
 				const resolution = findResolution(snapshotSessionEvents(agent.session), args.resolution_call_id, action);
 				if (!resolution) return unavailable(action, role, "persisted_effect_mismatch");
 				const executable = executableFor(action);
@@ -2444,7 +2494,7 @@ function createEvidenceTool(options = {}) {
 					"pull",
 					"fetch"
 				].includes(action);
-				if (!args.effect_call_id) return unavailable(action, role, "producer_reference_missing");
+				if (!args.effect_call_id) return unavailable(action, role, "producer_reference_missing", ["effect_call_id"], "Supply the successful matching effect call ID. Git/package/service effects must come from context_guard_action; do not repeat an already completed mutation to manufacture missing evidence.");
 				if (ownedEffect) {
 					const events = snapshotSessionEvents(agent.session);
 					const actionCall = actionCallMatches(events, args.effect_call_id, action, args.resolution_call_id, resolution.target);
@@ -4222,4 +4272,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/COMPATIBILITY.md

@@ -2,27 +2,25 @@
 
 Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
-## 0.5.1 support policy
+## 0.5.2 support policy
 
-Version 0.5.1 supports **DSH >= 0.1.5-rc.1** and nothing older. There is no
+Version 0.5.2 supports exactly **DSH `0.1.5-rc.2` or `0.1.5-rc.1`**.
+These are the latest registered release and the verified minimum. There is no
 backward compatibility: the previous Session V2 API, the V2 event vocabulary,
-and every older host cohort were removed rather than kept behind a fallback.
-`0.1.5-rc.1` is the version this release was implemented and tested against; it
-is the baseline, not a ceiling.
+and every older host cohort remain removed.
 
 Two separate judgments decide whether a host is usable, and neither replaces the
 other:
 
-1. **Version policy** — `src/domain/host-version.ts` orders host versions with
-   the SemVer prerelease rules. `peerDependencies` publish the range
-   `>=0.1.5-rc.1`; because a range cannot express "every future prerelease at
-   any base", the range is the conservative install-time statement and the
-   module is the explicit decision path. `0.1.4` and `0.1.5-alpha.9` are
-   refused. `0.1.6-rc.1` and `0.2.0-rc.1` order above the bound but do not
-   resolve from the published range and are not registered cohorts.
-2. **Host identity** — the exact 33-row DSH core graph must match one registered
-   cohort row for row. A newer host that has not been registered is reported as
-   unverified, never as supported: the version range alone never admits a graph.
+1. **Exact published set** — top-level `engines.dsh`, nested
+   `dsh.engines.dsh`, and every DSH peer dependency publish the newest-first
+   union `0.1.5-rc.2 || 0.1.5-rc.1`. Older versions, unregistered stable
+   `0.1.5`, and future releases are not advertised as supported. The minimum
+   comparison remains a diagnostic that distinguishes old hosts from newer but
+   unregistered hosts.
+2. **Host identity** — membership in the published set is not enough. The exact
+   33-row DSH core graph must match one registered cohort row for row. Missing,
+   mixed, or unknown graphs are reported as unsupported.
 
 If you are upgrading from a profile that ran DSH 0.1.2-rc.1, start a **new
 session**. Guard does not migrate V2 logs, proposals, or certificates, and old
@@ -71,7 +69,7 @@ DSH rc.1 replaces the public `Session.events` getter with `snapshotEvents()` and
 
 ## Upstream adaptation policy
 
-Version 0.5.1 targets DSH >= `0.1.5-rc.1` with `0.1.5-rc.1` as the implemented and tested baseline; alpha releases are observed for trend only and are never adaptation or validation targets. A newer upstream tag does not establish support by itself: support starts when that exact RC or release is added as its own registered cohort with source, CI, and native acceptance. The upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) tracks later releases. The host-side API differences that this adaptation had to absorb are listed in the repository's upstream API audit (`UPSTREAM_API_AUDIT.md` at the repository root), which is a maintainer document and is not part of the published package.
+Version 0.5.2 advertises only DSH `0.1.5-rc.2` and `0.1.5-rc.1`, with rc.1 retained as the implemented and tested baseline; alpha releases are observed for trend only and are never adaptation or validation targets. A newer upstream tag does not establish support by itself: support starts when that exact RC or release is added as its own registered cohort with source, CI, and native acceptance. The upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) tracks later releases. The host-side API differences that this adaptation had to absorb are listed in the repository's upstream API audit (`UPSTREAM_API_AUDIT.md` at the repository root), which is a maintainer document and is not part of the published package.
 
 ## Platform and release evidence
 
@@ -84,14 +82,15 @@ Version 0.5.1 targets DSH >= `0.1.5-rc.1` with `0.1.5-rc.1` as the implemented a
 ## Historical compatibility cohorts
 
 These are verification records, not support entries. An installed runtime built
-from any of them fails closed under the 0.5.1 policy.
+from any of them fails closed under the 0.5.2 policy.
 
 - DSH `0.1.1-rc.2` + dshmarket `1.36.0` + Cordis `4.0.1` is a retained, published-line cohort.
 - DSH `0.1.2-alpha.2` + dshmarket `1.38.1` + Cordis `4.0.2` is the published 0.3.2 cohort checked natively on macOS and Windows.
 - DSH `0.1.2-alpha.2` + dshmarket `1.39.0` + Cordis `4.0.2` remains a deterministic compatibility cohort. It is no longer a native 0.4.0 release blocker.
 - DSH `0.1.2-alpha.3` + dshmarket `1.39.0` + Cordis `4.0.2` is the recorded 0.4.0 release baseline.
 - DSH `0.1.2-rc.1` + dshmarket `1.41.0` + Cordis `4.0.2` is the 0.4.1-rc.1 / 0.5.0 cohort, checked natively on macOS and Windows.
-- DSH `0.1.5-rc.1` + Cordis `4.0.2` is the **active** 0.5.1 cohort, with no dshmarket row.
+- DSH `0.1.5-rc.1` + Cordis `4.0.2` is the verified minimum 0.5.2 cohort, with no dshmarket row.
+- DSH `0.1.5-rc.2` + Cordis `4.0.2` is the latest 0.5.2 cohort, with no dshmarket row.
 
 ## Rejection rules
 
@@ -147,20 +146,16 @@ The ordinary runtime packages are host-provided peers:
 
 Goal support uses two exact optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
 
-Version 0.5.1 publishes one range per DSH package: `>=0.1.5-rc.1`, with Cordis `^4.0.2` (Cordis is versioned independently and unchanged at `4.0.2`). The range is the floor of the support policy, never a claim that any graph above it works: runtime acceptance still requires an exact injected host lock and atomic selection of one complete registered cohort.
+Version 0.5.2 publishes `0.1.5-rc.2 || 0.1.5-rc.1` in top-level
+`engines.dsh`, nested `dsh.engines.dsh`, and every DSH peer dependency. Cordis
+is versioned independently and remains `^4.0.2`. Plugin markets and package
+managers therefore see the same two exact host releases as the host-lock
+registry; neither an unregistered stable release nor a future version is
+implicitly admitted.
 
-Two npm facts are worth stating plainly, because a bare `>=` reads stronger than it is:
-
-- A version carrying a prerelease resolves from `>=0.1.5-rc.1` only when its
-  `major.minor.patch` tuple is `0.1.5`. So `0.1.5-rc.2` and `0.1.5` resolve,
-  while `0.1.6-rc.1` and `0.2.0-rc.1` do not. Later `x.y.z` releases resolve
-  normally.
-- The development dependencies pin the exact `0.1.5-rc.1` packages this release
-  actually verified, so the tested baseline is recorded even though the peer
-  range is wider.
-
-Historical peer declarations belong to their own release sections above and are
-not part of the 0.5.1 contract.
+The development dependencies retain exact `0.1.5-rc.1` pins as the build
+baseline. Historical peer declarations belong to their own release sections
+above and are not part of the 0.5.2 contract.
 
 ## Terminal outcome contract
 

package/docs/HOST_LOCK_UPGRADE.md

@@ -50,9 +50,7 @@ unsupported graph, and only a thrown error produces `status: "unavailable"` with
 you whether the graph was accepted.
 
 For Headless, use its profile path and `--profile headless`. On Windows, use the
-installed `.cmd` launcher and Windows absolute paths. **Windows is accepted for
-evaluation but has not been natively audited for this cohort**, so treat a
-Windows result as unverified until the native gate runs. A strict repeat leaves
+installed `.cmd` launcher and Windows absolute paths. The published 0.5.1 artifact passed separate native macOS and Windows acceptance on DSH `0.1.5-rc.2`; see the [acceptance record](LOCAL_ACCEPTANCE.md). That result does not cover other artifacts or host versions. A strict repeat leaves
 the package and profile contents unchanged. Restarting or enabling a daily
 profile remains a separate user action.
 
@@ -71,18 +69,9 @@ source roots, platform/profile kind and the complete 33-row core graph. The
 core manifest is version 2. Runtime replay re-reads those graph sources and
 requires the same exact core before using certificate authority.
 
-Version 0.5.1's active cohort is the DSH `0.1.5-rc.1` core graph, and its rows
-are the exact published npm tarball identities rather than a graph read off a
-running host. The cohort therefore records
-`auditProvenance: registry-derived-pending-native-audit` with an empty
-`auditedPlatforms` list, and that provenance is part of the digest. A lock
-generated from it can certify the bytes, but no certificate may describe it as
-a native pass. Reading the native gate as "not run" is the accurate reading.
-Every successful `inspect`, `inspect-graph`, `inject` and `verify-dump` readback
-prints the same value as `audit_provenance`, next to the cohort id and the
-digest, so you can tell which of the two you are holding without decoding the
-digest. (A failing command prints only a status and a reason code: no cohort was
-resolved, so there is no provenance to report.)
+Version 0.5.1 registers separate DSH `0.1.5-rc.1` and `0.1.5-rc.2` core graphs. Their package identities come from exact published npm tarballs. The immutable package records `auditProvenance: registry-derived-pending-native-audit` and an empty `auditedPlatforms` list; this provenance is part of the lock digest.
+
+The later macOS and Windows native runs on rc.2 are recorded in the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). They establish native acceptance for that artifact and host version without modifying its registry or digest. A lock readback by itself proves the registered graph match, not a native run. Successful inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest; a failed check reports only its status and reason.
 
 **Which failure code you see depends on the lock generation you are holding**, and
 that matters for deciding whether you are migrating or just drifting:

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,9 +2,29 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
-## 0.5.1 candidate scope
+## 0.5.2 published release (2026-09-11)
 
-The candidate supports exact DSH `0.1.5-rc.1` and `0.1.5-rc.2` core graphs. Development tests retain the rc.1 baseline; rc.2 graph tests additionally reject missing, mixed, forged and unregistered package identities. Dependency-free Headless preflight selects the matching registered cohort and checks its launcher version.
+[Version 0.5.2](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.2) is published on GitHub and [npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.2). The annotated tag and npm `gitHead` identify commit `e8b21b3d0bb5b3864c856cc9ea6bd19d5ab066ef`. The frozen 303412-byte, 27-file tgz has SHA-256 `d975f17dc3bfed999cbe6c0e638b226c3dcf8651f288ea7ab83faa5ba7903d31`.
+
+The local deterministic matrix and [exact-candidate portability CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/34577054241) passed. Separate macOS and Windows runs on DSH `0.1.5-rc.2` each passed all 28 required host-bound gates for these same bytes, with cleanup passed. Both annexes retain the `real_model_request` skip; no real-model task, daily-profile adoption, or rc.1 native run is claimed for this artifact.
+
+Anonymous public readback verified the annotated tag target, npm version and `latest` tag, embedded `gitHead`, registry integrity, and downloaded tgz bytes. The GitHub Release title is `DSH Completion Guard 0.5.2`. All seven attachments matched the accepted files: the tgz, checksum, artifact manifest, and separate native annexes and transfer receipts for macOS and Windows. The public package publishes `0.1.5-rc.2 || 0.1.5-rc.1` consistently in the top-level DSH engine field, nested plugin engine field, and all seven DSH peer dependencies.
+
+This section and the updated main-branch installation guidance are post-release documentation. The published tag and npm package retain their original bytes.
+
+## 0.5.1 published release (2026-09-11)
+
+[Version 0.5.1](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1) is published on GitHub and [npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.1). The annotated tag and npm `gitHead` identify commit `aefdeaf2737ef1c99f1170085140c93a515e1125`. The frozen 303460-byte, 27-file tgz has SHA-256 `5e00ddf2f9772b1ae2ca3665d7c4ce858b814dc26a4116388082db2d625da28d`.
+
+The local deterministic matrix and [exact-candidate portability CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/34553623984) passed. Separate macOS and Windows runs on DSH `0.1.5-rc.2` each passed all 28 required host-bound gates for these same bytes, with cleanup passed. Both annexes retain the `real_model_request` skip; no real-model task is claimed. These isolated runs do not establish daily-profile adoption or native acceptance on rc.1.
+
+Anonymous public readback verified the annotated tag target, npm version and `latest` tag, embedded `gitHead`, registry integrity and downloaded tgz bytes. All seven GitHub Release attachments matched the accepted files: the tgz, checksum, artifact manifest, and separate native annexes and transfer receipts for macOS and Windows. The packaged registry provenance remains `registry-derived-pending-native-audit`; the later native results are carried by the exact-artifact annexes, not by a changed host-lock digest.
+
+This section and the updated main-branch installation guidance are post-release documentation. The published tag and npm package retain their original bytes.
+
+## 0.5.1 validation scope
+
+The release supports exact DSH `0.1.5-rc.1` and `0.1.5-rc.2` core graphs. Development tests retain the rc.1 baseline; rc.2 graph tests additionally reject missing, mixed, forged and unregistered package identities. Dependency-free Headless preflight selects the matching registered cohort and checks its launcher version.
 
 Candidate results are recorded outside packaged documents after the source and package bytes are frozen. Require the local deterministic matrix, exact-candidate portability CI, and separate macOS and Windows native annexes for the same frozen tgz. An earlier rc.1 artifact's result does not establish acceptance of an artifact that adds rc.2 support. Real-model behaviour, daily profile adoption and publication remain separate gates.
 

package/docs/NEXT_VERSION_REPAIR_NOTES.md

@@ -0,0 +1,54 @@
+# 下个版本：准备工具、Git 取证与问答残留
+
+状态：未发布的增量修复与后续设计记录，2026-09-14。修复基线为 DSH Completion Guard 0.5.2。本页持续补充，不是发布或原生验收记录；下一候选版本为 0.5.3；正式发布身份以独立制品和发布回读为准。
+
+## 已实施的局部修复
+
+### 准备工具返回合法 JSON
+
+宿主能力检查成功时可以不携带 reasonCode，但 prepare 将其写成 host_capability.reason_code: undefined。DSH 在渲染前检查返回值是否为无损 JSON，因此拒绝整个调用。不存在的条目和错误 revision 提前返回，不经过此字段。
+
+现在只有定义了 reasonCode 才输出 reason_code。注册期回归使用真实成功结果的形状，不再人为补一个成功原因来掩盖问题；覆盖 generic_run、commit、install、verify、push 和错误分支。该缺陷属于插件输出契约，跨操作系统，不应归因于 Windows 宿主拒绝合法数据。
+
+### Git 取证给出可执行的准备信息
+
+prepare 新增 evidence_input_contract：列出 selector、command_manifest、planned_arguments 的字段和完整调用顺序。Git 的 missing_target_fields 只列调用方需要提供的 selector 字段；前置 HEAD、暂存区摘要和源提交等由生产者读取，不要求用户伪造。
+
+resolution 缺少输入时，evidence 在探测可执行程序前返回 resolution_input_missing、missing_fields 和 next_step。effect/state 缺少前置调用引用时保留 producer_reference_missing，并明确缺少 resolution_call_id 或 effect_call_id。这些新增字段只解释失败，不改变证据事实、摘要或认证权限。
+
+正确顺序：
+
+1. 暂存需要提交的改动后，先请求 resolution。commit 的 selector 是 repository、branch；push/fetch/pull 是 repository、remote、refspec。
+2. Git command_manifest 只包含 planned_tool 和 planned_arguments；planned_tool 为 bash 或 pwsh，planned_arguments 只包含 command 和 workdir。命令必须匹配 prepare 给出的受支持形态；workdir 与 repository 一致。manifest_id 不是该输入的替代品。
+3. 用成功 resolution 的调用 ID、target_digest 和当前条目 ID/revision 调用 context_guard_action 执行一次。
+4. 分别请求 effect 和 state，均引用同一 resolution_call_id 和成功 action 的 effect_call_id。
+5. checkpoint 引用三种角色对应的 evidence ID。工具 call ID 与证据 evidence ID 不可混用。
+
+已有动作如果绕过这条链执行，普通回读仍能报告实际结果，但无法补造执行前证据。不要重复提交或推送来填补历史证据缺口。
+
+## 事故结论的修正
+
+两次 Windows 对话确实观察到 prepare 输出错误和 Git 取证失败。独立核对后，不能把缺参调用的失败推广为“Git 适配器完全不可达”：resolution 调用未提供计划工具清单，effect/state 调用未提供前置调用引用。adapter_id 标识尝试的适配路径，不代表本次产生了可用事实；selector 不接受 commit 字段也不表示缺少提交支持。
+
+现有真实临时仓库测试覆盖 commit/push/fetch/pull 的受控执行和独立回读。它们不能替代 Windows 日常宿主验收。Windows 中 Git 子进程创建 signal pipe 失败另属执行环境问题，不能由本次输出契约修复宣称解决。没有真实等待或延后资格时，boundary 拒绝仍是正常保护，不应为结束一次对话伪造资格。
+
+## 待设计：问答交付与执行认证分离
+
+本轮没有改变需求捕获、pending 状态、证书或恢复关闭规则。当前调查/问答可能已交付给用户，却仍以未认证条目保留；复杂表达又可能被识别为 generic_run。不能将这个已知缺口写成已修复。
+
+后续设计沿用上游 [Semantic Compatibility](https://github.com/GreenLv/codex-context-guard/blob/main/docs/SEMANTIC_COMPATIBILITY.md) 的边界：共享语义由上游拥有，DSH 保留独立宿主、持久化和运行时。当前镜像不意味着自动采用 Codex 0.13.x 的全部行为。既有分析还包括 effectiveness 仓库的 docs/SEMANTIC_BOUNDARIES.md，指出有限句型只能保证已覆盖语法，不能证明一般语义完备。
+
+下一批工作须定义：
+
+- 原文跨度对应信息交付、执行、约束和未知部分；未覆盖跨度保持可见，不由模型摘要替代原文。
+- 回答交付记录绑定当前根用户输入、宿主 turn 和最终回答；交付不等于内容正确或执行认证。
+- 混合请求的回答部分可以记录交付，修改、测试、发布等仍需独立证据；子项交付不能关闭父项全部工作。
+- 未知表达保持可解释的未决状态，禁止靠增加关键词或删除 pending 条目掩盖问题。观察模式先评估误关闭与误保留，再决定版本化切换。
+- 延迟回复、子代理回复、压缩摘要、引用历史和中止 turn 不能误绑定为当前回答；恢复保持已验证的交付与未完成执行。
+- 旧证书、旧投影和升级边界必须明确；新增共享行为先在上游形成中立合成用例，再按精确 pin 适配，不能静默改写冻结镜像。
+
+验收需分别覆盖纯问答、附流程图说明、长复合提问、解释后执行、未知尾句、条件/否定、双语、跨 turn、compact/resume 和旧状态。记录误保留、误关闭及额外轮次，不能仅用总测试通过率评价语义覆盖。
+
+## 验证边界
+
+本轮局部修复使用宿主注册、诊断和取证测试，以及仓库映射所要求的本地检查。更新 dist 只代表生成源码产物；旧 0.5.2 制品和已加载插件不变。新候选的 CI、Windows/macOS 原生验收、冻结制品、安装和发布均需后续独立完成。Codex 本轮仅新增问题与设计文档，不修改其运行时。

package/docs/PORTING_NOTES.md

@@ -15,10 +15,10 @@ fixtures and an explicit delta ledger.
 | portable protocol and digest fixtures | Mirror exact upstream bytes and verify their hashes |
 | product-specific or newer Codex behavior | Record explicitly in the delta ledger before porting |
 
-## Current host boundary (0.5.1)
+## Current host boundary (0.5.2)
 
-Version 0.5.1 ports Guard onto DSH >= 0.1.5-rc.1 and keeps no path back to the
-older host. Concretely:
+Version 0.5.2 admits exactly DSH `0.1.5-rc.2` and `0.1.5-rc.1` and keeps no path back to the
+older host or ahead to an unregistered host. Concretely:
 
 - Session history is read only through the DSH Session V3 `snapshotEvents()`
   API. The V2 `events` getter is gone, and a session that does not expose the
@@ -32,8 +32,8 @@ older host. Concretely:
   resume entry point, and turn stopping yields while a Goal is paused, blocked,
   completed, or not yet read back.
 
-The host identifier is the exact 33-row DSH core graph. The active 0.1.5-rc.1
-cohort is registry-derived with its native audit still pending, and that
+The host identifier is the exact 33-row DSH core graph. The rc.1 verified-minimum
+and rc.2 latest cohorts are registry-derived, and that
 provenance is bound into the host-lock digest rather than inferred from a
 version number.
 

package/docs/distribution.md

@@ -25,16 +25,24 @@ version and annotated tag are retained for audit history; the npm version is
 deprecated with `Release metadata incomplete; use dsh-completion-guard@0.3.1.`
 Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
 
-## Published v0.4.0 destinations
+## Published v0.5.2 destinations (2026-09-11)
+
+1. [GitHub Release `v0.5.2`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.2) is a non-draft, non-prerelease release named `DSH Completion Guard 0.5.2`. Its annotated tag identifies commit `e8b21b3d0bb5b3864c856cc9ea6bd19d5ab066ef`.
+2. [`dsh-completion-guard@0.5.2` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.2) is published and `latest` resolves to `0.5.2`. Its `gitHead` equals that release commit. The registry download and Release tgz match SHA-256 `d975f17dc3bfed999cbe6c0e638b226c3dcf8651f288ea7ab83faa5ba7903d31`. The public package exposes `0.1.5-rc.2 || 0.1.5-rc.1` in both DSH engine fields and all seven DSH peer dependencies.
+3. All seven Release attachments were downloaded and matched the accepted files. The separate macOS and Windows annexes each record 28 required gates passed on DSH `0.1.5-rc.2`, with real-model requests skipped. See [acceptance details](LOCAL_ACCEPTANCE.md).
+
+Version 0.5.1 remains available as an immutable historical release.
+
+## Historical v0.4.0 destinations
 
 1. [GitHub Release `v0.4.0`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.4.0)
-   is the latest non-draft, non-prerelease release. Its annotated tag peels to
+   remains a historical non-draft, non-prerelease release. Its annotated tag peels to
    release commit `d5cd0ca17833d05bfdf41457ae203864bde8056b`. The Release
    carries the frozen tgz, checksum, artifact manifest, and separate macOS and
    Windows native-acceptance annexes. The tgz has SHA-256
    `71ce205dedeffe72566ad399e001f0b337d057cede297e1d2249acec67cde1f2`.
 2. [`dsh-completion-guard@0.4.0` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.4.0)
-   is published and `latest` resolves to `0.4.0`. The registry `gitHead`
+   remains published. The registry `gitHead`
    equals the release commit, and a fresh registry download is byte-identical
    to the frozen Release tgz.
 3. Source commit, candidate/main/tag CI, native macOS and Windows acceptance,
@@ -83,9 +91,9 @@ install target.
 
 | Channel | Entry | Status | Evidence |
 |---|---|---|---|
-| [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | `GreenLv/dsh-completion-guard` (category `security`) | Listed | Added via [PR #3693](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3693) (merge commit `299f0b5c`, 2026-08-29). The shorter plain-language English and Chinese descriptions merged via [PR #3977](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3977) (merge commit `bdf5145`, 2026-09-01) and were read back from the current generated READMEs, source YAML, and public [`plugins.json`](https://awesome-dsh-plugin.com/plugins.json). The detail page still showed the earlier wording and GitHub install command at readback, so that page refresh remains pending. Screenshots are declared in this repository's [`screenshots.json`](../screenshots.json); image changes do not need a listing PR. |
-| [dsh-market](https://dsh-market.com/) | `dsh-completion-guard` (Tools / Development workflow) | Listed | Added via [PR #1285](https://github.com/zhu1090093659/dsh-web/pull/1285) (merge commit `be426da`, 2026-08-31); read back on 2026-09-01 from the public [`manifest/plugins.json`](https://dsh-market.com/manifest/plugins.json) at rank 51. The market reads the listing text from its community index; npm download counts and likes are updated separately by the site. |
-| [Awesome DeepSeek Harness](https://github.com/Dominic789654/awesome-deepseek-harness#security--permissions) | `GreenLv/dsh-completion-guard` | Listed | Rows merged via [PR #332](https://github.com/Dominic789654/awesome-deepseek-harness/pull/332) (merge commit `ba414c4`, 2026-08-29) and read back live the same day from both generated READMEs (`README.md` line 940, `README.zh-CN.md` line 946), under **Security & Permissions** alongside the other fail-closed gates and verifier plugins. |
+| [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) | `GreenLv/dsh-completion-guard` (category `security`) | Listed | Added via [PR #3693](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3693) (merge commit `299f0b5c`, 2026-08-29). The shorter plain-language English and Chinese descriptions merged via [PR #3977](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3977) (merge commit `bdf5145`, 2026-09-01) and were read back from the current generated READMEs, source YAML, and public [`plugins.json`](https://awesome-dsh-plugin.com/plugins.json). On 2026-09-11, the detail page showed the updated bilingual description and npm install command. Its embedded README still described 0.4.0 and the public index version remained 0.4.3; those generated caches await the directory publisher's refresh. Screenshots are declared in this repository's [`screenshots.json`](../screenshots.json); image changes do not need a listing PR. |
+| [dsh-market](https://dsh-market.com/) | `dsh-completion-guard` (Tools / Development workflow) | Listed | Added via [PR #1285](https://github.com/zhu1090093659/dsh-web/pull/1285) (merge commit `be426da`, 2026-08-31); read back on 2026-09-01 from the public [`manifest/plugins.json`](https://dsh-market.com/manifest/plugins.json) at rank 51. A browser readback on 2026-09-11 confirmed the Completion Guard detail page, matching bilingual description, repository identity and unversioned npm install command. The market reads the listing text from its community index; npm download counts and likes are updated separately by the site. |
+| [Awesome DeepSeek Harness](https://github.com/Dominic789654/awesome-deepseek-harness#security--permissions) | `GreenLv/dsh-completion-guard` | Listed | Rows merged via [PR #332](https://github.com/Dominic789654/awesome-deepseek-harness/pull/332) (merge commit `ba414c4`, 2026-08-29) and read back live the same day from both generated READMEs (`README.md` line 940, `README.zh-CN.md` line 946), under **Security & Permissions** alongside the other fail-closed gates and verifier plugins. The English source README still contained the matching version-independent entry on 2026-09-11. |
 
 ## Update route
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-completion-guard",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "A task-contract and completion-certification layer for DeepSeek Harness.",
   "repository": {
     "type": "git",
@@ -38,20 +38,24 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "engines": {
+      "dsh": "0.1.5-rc.2 || 0.1.5-rc.1"
     }
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22",
+    "dsh": "0.1.5-rc.2 || 0.1.5-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-commands": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-goal": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-goal": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": ">=0.1.5-rc.1"
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-goal": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-goal": "0.1.5-rc.2 || 0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.2 || 0.1.5-rc.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-goal": {
@@ -109,5 +113,5 @@
     "hooks",
     "typescript"
   ],
-  "gitHead": "aefdeaf2737ef1c99f1170085140c93a515e1125"
+  "gitHead": "a7baccdfbc538aa071941ebb36aa41fa9bf6e709"
 }