dsh-completion-guard 0.5.2 → 0.6.0

package/docs/ARCHITECTURE.md

@@ -84,6 +84,94 @@ Since 0.5.0 a durable root message is one atomic confirmation transaction. The f
 
 No digest-v3 wire format or upstream fixture changes are needed. A replacement changes the item/status set and contract revision, invalidating the earlier certificate; evidence is never copied into a passed state. A fresh checkpoint must revalidate the exact action, target, executor, host lock, and transition. Evidence predating the authoritative root clause referenced by a replacement is rejected while retaining its historical ID.
 
+## 0.6.0 semantic layer
+
+The v5 protocol boundary (`Context Guard protocol boundary: v5.0.0`), written
+with the first real root-input step of a new session, activates the semantics
+below. A session that never wrote it keeps the whole-session contract, version-1
+certificates, and the frozen digest domains; a session that wrote it keeps
+pre-boundary obligations under their birth rules while new work uses the v5
+rules. `/context-guard migration` reports which of the two is in force.
+
+| Module | Owns |
+| --- | --- |
+| `domain/spans.ts` | UTF-8 byte offsets and half-open spans of the original root text |
+| `domain/host-selection.ts` | Trusted question round-trips; a selection is only ever a paired call + result |
+| `domain/work-unit.ts` | Derived units, delegation lineage, ancestor/descendant relations, explicit switch and delegation vocabularies |
+| `domain/closure.ts` | The single open-closure implementation: visible pending, certifiable open, unit closure with required descendants, and the ancestor constraints in force |
+| `domain/delivery.ts` | Trusted answer delivery: the four-part composition criterion over durable turn structure |
+| `domain/proof.ts` | v1 and v2 proof manifests, the v2 capability matrix, and the binding/refusal rules per kind |
+| `domain/release.ts` | Explicit release contracts, one-shot reservations, readback settlements, coverage surface, and the pre-effect gate |
+| `domain/reason-class.ts` | The frozen seven-class mapping for every reason code |
+| `domain/migration.ts` | Rule set in force, preserved identities, and the rollback precondition |
+| `domain/diagnostics.ts` | The single per-item judge, now carrying its reason class |
+
+### Delivery
+
+A delivery fact exists only when the host's own log says so: an
+`assistant/message` for turn T at that turn's highest step, with no
+`interrupted` marker, followed by `turn/end { turn: T, reason.kind:
+"completed" }`. `assistant/attempt` records, aborted or errored turns, other
+turns' replies, and delegated sessions never bind a delivery. Delivery closes
+only information-slot obligations captured inside that turn (including those of
+a delegated sub-unit created in it), and it proves delivery only — never
+accuracy, sufficiency, or execution.
+
+### Units and closure
+
+Units are derived from the durable message stream, never written. A
+delegation-marked root message opens a CHILD unit: the parent stays the current
+unit, so delegating a sub-task cannot drop the parent's own work, and the
+child's open obligations join the parent's closure as required descendants. An
+ordinary task switch opens a sibling, whose residual work deliberately does not
+block the newer task. A delegated tool round-trip is recorded per unit and its
+evidence is marked bounded, so a subagent's result is visible and auditable but
+can never close a parent obligation. Certifying a unit also refuses any binding
+that an ancestor unit's prohibition or unsatisfied condition still governs.
+
+### Proof v2
+
+The v1 manifest and `ccg.proofManifest.v1` are frozen and read by their own
+rules. The v2 manifest (`0.6.0`, `ccg.proofManifest.v2`) binds each obligation
+to a current subject, a declared source, and a real operation, and covers eight
+kinds. Tool success is only ever an `execution_fact`; a visual readback needs a
+fact that carries a visual-readback capability and actually read the subject; an
+input asset check must be a prior-state fact; an external fact needs a completed
+external-operation reference; and a cohort with no producer reports
+`proof_producer_capability_unavailable`. Strict policy uses this same matrix to
+demand the proof the user explicitly asked for.
+
+### Explicit release
+
+Contracts, reservations and settlements are persisted through the plugin-notice
+channel the host already writes, and each is idempotent by its own identity
+(contract id, call id). Reservations are written before the effect and record
+the SRI the trusted producer read; a settlement records a trusted readback when
+one exists and otherwise stays `unconfirmed`, which preserves the in-flight
+protection and refuses a re-send. Adoption comes only from the root
+`command/run`, and `release status`/`release revoke` are read-only and
+authority-withdrawing respectively — neither is a state corruption.
+
+The contract freezes the candidate scope's `adoptedAtRevision`, and the closure
+certificate must be the one that certified exactly that revision: the release
+instruction is itself a new obligation, so requiring the CURRENT revision would
+make publishing depend on having already published, while freezing the revision
+still refuses a candidate whose content moved on.
+
+Candidate identity is read from trusted producers only: the action tool reads
+the exact tgz (byte SHA-256, npm SRI, embedded `gitHead`, package, version,
+repository) and the canonicalized registry, and the runtime resolves a declared
+ref with the audited git executable. Each named identity is compared with its
+own observation.
+
+`context_guard_release` is the recovery entry: `status` is a read-only report,
+and `reconcile` reads the external identity through the auditing registry
+adapter and settles a reservation only when the readback names the frozen bytes.
+It never re-sends a release, and it works after a restart and for a
+revoked-but-in-flight attempt. `RuntimeExecutorSeams` exists so an acceptance
+run can replace the mutation executor, the HTTP client and the pinned host
+cohort; the release gate, records, producers and replay stay production code.
+
 ## Bounded queries and recovery
 
 Checkpoint certification runs over the complete contract before display filtering. Default pages contain at most eight current items/constraints and ten evidence rows. Each list has its own cursor, bound to the session, epoch, contract revision, query, bindings, and evidence snapshot. `history` includes unsupported evidence with an unavailable disposition; default evidence and binding templates share action/target matching. Unknown cursor state is an explicit query error.

package/docs/LOCAL_ACCEPTANCE.md

@@ -2,6 +2,118 @@
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.
 
+### Third repair round after targeted review (2026-09-14)
+
+Two findings from the targeted review of `fcc3813`: an adoption could be ratified
+by a certificate minted AFTER it (the revision comparison was satisfiable by a
+later log entry), and a mistyped `/context-guard release adopt` payload marked
+the persisted release state damaged, so one typo blocked every later
+publication. Both are fixed: the adoption freezes the closure certificate's
+identity at its own watermark, and only unreadable persisted records damage the
+release state. Regression cases live in
+`tests/domain/v060-release-migration.test.ts` (31 cases).
+
+### Second repair round after follow-up review (2026-09-14)
+
+The follow-up review of the repair commit found five remaining wiring defects
+(pre-v5 delivery retro-closure, the unobserved registry and unreachable ref, the
+closure revision that made publishing depend on publishing, read-only status
+poisoning the release state, and a proof that was checked when signed but not
+when replayed). All five are fixed and the reviewer's counterexamples remain as
+regression cases.
+
+Added deterministic evidence for this round:
+
+- `tests/tools/v060-release-chain.test.ts` — the production release chain: a real
+  root publish instruction, a real certified preparation closure, a real
+  contract adoption, a real tgz and resolution through the registered evidence
+  tool, and the registered action tool consulting the runtime's own gate
+  (reserve, execute once, stay in flight, reconcile through the registered
+  recovery tool, refuse the replay). Also the revoked-but-in-flight restart
+  recovery and a mismatching readback.
+- `tests/domain/v060-proof-production-chain.test.ts` — a proof-bound certificate
+  signed, persisted and replayed through the real tool, plus the missing-proof,
+  tampered-proof and Goal-consumption negatives.
+
+### Repair round after concentrated review (2026-09-14)
+
+The `0dce898` candidate failed a concentrated review: fifteen counterexamples,
+all reproducing real defects. The findings were repaired as eight families
+(F01–F08) and the reviewer's suite is now a permanent regression gate
+(`tests/domain/review-counterexamples.test.ts`, 15 cases, all passing). One
+reviewer expectation was deliberately changed and is marked in place.
+
+Added deterministic evidence for this round:
+
+- `tests/domain/v060-proof-production-chain.test.ts` — the C09 proof entry
+  through real DSH tool registration: a real read fact, the real binder, the real
+  checkpoint tool, a persisted certificate and a full log replay.
+- `tests/domain/v060-release-migration.test.ts` — rewritten (26 cases) around a
+  REAL certified closure, with every candidate identity refusal, the
+  reconciliation of an unconfirmed attempt by a trusted readback, damaged-state
+  scoping, revocation, and the migration rule sets.
+- The v2 fixture grew to 27 cases: S09 now carries a real read fact and asserts
+  the binder's outcome, the S11 probes are evaluated at their own point in the
+  log with real closure certificates, and the coverage table records each
+  operation's honest attribution.
+
+The two scope facts decided on 2026-09-14 (candidate-only v2 plus open parity;
+`npm_publish` as the only protectable release surface, with the missing routes
+attributed as an approved scope reduction) are recorded in
+[SEMANTIC_COMPATIBILITY.md](SEMANTIC_COMPATIBILITY.md).
+
+## 0.6.0 source candidate (2026-09-14)
+
+This section records a **source and deterministic** claim only. It is not a
+release, not an artifact acceptance, and not a native-platform result.
+
+Established at this point:
+
+- The full local deterministic matrix on the frozen candidate: `typecheck`,
+  `lint`, `vitest`, `test:release-pack`, `test:stats`, `build`, `pack:check`,
+  the repository documentation audit and its unit test, `git diff --check`, and
+  a byte-clean `git diff --exit-code -- dist` after the build.
+- The v2 conformance candidate (25 cases, S01–S12) and its independence,
+  proof-v2, release/migration, strict-policy, unit-closure, and release-gate
+  suites, all through production entry points.
+- `pack:check` reports the 0.6.0 payload inventory (28 files) with `dist/`,
+  both changelogs, `docs/`, and `manifests/` included.
+
+Not established here, and deliberately not claimed:
+
+- No tgz has been packed with `scripts/release-pack.mjs`, so there is no frozen
+  artifact digest and no repeated-pack byte identity for 0.6.0.
+- No native macOS or Windows Web/Headless run has been executed against a
+  0.6.0 artifact. The 0.5.3 native annexes are bound to the 0.5.3 bytes and do
+  not transfer.
+- No tag, npm publication, GitHub Release, or consumer installation exists for
+  0.6.0.
+- Cross-language parity for the v2 input family is not established, because the
+  upstream has not landed a canonical v2 fixture.
+
+The next stages are P5 (one canonical pack, two platforms, same tgz) and P6
+(publication and consumption), each requiring its own authorization.
+
+## 0.5.3 published release (2026-09-14)
+
+[Version 0.5.3](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.3) is published on GitHub and [npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.3). The annotated tag and npm `gitHead` identify commit `a7baccdfbc538aa071941ebb36aa41fa9bf6e709`. The frozen 308178-byte, 28-file tgz has SHA-256 `972269489ba65092bf13daf2993c162b6f509d5f49040412376e6ae21d957798`.
+
+The local deterministic checks and [exact-candidate CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/34813886909) passed, including Ubuntu/macOS/Windows on Node.js 22 and 24. Separate macOS and Windows native runs on DSH `0.1.5-rc.2` each passed all 28 required host-bound gates on the same CI-frozen package, with no reused gates and successful cleanup. The real host tool path covers prepare without an optional reason code and Git missing-input replies. Both annexes retain the `real_model_request` skip; these runs do not establish daily-profile adoption, rc.1 native acceptance, or general answer-delivery semantics.
+
+Anonymous readback verified the annotated tag target, npm version and latest tag, embedded commit, registry integrity and downloaded package bytes. The GitHub Release title and bilingual body match the reviewed candidate. All seven attachments match the accepted files: package, checksum, artifact manifest, and the separate macOS/Windows annexes and transfer receipts. Windows result hashes were also matched to the original remote files before publication.
+
+This section and the updated main-branch installation instructions are post-release documentation; the tag and npm package retain their original bytes. The patch fixes prepare serialization and Git input guidance. The answer-delivery design remains future work in [the repair notes](NEXT_VERSION_REPAIR_NOTES.md).
+
+## 0.5.2 published release (2026-09-11)
+
+[Version 0.5.2](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.2) is published on GitHub and [npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.2). The annotated tag and npm `gitHead` identify commit `e8b21b3d0bb5b3864c856cc9ea6bd19d5ab066ef`. The frozen 303412-byte, 27-file tgz has SHA-256 `d975f17dc3bfed999cbe6c0e638b226c3dcf8651f288ea7ab83faa5ba7903d31`.
+
+The local deterministic matrix and [exact-candidate portability CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/34577054241) passed. Separate macOS and Windows runs on DSH `0.1.5-rc.2` each passed all 28 required host-bound gates for these same bytes, with cleanup passed. Both annexes retain the `real_model_request` skip; no real-model task, daily-profile adoption, or rc.1 native run is claimed for this artifact.
+
+Anonymous public readback verified the annotated tag target, npm version and `latest` tag, embedded `gitHead`, registry integrity, and downloaded tgz bytes. The GitHub Release title is `DSH Completion Guard 0.5.2`. All seven attachments matched the accepted files: the tgz, checksum, artifact manifest, and separate native annexes and transfer receipts for macOS and Windows. The public package publishes `0.1.5-rc.2 || 0.1.5-rc.1` consistently in the top-level DSH engine field, nested plugin engine field, and all seven DSH peer dependencies.
+
+This section and the updated main-branch installation guidance are post-release documentation. The published tag and npm package retain their original bytes.
+
 ## 0.5.1 published release (2026-09-11)
 
 [Version 0.5.1](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1) is published on GitHub and [npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.1). The annotated tag and npm `gitHead` identify commit `aefdeaf2737ef1c99f1170085140c93a515e1125`. The frozen 303460-byte, 27-file tgz has SHA-256 `5e00ddf2f9772b1ae2ca3665d7c4ce858b814dc26a4116388082db2d625da28d`.

package/docs/NEXT_VERSION_REPAIR_NOTES.md

@@ -0,0 +1,81 @@
+# 下个版本：准备工具、Git 取证与问答残留
+
+状态：局部修复已随 0.5.3 发布（2026-09-14）；本页记录的后续语义设计已随 0.6.0 实现（2026-09-14），实现状态与验收边界见下节与[语义兼容说明](SEMANTIC_COMPATIBILITY.md)。本页以 0.5.2 为事故修复基线；精确制品与平台结果见[验收记录](LOCAL_ACCEPTANCE.md#053-published-release-2026-09-14)。
+
+## 0.6.0 实现结论（2026-09-14）
+
+本页"待设计：问答交付与执行认证分离"一节列出的六项要求已全部落地，并且都在生产链路（derive / 交付 / 闭包 / Goal / 工具注册）上运行，而不是只测解析器：
+
+- 原文跨度按 UTF-8 字节半开区间绑定信息、执行、约束和未知部分；无法分类的部分进入 coverage 记录并保持可见，不由模型摘要替代原文。
+- 回答交付记录绑定当前根输入、宿主 turn 与最终回答；判据是宿主的 `assistant/message`（该 turn 最大 step、无 interrupted）+ 后继 `turn/end completed`，交付不代表内容正确或执行完成。
+- 混合请求按子项关闭：回答部分交付即关闭，修改/测试/发布仍需独立证据；子项交付不关闭父项全部工作（C04 必需后代闭包）。
+- 未知表达保持可解释的未决状态；未通过增加关键词或删除 pending 条目来掩盖问题。
+- 延迟回复、子代理回复、压缩摘要、引用历史和中止 turn 都不会绑定为当前回答；子代理结果标记为有界证据，且明确不是可用的证明来源。
+- 旧证书、旧投影与升级边界已明确：v5 边界之前的条目保留出生规则，v1 证明 manifest 与全部 v3 摘要域只读不变；新共享行为先以 DSH 侧 host-neutral 候选形式落地。
+
+### 跟进复核后的第二轮修复（2026-09-14）
+
+修复提交的跟进复核在新接线中发现 5 个残留缺陷，均属原家族，已全部修复并保留反例为回归：pre-v5 交付追溯关闭（F01）、真实生产者缺 registry 且 ref 路径不可达（F04）、闭包 revision 使发布依赖发布（F04）、只读 `release status` 永久毒化发布状态（F05/F06）、proof 签发时校验但重放时忽略（F08）。同时补齐了此前缺失的**可信恢复入口** `context_guard_release`（`status` 只读、`reconcile` 按审计 registry 回读结算，绝不重发；覆盖重启后与 revoked-but-in-flight 恢复，并为 SHA256-only 合同保留预约期记录的 SRI 以便核对与检测不一致）。
+
+### 集中复核后的修复（2026-09-14）
+
+对 0dce898 候选的集中复核给出 15 个反例，全部复现真实缺陷；F01–F08 已修复并各有生产链路正负例，反例套件保留为常驻回归（`tests/domain/review-counterexamples.test.ts`）。其中一项复核期望（R1）被有意修改：原探针要求"64 位 hex 契约 + SRI 请求"必须放行，这本身就是被判定为缺陷的身份混用；修复后同义要求由"真实制品绑定的合法发布必须可放行"与"错字节/错 gitHead/错 SRI/错目标/错回读必须拒绝"两组用例覆盖，理由写在测试原位。
+
+仍未完成、且本页不宣称完成的部分：
+
+- 上游尚未落地冻结的 v2 fixture，因此本仓库的 v2 文件是候选身份，跨语言 parity 与正式镜像待上游落地后按精确 commit 重镜像并刷新 `UPSTREAM_PIN.json`。**协调者已于 2026-09-14 裁定阶段性退出**：该项归上游所有，列为跨仓库待办，不作为 DSH 侧退出条件。
+- 发布档可保护表面仅 `npm_publish`。`git_tag` 与 GitHub Release 路由记为 `release_operation_unrouted` / `attribution: scope_reduction`（缺少 Guard 自有路由，属可实现缺口，并经协调者批准缩小本轮公开范围）；只有复合 runner 记为不透明宿主边界。补建这两条路由是后续版本的工作项。
+- 0.6.0 候选的原生 macOS/Windows 验收、精确制品冻结、tag、npm 与 GitHub Release 均未执行，属于后续独立阶段。
+
+## 已实施的局部修复
+
+### 准备工具返回合法 JSON
+
+宿主能力检查成功时可以不携带 reasonCode，但 prepare 将其写成 host_capability.reason_code: undefined。DSH 在渲染前检查返回值是否为无损 JSON，因此拒绝整个调用。不存在的条目和错误 revision 提前返回，不经过此字段。
+
+现在只有定义了 reasonCode 才输出 reason_code。注册期回归使用真实成功结果的形状，不再人为补一个成功原因来掩盖问题；覆盖 generic_run、commit、install、verify、push 和错误分支。该缺陷属于插件输出契约，跨操作系统，不应归因于 Windows 宿主拒绝合法数据。
+
+### Git 取证给出可执行的准备信息
+
+prepare 新增 evidence_input_contract：列出 selector、command_manifest、planned_arguments 的字段和完整调用顺序。Git 的 missing_target_fields 只列调用方需要提供的 selector 字段；前置 HEAD、暂存区摘要和源提交等由生产者读取，不要求用户伪造。
+
+resolution 缺少输入时，evidence 在探测可执行程序前返回 resolution_input_missing、missing_fields 和 next_step。effect/state 缺少前置调用引用时保留 producer_reference_missing，并明确缺少 resolution_call_id 或 effect_call_id。这些新增字段只解释失败，不改变证据事实、摘要或认证权限。
+
+正确顺序：
+
+1. 暂存需要提交的改动后，先请求 resolution。commit 的 selector 是 repository、branch；push/fetch/pull 是 repository、remote、refspec。
+2. Git command_manifest 只包含 planned_tool 和 planned_arguments；planned_tool 为 bash 或 pwsh，planned_arguments 只包含 command 和 workdir。命令必须匹配 prepare 给出的受支持形态；workdir 与 repository 一致。manifest_id 不是该输入的替代品。
+3. 用成功 resolution 的调用 ID、target_digest 和当前条目 ID/revision 调用 context_guard_action 执行一次。
+4. 分别请求 effect 和 state，均引用同一 resolution_call_id 和成功 action 的 effect_call_id。
+5. checkpoint 引用三种角色对应的 evidence ID。工具 call ID 与证据 evidence ID 不可混用。
+
+已有动作如果绕过这条链执行，普通回读仍能报告实际结果，但无法补造执行前证据。不要重复提交或推送来填补历史证据缺口。
+
+## 事故结论的修正
+
+两次 Windows 对话确实观察到 prepare 输出错误和 Git 取证失败。独立核对后，不能把缺参调用的失败推广为“Git 适配器完全不可达”：resolution 调用未提供计划工具清单，effect/state 调用未提供前置调用引用。adapter_id 标识尝试的适配路径，不代表本次产生了可用事实；selector 不接受 commit 字段也不表示缺少提交支持。
+
+现有真实临时仓库测试覆盖 commit/push/fetch/pull 的受控执行和独立回读。它们不能替代 Windows 日常宿主验收。Windows 中 Git 子进程创建 signal pipe 失败另属执行环境问题，不能由本次输出契约修复宣称解决。没有真实等待或延后资格时，boundary 拒绝仍是正常保护，不应为结束一次对话伪造资格。
+
+## 待设计：问答交付与执行认证分离
+
+本轮没有改变需求捕获、pending 状态、证书或恢复关闭规则。当前调查/问答可能已交付给用户，却仍以未认证条目保留；复杂表达又可能被识别为 generic_run。不能将这个已知缺口写成已修复。
+
+后续设计沿用上游 [Semantic Compatibility](https://github.com/GreenLv/codex-context-guard/blob/main/docs/SEMANTIC_COMPATIBILITY.md) 的边界：共享语义由上游拥有，DSH 保留独立宿主、持久化和运行时。当前镜像不意味着自动采用 Codex 0.13.x 的全部行为。既有分析还包括 effectiveness 仓库的 docs/SEMANTIC_BOUNDARIES.md，指出有限句型只能保证已覆盖语法，不能证明一般语义完备。
+
+下一批工作须定义：
+
+- 原文跨度对应信息交付、执行、约束和未知部分；未覆盖跨度保持可见，不由模型摘要替代原文。
+- 回答交付记录绑定当前根用户输入、宿主 turn 和最终回答；交付不等于内容正确或执行认证。
+- 混合请求的回答部分可以记录交付，修改、测试、发布等仍需独立证据；子项交付不能关闭父项全部工作。
+- 未知表达保持可解释的未决状态，禁止靠增加关键词或删除 pending 条目掩盖问题。观察模式先评估误关闭与误保留，再决定版本化切换。
+- 延迟回复、子代理回复、压缩摘要、引用历史和中止 turn 不能误绑定为当前回答；恢复保持已验证的交付与未完成执行。
+- 旧证书、旧投影和升级边界必须明确；新增共享行为先在上游形成中立合成用例，再按精确 pin 适配，不能静默改写冻结镜像。
+
+验收需分别覆盖纯问答、附流程图说明、长复合提问、解释后执行、未知尾句、条件/否定、双语、跨 turn、compact/resume 和旧状态。记录误保留、误关闭及额外轮次，不能仅用总测试通过率评价语义覆盖。
+
+## 验证边界
+
+本轮局部修复使用宿主注册、诊断和取证测试，以及仓库映射所要求的本地检查。更新 dist 只代表生成源码产物；旧 0.5.2 制品和已加载插件不变。0.5.3 的 CI、冻结制品、双平台隔离原生验收和公开发布已独立完成，具体范围见验收记录；日常环境安装不在这些结果之内。
+
+0.6.0 的确定性证据包括仓库完整矩阵（typecheck、lint、vitest、release-pack、stats、build、pack:check、文档 audit 及其单测、`git diff --check` 与 dist 一致性）。它不包含原生平台验收：候选尚未冻结为精确制品，也尚未在 macOS/Windows 的 Web 与 Headless 上运行。Codex 本轮仅新增问题与设计文档，不修改其运行时；上游没有新增可用于镜像的 v2 规范或 fixture。

package/docs/PORTING_NOTES.md

@@ -15,9 +15,9 @@ fixtures and an explicit delta ledger.
 | portable protocol and digest fixtures | Mirror exact upstream bytes and verify their hashes |
 | product-specific or newer Codex behavior | Record explicitly in the delta ledger before porting |
 
-## Current host boundary (0.5.2)
+## Current host boundary (0.6.0)
 
-Version 0.5.2 admits exactly DSH `0.1.5-rc.2` and `0.1.5-rc.1` and keeps no path back to the
+Version 0.6.0 admits exactly DSH `0.1.5-rc.2` and `0.1.5-rc.1` and keeps no path back to the
 older host or ahead to an unregistered host. Concretely:
 
 - Session history is read only through the DSH Session V3 `snapshotEvents()`
@@ -37,6 +37,40 @@ and rc.2 latest cohorts are registry-derived, and that
 provenance is bound into the host-lock digest rather than inferred from a
 version number.
 
+
+## 0.6.0 shared-semantics port
+
+The 0.6.0 line implements the C01–C12 contract from the shared DSH 0.6.0 /
+Codex 0.14.0 plan. What was ported as shared semantics, and what was deliberately
+replaced with a DSH-native mechanism:
+
+| Shared requirement | DSH treatment |
+| --- | --- |
+| Root-input spans and coverage | Implemented over the original message bytes with `TextEncoder`, so offsets are UTF-8 byte offsets — never UTF-16 string indices |
+| One interpretation view and one open set | Implemented as pure domain modules (`closure.ts`, `diagnostics.ts`); Codex's ledger is not copied |
+| Trusted answer delivery | Bound to the DSH host's own `assistant/message` / `turn/end` structure; Codex maps the same criterion onto its own events |
+| Work units with required descendants | Units are derived from the DSH message stream and are never persisted; Codex keeps its own work-unit state |
+| Trusted user selection | Read from paired `tool/call` + `tool/result` round-trips of the host's question tool; the tool names are an audited cohort surface |
+| Proof capability matrix | Shared kinds and subject/source/operation binding; the host surfaces are DSH-native (`native_read`, `shell`, `web`, `jobs`, `subagent`, `visual_capture`) |
+| Explicit release tickets | A DSH-native reservation/settlement record in the plugin-notice channel plus a gate inside the Guard-owned action tool; Codex reuses its own release adapter and `PreToolUse` hook |
+| Reason classes and migration report | Shared seven-class vocabulary and rule-set semantics; the record shapes are DSH-native |
+
+Three porting decisions are worth stating explicitly, because the obvious
+alternative would have been wrong:
+
+- **No new session event types.** Delivery, units, selections, and approvals are
+  derived facts. Only the release contract, reservation, and settlement need
+  durable records, and those ride the plugin-notice `user/message` channel the
+  host already persists and reloads.
+- **The v1 proof manifest and digest domains are frozen.** The v2 kinds live in
+  a new domain (`ccg.proofManifest.v2`), so an old record is read by the old
+  rules and no golden vector changes. A port that widened `ccg.proofManifest.v1`
+  would have silently rewritten another repository's parity contract.
+- **Delegation is not a parent completion.** A subagent's result is recorded and
+  marked bounded. This is deliberately weaker than treating a successful
+  delegation as evidence, because the parent task's own work is not what the
+  subagent did.
+
 The DSH port derives guard state from native DSH session events, connects the
 completion gate to Goal handling, and fails closed when it cannot verify the
 host or evidence. Version 0.3.2 has passed same-package Web and Headless

package/docs/SEMANTIC_COMPATIBILITY.md

@@ -156,6 +156,129 @@ The 0.4.2 release retained these exact mirrored fixtures and the recorded upstre
 
 The 0.4.3 core policy changes DSH-specific manifest values, not the shared digest-v3 encoding or byte-mirrored fixtures. Core manifest version 2 and `dsh-core/v1` produce a fresh identity after actual-graph inspection. Legacy cohorts remain historical inputs. Market service adapter `context-guard.service.v2` uses version `2.0.0`; old restart credentials cannot become new-instance credentials. Package apply remains a disk-state operation, and unavailable restart work remains pending.
 
+## 0.6.0 shared contract status (2026-09-14)
+
+Version 0.6.0 implements the C01–C12 contract that the DSH 0.6.0 development
+plan shares with a planned Codex Context Guard 0.14.0. The table below states
+what this repository actually implements and which part of it is proven by
+production-chain tests. It is not a parity claim: the two products still have
+separate runtimes, persistence, lifecycle, and scheduling, and the shared
+artifacts are not mirrored (see below).
+
+| Contract | DSH 0.6.0 implementation | Production-chain evidence |
+| --- | --- | --- |
+| C01 source spans | UTF-8 byte half-open spans of the original root text, bound to the message digest; per-message coverage records | `tests/domain/v060-bounded-choice-spans.test.ts` |
+| C02 one interpretation | Four semantic slots plus a coverage view; the open set has one implementation in `domain/closure.ts` | `tests/domain/v050-diagnosis.test.ts`, `v060-portable-v2.test.ts` |
+| C03 delivery | Trusted delivery over the host's own turn structure, separate from execution certification | `tests/domain/v060-units-delivery.test.ts`, S01/S02/S08 cases |
+| C04 units and closure | Derived units, delegation lineage, required descendants, ancestor constraints, and a v2 unit-closure certificate | `tests/domain/v060-unit-closure.test.ts`, `v030-certificate.test.ts` |
+| C05 conditions and Stop | Per-action conditions and immediate-work judgement; unchanged waiting and bounded-correction budgets | `tests/domain/v051-wait-lifecycle.test.ts`, `v051-goal-lifecycle-composed.test.ts` |
+| C06 responsibility tiers | `standard` / `strict` / `release`, orthogonal to activation; strict demands the proof the user asked for and adds no ordinary approval | `tests/domain/v060-strict-policy.test.ts` |
+| C07 targets and identity | Trusted question round-trips, bounded file choice, path/type scope, separate sandbox approvals | `tests/domain/v060-selection-clarification.test.ts`, `v051-target-identity.test.ts` |
+| C08 clarification | Atomic verbatim supersession with both revisions kept; evidence invalidation only on a real change | `tests/domain/v060-selection-clarification.test.ts` |
+| C09 proof | v2 manifest, capability matrix, subject/source/operation binding, explicit unavailability; a presented proof is persisted with the checkpoint call and re-bound at replay, so a tampered or omitted proof cannot restore a certificate | `tests/domain/v060-proof-v2.test.ts`, `v060-proof-production-chain.test.ts` |
+| C10 explicit release | Contracts (with the candidate revision AND the closure certificate's identity frozen at adoption), reservations carrying the observed SRI, reconciled settlements, named candidate identities read from trusted producers, a callable trusted recovery entry, pre-effect refusals, and an honest coverage surface | `tests/domain/v060-release-migration.test.ts`, `tests/tools/v060-release-chain.test.ts`, `tests/tools/evidence.test.ts` |
+| C11 fresh projection | Every public read/control entry flushes, re-snapshots, and re-derives; a failed flush reports unavailability | `tests/tools/prepare-fresh-projection.test.ts`, `tests/flush.test.ts` |
+| C12 migration and diagnosis | Seven-class reason mapping, rule-set report, preserved identities, rollback precondition | `tests/domain/v060-release-migration.test.ts`, `v042-recovery-migration.test.ts` |
+
+### Scope rulings and protocol difference table (2026-09-14)
+
+A concentrated review of the `0dce898` candidate found eight defect families and
+asked for two scope decisions. Both were decided by the coordinator on
+2026-09-14 and are recorded here as facts, not as a parity claim:
+
+1. **The v2 fixture stays a DSH-authored candidate; cross-language parity stays
+   open.** The upstream has not frozen a v2 specification, so the shared gate is
+   recorded as a cross-repository pending item owned by `codex-context-guard`.
+   Nothing here claims C01–C12 alignment with that product.
+2. **The release profile's protectable surface is `npm_publish` only.** The
+   `git_tag` and GitHub Release operations are reported as
+   `release_operation_unrouted` with `attribution: scope_reduction` — the gap is
+   the missing Guard-owned route, which a later release can add — and only a
+   composite runner is reported as an opaque host boundary. The coverage table
+   is machine-readable precisely so this distinction cannot be flattened into
+   "the host does not support it".
+
+| Difference | Value here | Reason |
+| --- | --- | --- |
+| Action manifest version | stays `1` | The new preparation fields live in the `actionPreparation()` descriptor (plugin output), not in `ActionSpec`; no shipped manifest byte changed. |
+| Boundary protocol | stays `1` | No unit-attribution field was needed; adding one would change every boundary digest without adding a guarantee. |
+| Release `ref` observability | a contract that declares `ref` requires an observed ref | `npm_publish` observes the tgz and, when the contract names a ref, the local repository's own answer; a declared-but-unobserved `ref` is refused as unresolved rather than skipped. |
+| Release artifact identity | three named identities, never conflated | The commit (`gitHead`), the byte SHA-256 and the npm SRI are different facts; the legacy `artifactDigest` alias is split by its own shape. |
+| `git_tag` / GitHub Release / composite runner | refused before any effect | Approved scope reduction for the first two (no Guard route yet); opaque host boundary for the third. |
+
+### P0 deviation record (2026-09-14)
+
+The P0 specification's identity table assigned new protocol numbers to every
+surface it lists. Two of them are deliberately NOT changed here, and recording
+that is more honest than bumping a version without a semantic change:
+
+| P0 item | P0 value | 0.6.0 actual | Reason |
+| --- | --- | --- | --- |
+| Action manifest version | `2` | stays `1` | The new action description fields live in the `actionPreparation()` descriptor, which is plugin output generated per action, not an added `ActionSpec` wire field. The shipped `manifests/action-manifest.v1.json` is byte-aligned with `ACTION_MANIFEST.actions` by a test, and no field of it changed. Bumping the number alone would create a new identity for identical bytes and invalidate a mirror for nothing. |
+| Boundary protocol | `2` | stays `1` | The planned "unit attribution" fields were not needed: a boundary already names the exact obligations it covers through `qualificationIds`, and C04's closure never consults boundary ownership. Adding a field would change every boundary candidate digest and break old-boundary replay without buying a semantic guarantee, so the record shape is unchanged. |
+
+Everything else in the P0 identity table is implemented as specified: the
+`v5.0.0` session boundary, Stop protocol `3.0.0`, certificate version `2`,
+proof protocol `0.6.0` in the new `ccg.proofManifest.v2` domain, the
+`ccg.certificationDigest.v4` field table, unchanged adapter identities, and the
+three new release-record prefixes. Every v3 digest domain and the 29 mirrored
+golden vectors are byte-identical.
+
+### Unfinished shared artifacts
+
+Two shared artifacts are deliberately incomplete, and neither is described here
+as done:
+
+- **The v2 fixture is a DSH-authored candidate, not a mirror.** The upstream
+  repository `GreenLv/codex-context-guard` was at
+  `ce667adefd716f829fb1fb070b3089e789ed74c3` with no frozen v2 fixture when this
+  candidate was prepared (verified by a live `ls-remote` read of `refs/heads/main`,
+  and by the local checkout's contents). `tests/fixtures/conformance/context_guard_semantics_v2.candidate.json`
+  therefore carries `fixtureVersion: 2.0.0-candidate.1` and `status:
+  "dsh-candidate"`, and a test asserts that identity. `UPSTREAM_PIN.json` still
+  pins only the unchanged v1 mirrors and is not refreshed by this release.
+- **Cross-language parity is not established.** The Python and TypeScript
+  projections have not been compared on the v2 input family, because the
+  reference implementation for that family does not exist upstream yet. The
+  digest-v3 vectors remain the only byte-level cross-language agreement
+  evidence, and they are unchanged.
+
+The consequence is stated plainly: this repository does not claim "C01–C12
+core alignment" with Codex Context Guard. It claims that its own C01–C12
+implementation is present and covered by production-chain tests, and that the
+shared spec/fixture freeze, the mirror, and the cross-language comparison are
+open items owned by the upstream.
+
+## S01–S12 coverage in this repository
+
+The v2 candidate carries 25 cases across every family. Each case runs through
+the production derive/delivery/closure/Goal chains, and the runner computes its
+actual values from the events and the projection only — it never reads an
+expectation to decide a result, and it has no branch on a case id or family.
+Coverage by family:
+
+| Family | Cases |
+| --- | --- |
+| S01 delivered questions | delivered question closes; execution with a trailing question stays open |
+| S02 same-prefix variants | execution tail stays open; negation keeps the constraint |
+| S03 update/modify objects | document update becomes a bounded modify; a non-file object stays honestly unresolved |
+| S04 conditions | conditional wait stays pending; a future-tense push stays evidence-gated |
+| S05 first step | the persisted requirement is stable across messages |
+| S06 trusted selection | the paired directory answer and the separate approval record |
+| S07 clarification | verbatim refinement supersedes; an independent task switches unit |
+| S08 delivery and delegation | aborted turn never delivers; delegation opens a required descendant; the Goal gate demands a certificate |
+| S09 proof | requested visual proof cannot be faked; a readback obligation stays open |
+| S10 policy | release and strict never block ordinary work; the tier does not imply a contract |
+| S11 release | no contract, unprotectable adoption, in-flight operation, and consumed ticket |
+| S12 migration | a legacy session and a v5 session each report their own rule set |
+
+Negative coverage lives beside it: the independence suite corrupts every
+expectation field and asserts that the actual result is unchanged while the
+comparison reports the mismatch, and separately detects wrong interpretation,
+closure, delivery count, turn binding, delivery surface, open items, reason
+codes, goal gate, correction, selection/approval/supersession counters, reason
+classes, release state, and migration facts.
+
 ## Validation boundaries
 
 - `pnpm install --frozen-lockfile && pnpm typecheck && pnpm test && pnpm

package/docs/distribution.md

@@ -25,12 +25,14 @@ version and annotated tag are retained for audit history; the npm version is
 deprecated with `Release metadata incomplete; use dsh-completion-guard@0.3.1.`
 Version 0.3.1 repairs the provenance-bearing frozen-package workflow.
 
-## Published v0.5.1 destinations (2026-09-11)
+## Published v0.5.2 destinations (2026-09-11)
 
-1. [GitHub Release `v0.5.1`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1) is a non-draft, non-prerelease release. Its annotated tag identifies commit `aefdeaf2737ef1c99f1170085140c93a515e1125`.
-2. [`dsh-completion-guard@0.5.1` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.1) is published and `latest` resolves to `0.5.1`. Its `gitHead` equals that release commit. The registry download and Release tgz match SHA-256 `5e00ddf2f9772b1ae2ca3665d7c4ce858b814dc26a4116388082db2d625da28d`.
+1. [GitHub Release `v0.5.2`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.2) is a non-draft, non-prerelease release named `DSH Completion Guard 0.5.2`. Its annotated tag identifies commit `e8b21b3d0bb5b3864c856cc9ea6bd19d5ab066ef`.
+2. [`dsh-completion-guard@0.5.2` on npm](https://www.npmjs.com/package/dsh-completion-guard/v/0.5.2) is published and `latest` resolves to `0.5.2`. Its `gitHead` equals that release commit. The registry download and Release tgz match SHA-256 `d975f17dc3bfed999cbe6c0e638b226c3dcf8651f288ea7ab83faa5ba7903d31`. The public package exposes `0.1.5-rc.2 || 0.1.5-rc.1` in both DSH engine fields and all seven DSH peer dependencies.
 3. All seven Release attachments were downloaded and matched the accepted files. The separate macOS and Windows annexes each record 28 required gates passed on DSH `0.1.5-rc.2`, with real-model requests skipped. See [acceptance details](LOCAL_ACCEPTANCE.md).
 
+Version 0.5.1 remains available as an immutable historical release.
+
 ## Historical v0.4.0 destinations
 
 1. [GitHub Release `v0.4.0`](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.4.0)