dsh-completion-guard 0.5.3 → 0.6.1

package/docs/WINDOWS_0_6_0_REPAIR_PLAN.md

@@ -0,0 +1,92 @@
+# Windows 真实会话复核与 0.6.1 修复计划
+
+日期：2026-09-15。状态：W060-01–05 的实现与本地确定性验证已随 0.6.1 源候选完成（2026-09-15，见 CHANGELOG 与 LOCAL_ACCEPTANCE 对应小节）；本页保留复核结果与修复合同作为规划依据。跨主机/精确制品验收与发布属于后续独立阶段，本页不宣称其结果。
+
+## 结论与版本
+
+0.6.0 需要后续修复。主要缺陷不是准备工具再次返回非法 JSON，也不是全部问答交付失效，而是解释结果、附件义务与诊断投影之间存在语义断层。应修复统一解释和状态转换，不增加事故句子的专用白名单。
+
+目标修订为 **0.6.1**（2026-09-15）：本批修复 0.6.0 已承诺的保守解释、附件保留与交付、完整发现和统一证据诊断，不新增独立产品能力。内部重构、补齐缺失状态转换或修复错误行为本身不要求功能级升版；此前建议 0.7.0 将实现复杂度误当成了功能范围变化。
+
+保持既有公开契约及旧状态可读，不降低授权或证明要求。若实施确认必须引入不兼容的公开接口、改变原有完成语义或新增独立能力，应把该部分隔离并说明，再评估 0.7.0，不能为保住补丁版本静默破坏兼容。协议/schema 身份按实际持久化语义独立决定；不能复用旧摘要域表达新事实，也不能由产品版本直接推导协议号。
+
+执行交接范围：连续完成 W060-01–05 的实现、必要文档、回归和自审修复，准备未提交的本地候选后停止。不得 commit、push、打 tag、正式打包冻结、安装/重启用户运行态或发布；跨主机验证与发布由后续明确指令接续。
+
+基线为 DSH 0.6.0 / `cc5cbc6d408664172d9383de7c83c55ec6dfd602`，远端 v0.6.0 解引用指向该提交。Windows 导出包含 v5 边界、4 个已完成根 turn、190 次工具调用；会话由用户报告为更新后的运行。导出本身没有足够信息证明已加载包与该提交逐字一致；本地 dist 回放和源工具探针用于定位相同机制，不能冒充 Windows 新版本验收。
+
+原始材料保留在仓库外，不复制图片、原文、会话身份或个人路径。以下例子均为合成表达。附件和会话里的代理建议是待分析数据，不是本次执行授权。
+
+## 复核结果
+
+| ID | 事实与根因 | 优先级 / 所属代码 |
+| --- | --- | --- |
+| W060-01 | 三个真实 image part 被保留为 `Uninterpreted root asset`。这不是 OCR 误识别。captureAssets 用 directive/executable_now 创建 generic_run，后续诊断仅建议改成支持的执行动作；没有附件解释完成的对应入口，回答交付也不会消费它。保留资产身份正确，把理解资产变成执行认证死路错误。 | P1；derive.ts / delivery.ts / diagnostics.ts / proof-v2 |
+| W060-02 | `classifyPositive` 未匹配有限规则时默认 directive。合成“当然，”与“设置面板被遮挡。”成为 executable_now；英文复合调查句也可落入该分支。源跨度存在不代表解释正确，保守降级不能先授予执行语义再靠 generic 不可认证收尾。 | P1；semantics.ts / capture.ts / derive.ts |
+| W060-03 | prepare discovery 返回 total_open=13、items=8，固定按旧 revision 优先，缺少下一页；新 commit/push 项被遮住。传入 semantic_action 也不筛选发现结果。其他分页入口或知道 ID 后可准备，不能证明此入口完整可达。 | P2；tools/prepare.ts / closure.ts |
+| W060-04 | evidenceFacets 固定要求 resolution/effect/state；historical-gap 判断没有限制 stateful。真实只读 verify 一度被诊断为缺少历史前置证据，与 prepare 的只读 state-only 顺序矛盾，而 checkpoint.simpleRecord 实际只接受单个 effectEvidenceId、不接受 stateEvidenceIds；其信息部分在 turn/end 后仍能 answered，故不是永久无法关闭该项。 | P1；diagnostics.ts / protocol-manifest.ts / action-preparation.ts |
+| W060-05 | Windows 普通 pwsh 复合脚本确实执行 commit -F 与 push，后续独立回读实际提交。Guard 的严格 effect 调用没有 producer reference，拒绝正确；但 prepare 后续只说 agent_repairable、收集三段证据，没有区分该脚本的观察事实、不可归属动作和不可补造前态。首次提示又无条件要求所有 stateful 先走 Guard。 | P1；lifecycle.ts / evidence.ts / diagnostics.ts / policy 接线 |
+
+最后一次回放仍有 13 个 pending，且 R006/R010 已 answered。因此“0.6.0 完全没有交付能力”不成立。未发现此次出现 prepare 输出非法 JSON。无根用户显式延后资格时，boundary 返回空 available_qualifications 并拒绝 deferred 属正常保护，不应伪造资格、放宽验证或作为独立 bug 登记。
+
+会话仍属于同一相关任务链，不能仅因旧条目多就宣布工作单元实现错误，也不能把整段调查工具耗时算作 Guard 自旋。根问题是错误条目持续进入该闭包。普通 shell 的权限/凭据受限与插件语义问题分开处理；本次不重试现场修改、提交或推送。
+
+## 统一修复合同
+
+### P0：解释和能力合同先于工具补丁
+
+1. 原始输入与解释记录分离。输入保存完整跨度/资产身份；解释记录明确 information、execution、constraint、unresolved，以及来源、owner、条件和关联。连接成分与背景叙述作为 coverage 中的上下文片段，不自行生成执行义务。不能靠标点切成的单片段丢失支配关系。
+2. 未证明是指令的片段不得默认 executable_now。可以接受模型提出的结构化解释候选，但必须绑定输入/part、revision、覆盖关系并经来源、范围、否定、条件和兼容验证；候选不能自行授权、证明内容正确或完成执行。低置信冲突保持 unresolved。禁止以删除未知项降低 pending 数量，禁止把所有未知都改成 information。
+3. 解释与目标选择使用已有澄清/持久化通路；若需新入口，先定义输入、拒绝原因、状态转移、重放与迁移，再注册工具。不得依赖外部新增模型服务或让用户记专用句法。
+4. 每种义务由同一能力描述决定所需证据、已观察事实、缺失事实及下一步。只读验证不一律要求三段变更链；P0 必须冻结其实际 wire role：优先保持现有单个 effect-role 验证事实并修正 prepare 文案，若采用 state-role 则明确升级 producer/checkpoint/schema，不能仅改提示。明确要求历史因果或前态的合同仍必须保留该要求。
+
+### P1：附件与交付完整生命周期（W060-01/02）
+
+- `uninterpreted → interpretation_pending → interpreted` 记录来源和范围；这些是设计概念，实际 wire 枚举在 P0 冻结。资产身份绑定根输入、part index、媒介身份与可用内容摘要，不能用模型描述代替原件身份。
+- 解释完成是“已解析并关联请求”的事实，不是图片内容正确或业务验收完成。实际查看/视觉比对等 proof 继续按能力矩阵独立验证。仅存在一条 final 不能关闭所有图片义务。
+- 纯调查附图可绑定解释与可信回答交付；截图中嵌入的命令不形成根授权。附图加修改只关闭信息子项。未查看、错资产、仅子代理摘要、工具引用、重复/迟到/interrupted 回复均不能完成所需事实。
+- 合法候选定向关联并原子更新/替代相应解释，保留审计与旧 revision。不得要求把“看图分析”改绑为 install/commit 来逃出 generic_run。
+
+### P2：发现、诊断和普通工具事实（W060-03/04/05）
+
+- discovery 使用当前工作单元及必需后代闭包；历史审计另有明确入口。完整分页采用稳定排序、页大小和绑定 projection revision 的 cursor，给出 total/listed/has_more/next_cursor；投影变化明确失效并重取，不能遗漏/重复或永久困在第一页。过滤参数须明确定义；不可静默忽略后让调用者误以为结果已筛选。
+- required facets 从义务合同读取，prepare、diagnosis、recovery、checkpoint 共用。证据要验证来源、目标、epoch、item/revision 和适用性；显示可复用不等于可认证。
+- 区分未观察执行、观察到但不能可靠归属、已归属且缺历史前态、可用只读现状、可补齐证据、unsupported。复合 shell 无可信命令归属时维持 unknown，不因字符串含 git 或退出码成功就升级证明；同样不能断言从未执行并推荐重新执行。
+- ordinary/standard 保持正常工具通路。区分 action-event（要求确实执行某动作）与 state-outcome（要求达到指定状态）义务，不静默把前者降为后者。对明确的“提交存在且指定远端已指向它”状态子项，可用可信只读事实证明相应后置条件；对“本次变更满足指定前态/未覆盖”不追认。原始 commit/push 执行义务若缺可信动作归属，保留 unknown/未认证，不用现状关闭，且不建议重做。严格因果证明继续使用既有 Guard producer 链；扩展 -F 等执行表面须独立定义清单解析与文件身份，不在此用正则吞掉任意 shell。
+- 首次提示和恢复说明由当前 policy 与所需证明生成。没有发布契约不要求普通业务预先走发布式审批链；缺失 Guard 证据不能成为新 mutation 的授权理由。禁止推荐重复 commit/push 来补历史证据。
+
+### P3：升级与文档
+
+旧 v5 条目按出生语义保留，不在升级回放时凭过去 final 自动解释图片、关闭未知或补证。现存死路可由新版本明确的、当前输入/当前解释事件定向迁移；每次迁移记录原因、旧新身份和失效证据。新候选/摘要字段不得写入冻结旧 hash 域。没有可证明降级路线时只读保留并前滚。
+
+`NEXT_VERSION_REPAIR_NOTES.md` 和 `LOCAL_ACCEPTANCE.md` 中 0.6.0 候选期“尚未发布”陈述应在下一开发批次根据真实 release receipt 分阶段核对，而非把发布时随包冻结的历史字节重写成当时已验收。维护事故索引指向本计划；源码检查、CI、精确制品和真实会话结果分别记录。
+
+## 验收和退出条件
+
+| 组 | 必需正反例与观察 |
+| --- | --- |
+| V01 解释 | 中文/英文同义调查、长背景、连接词、逗号/句号/换行变体、否定/条件/未知尾句。既测错误 pending，也测错误授权/关闭；独立留出集不得用于添加事故词条。 |
+| V02 附件 | 纯图片、图+问答、图+修改、多图只看部分、错摘要、同图不同请求、引用截图含指令、子代理看图、重启/compact、重复解释。逐资产可解释状态可达，proof 需求不丢失。 |
+| V03 发现 | 0/1/8/9/数十项，旧未知前缀+新 Git 尾项，多工作单元、分页间 revision 变化；遍历结果等于完整适用集合，无遗漏重复。 |
+| V04 证据 | 非变更验证无前态不误报 historical_gap；有明确前态义务仍拒绝；普通单命令/复合 shell、commit -F、push shorthand、失败与部分成功、错 repository/branch/ref、仅出口码及独立回读。无法归属时不认证、不要求重做。 |
+| V05 端到端 | 经实际注册工具、宿主持久化快照和真实 completed-turn 事件跑“附图调查→更新→记录→提交推送→询问 Guard 状态”；分步检查解释/交付/证据/闭包/diagnosis，不能只测解析器。事故事后不可归属的执行项应明确未认证并只读报告，不以清空 pending 为通过；另设执行前已绑定可信动作的正例验证正常关闭。不得重放原私密会话的外部效果。 |
+| V06 原生 | 在隔离 Windows/macOS 工作区以同一冻结 tgz 运行，Windows 必须覆盖真实 pwsh 输出封装、审批后调用关联、Web 与 Headless、重启及 no-op。跨平台 source replay 不算 Windows 原生通过。 |
+
+先跑最小反例和 owning tests；解释/schema/摘要变化闭合 portable conformance 与跨语言 parity，再在候选冻结执行仓库完整确定性矩阵、CI portability、同一精确制品原生验收。沿用已确认相同输入的证据，不因阶段转换重跑无关检查。
+
+P0 合同、来源/状态/版本/平台可实施性复核无 P1 后实施 P1/P2；发布退出必须全部 W060-01–05 的正负例和原生链通过，不能以整体测试数量代替事故 oracle。发布不在本次规划操作范围内。已有 git_tag/GitHub Release producer 路由缺口仍独立在 backlog，不捆绑本次修复。
+
+## Codex 0.14.0 对齐
+
+Codex 的 C01/C02/C03 已覆盖来源、保守解释和交付，C04 覆盖闭包，C06/C08/C09/C12 已覆盖普通证据、历史缺口、能力和统一诊断；不复制这些任务，不将 DSH 源缺陷记成 Codex 已复现缺陷。
+
+仅补充两个原计划未明确的验收合同：附件解释有可达且独立于执行认证的状态转移；有界发现/恢复页必须能遍历完整适用集合并处理 revision 变化。分别归入 CG14-01/02/04 和 CG14-04/06，不另建竞争路线图。跨语言 fixture 仍绑定精确上游身份；DSH 候选不是已完成 parity。
+
+## 本次证据边界
+
+本地对基线 dist 的真实导出只读回放确认两项 answered、十三项 pending，并复现源 prepare 的 8/13 发现结果。11 条事故断言通过意味着缺陷得到复现，不是修复通过。Windows 导出仅用于观察；当前没有新修复运行时、未重启用户 DSH、未重复执行现场业务动作。
+
+## 仓库整理结果（2026-09-15）
+
+旧分支 `codex/0.5.1-cross-platform` 的全部提交已在 main 中，远端没有开放 PR，源码/工作流不依赖该分支；本地及远端引用已删除，删除前身份为 `aefdeaf2737ef1c99f1170085140c93a515e1125`，历史仍可由 main 追溯，无需制造空合并。
+
+0.5.3 与 0.6.0 两个 detached 安装源工作树均干净，无未跟踪/忽略资产、独有提交、已发现的进程 cwd、任务 cwd 或运行时链接依赖，已移除。对应发布标签保留，可按原提交重建。`main` 和 `stats` 保留；后者由 npm-download-stats 工作流持续读取和更新，不应合并进产品主线或删除。

package/docs/upstream-deltas.json

@@ -1,22 +1,28 @@
 {
   "ledgerVersion": "2",
   "description": "Current, evidence-bounded delta ledger for behavior shared between codex-context-guard and dsh-completion-guard. It separates aligned behavior, partial host-native equivalents, missing shared behavior, and Codex-only lifecycle features.",
-  "updatedAt": "2026-09-10",
+  "updatedAt": "2026-09-14",
   "source": {
     "product": "codex-context-guard",
-    "currentRelease": "v0.11.0",
-    "currentReleaseHead": "558612b02826fab1e2ccb1e36f1a4e2c36caf2fd",
-    "alignedReference": "v0.10.0",
-    "alignedReferenceHead": "e4fccf690bcbc2be79d0b8d42a1a269f87072120"
+    "currentRelease": "v0.13.9",
+    "currentReleaseHead": "1575c41d318b4c348387532110526f4a63801f07",
+    "alignedReference": "v0.10.0 (historical evidence alignment)",
+    "alignedReferenceHead": "e4fccf690bcbc2be79d0b8d42a1a269f87072120",
+    "sharedPlanTarget": "codex-context-guard v0.14.0 (not implemented upstream)",
+    "upstreamMainAtAudit": {
+      "commit": "ce667adefd716f829fb1fb070b3089e789ed74c3",
+      "verifiedBy": "live `git ls-remote origin refs/heads/main` on 2026-09-14 plus the local checkout contents",
+      "canonicalV2Fixture": "absent: the upstream tree contains only context_guard_semantics_v1.{json,schema.json} and digest_v3"
+    }
   },
   "target": {
     "product": "dsh-completion-guard",
-    "currentRelease": "v0.5.1",
-    "currentReleaseHead": "uncommitted candidate on 09df9ecfdc94d7880ddabb37774e626486aca972",
+    "currentRelease": "v0.6.0",
+    "currentReleaseHead": "not recorded here: the 0.6.0 source candidate is not yet frozen into an artifact, so no commit SHA is asserted in this ledger",
     "implementationBaseline": "ffc6fe9e1246a815f0bb630943c59d14b6505716",
-    "host": "DSH 0.1.5-rc.1 / Cordis 4.0.2 (registry-derived cohort; native audit pending)"
+    "host": "DSH 0.1.5-rc.2 || 0.1.5-rc.1 / Cordis 4.0.2 (registry-derived cohort; native audit pending for 0.6.0)"
   },
-  "alignmentClaim": "DSH 0.4.0 aligns the named evidence and proof obligations with Codex 0.10.0. It does not claim full product parity and does not include all Codex 0.11.0 changes.",
+  "alignmentClaim": "DSH 0.6.0 implements the C01-C12 shared contract of the paired 0.6.0/0.14.0 plans and covers it with production-chain tests. It does NOT claim core alignment with Codex Context Guard: the v2 conformance fixture exists only as a DSH-authored candidate because the upstream has not landed a frozen v2 specification, so the canonical mirror and the cross-language parity comparison remain open. The v1 fixtures, the digest-v3 vectors, and the frozen digest domains are unchanged.",
   "dispositions": [
     "aligned",
     "partial-equivalent",
@@ -139,6 +145,81 @@
         "tests/domain/portable-semantics.test.ts",
         "tests/domain/v051-dsh015-adaptation.test.ts"
       ]
+    },
+    {
+      "capability": "trusted-answer-delivery",
+      "introducedBy": "shared C03 (0.6.0 / 0.14.0 plan)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.0",
+      "plainLanguage": "A question or explanation is closed only by the host's own record of a normally completed turn whose final assistant message was not interrupted; delivery never implies correctness or execution.",
+      "implementation": "domain/delivery.ts derives the fact from assistant/message + turn/end; deriveProjection applies it to information-slot items of that turn's owning unit and its delegated sub-units.",
+      "tests": [
+        "tests/domain/v060-units-delivery.test.ts",
+        "tests/domain/v060-portable-v2.test.ts"
+      ]
+    },
+    {
+      "capability": "work-unit-required-descendant-closure",
+      "introducedBy": "shared C04 (0.6.0 / 0.14.0 plan)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.0",
+      "plainLanguage": "Tasks are grouped into derived units; a delegated child unit's open work is required by the parent's closure, a sibling switch never blocks the newer task, and an ancestor's prohibition or unsatisfied condition still governs a descendant's matching action.",
+      "implementation": "domain/work-unit.ts derives the lineage; domain/closure.ts owns the closure, the ancestor constraints, and the certifier's pre-evidence refusal. Units are derived, never persisted.",
+      "tests": [
+        "tests/domain/v060-unit-closure.test.ts",
+        "tests/domain/v030-certificate.test.ts"
+      ]
+    },
+    {
+      "capability": "proof-capability-matrix-v2",
+      "introducedBy": "shared C09 (0.6.0 / 0.14.0 plan)",
+      "disposition": "partial-equivalent",
+      "targetRelease": "dsh-completion-guard v0.6.0",
+      "plainLanguage": "Five new proof kinds bind a current subject, a declared source, and a real operation. Tool success is only an execution fact, a visual readback needs an actual read, and a cohort with no producer reports unavailability instead of passing.",
+      "implementation": "domain/proof.ts adds the v2 manifest in the new ccg.proofManifest.v2 domain and a capability matrix over DSH host surfaces. There is no Codex-side v2 counterpart yet, so the shared vocabulary is only frozen on the DSH side.",
+      "tests": [
+        "tests/domain/v060-proof-v2.test.ts",
+        "tests/domain/v060-strict-policy.test.ts"
+      ],
+      "dshOnlyReason": "The upstream Python implementation has not been extended with the v2 kinds; the shared fixture that would pin them does not exist upstream."
+    },
+    {
+      "capability": "explicit-release-single-use-ticket",
+      "introducedBy": "shared C10 (0.6.0 / 0.14.0 plan)",
+      "disposition": "partial-equivalent",
+      "targetRelease": "dsh-completion-guard v0.6.0",
+      "plainLanguage": "A release contract is adopted only by an explicit root command; each operation spends one reservation written before the effect and settled afterwards from a trusted readback; wrong candidate, wrong ref, expiry, consumption, replay, in-flight retries, unresolved targets and opaque runners are refused before any effect.",
+      "implementation": "domain/release.ts holds the state machine; the runtime persists contracts, reservations and settlements through the plugin-notice channel; the Guard-owned action tool consults the gate before its first probe. Only npm_publish has a Guard execution surface, so the coverage report marks the other five categories unprotectable.",
+      "tests": [
+        "tests/domain/v060-release-migration.test.ts",
+        "tests/tools/evidence.test.ts"
+      ],
+      "dshOnlyReason": "Codex reuses its own release adapter and PreToolUse hook; the DSH record shapes and the protectable surface set are host-specific and are deliberately not claimed to be equivalent."
+    },
+    {
+      "capability": "unified-reason-classes-and-migration-report",
+      "introducedBy": "shared C12 (0.6.0 / 0.14.0 plan)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.0",
+      "plainLanguage": "Every diagnosis carries one of seven frozen classes beside its exact reason code, and the session reports which rule set is in force, which obligations keep their pre-0.6.0 rules, and what a rollback requires.",
+      "implementation": "domain/reason-class.ts holds the mapping table; domain/diagnostics.ts attaches the class; domain/migration.ts states the rule set, preserved domains, and the snapshot precondition.",
+      "tests": [
+        "tests/domain/v060-release-migration.test.ts",
+        "tests/domain/v050-diagnosis.test.ts"
+      ]
+    },
+    {
+      "capability": "shared-v2-fixture-freeze-and-cross-language-parity",
+      "introducedBy": "shared P0 plan section 4/5 (0.6.0 / 0.14.0 plan)",
+      "disposition": "not-implemented",
+      "targetRelease": "open",
+      "plainLanguage": "The platform-neutral v2 conformance fixture is not frozen upstream, so this repository ships a DSH-authored candidate instead of a byte mirror and has not compared the Python and TypeScript projections on the v2 input family.",
+      "implementation": "tests/fixtures/conformance/context_guard_semantics_v2.candidate.json declares fixtureVersion 2.0.0-candidate.1 and status dsh-candidate; UPSTREAM_PIN.json still pins only the unchanged v1 mirrors.",
+      "tests": [
+        "tests/domain/v060-portable-v2.test.ts",
+        "tests/domain/v060-v2-runner-independence.test.ts"
+      ],
+      "dshOnlyReason": "Only the upstream repository can land the canonical v2 specification, schema and reference projection. Until it does, mirroring and parity cannot be established honestly."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-completion-guard",
-  "version": "0.5.3",
+  "version": "0.6.1",
   "description": "A task-contract and completion-certification layer for DeepSeek Harness.",
   "repository": {
     "type": "git",
@@ -113,5 +113,5 @@
     "hooks",
     "typescript"
   ],
-  "gitHead": "a7baccdfbc538aa071941ebb36aa41fa9bf6e709"
+  "gitHead": "d11009d8f755ecee7d288cff18250c7b372cfd2a"
 }