dsh-completion-guard 0.6.2 → 0.6.3

package/docs/REVIEW_0_6_2_CORE_ALIGNMENT.md

@@ -0,0 +1,87 @@
+# 0.6.2 真实会话：核心对齐与验收失效复核
+
+状态：已复现缺陷，未实施修复；不是下一版本已批准的开发或发布计划。
+基线：`63326f22d40407099baa70c8947c37029749588e`，package 0.6.2。
+比较对象：实际安装的 Codex Context Guard 0.13.9。
+
+## 结论
+
+这次是 macOS 会话，不能沿用 Windows 平台解释。存在三个相互作用的核心缺陷，其中混合请求的执行义务可被最终答复错误关闭，比用户看到的拒绝更严重。原会话有 119 次工具调用，其中 23 次为 Guard 调用；这个比例仅是数量，不证明全部属于浪费，也不代表有自动 Stop 自旋。
+
+此次复核以根用户文本、工具调用/结果、宿主 turn 事件和源码为证据，不采用会话模型的自我诊断为结论，不重放任何安装/提交/推送效果。原始会话及私有回放留在仓库外。
+
+## F062-01：问句标记吞并混合请求（P1）
+
+位置：`src/domain/semantics.ts` 的 QUESTION_SCOPE / classifyPositive，及 derive / delivery 接线。
+
+合成反例：
+
+> 更新插件，检查是否存在更新，安装新主题，记录变更。
+
+当前实现将整个片段赋予 informational。在完整的合成 turn 中不提供任何工具调用，只输出“已收到。”并结束 turn，条目仍转为 answered。原会话第一条混合要求同样在第一轮结束后变成 answered。这个结果不表示生成了完成证书，但确实使执行要求从 pending 中消失。
+
+英文变体 `Install the package, check whether an update exists, and write a report.` 中安装子段也被当成信息部分关闭。换成句号/分号可保留执行项，说明行为依赖断句。并非所有含问句的输入都失败：显式“然后安装”能够保留安装项，必须作为对照保留。
+
+机制：对尚未可靠分解的片段执行 QUESTION_SCOPE 的存在性匹配，遇到“是否”等标记立即返回 informational。源码注释将“含有疑问标记”误当成“整段是纯信息请求”。保留 source span 不能证明该 span 的解释正确。
+
+同样四条合成输入在 Codex 0.13.9 的 `_reply_only_request_shape` 中均返回 false，因此不会通过这条纯回答交付判据关闭。此比较证明具体判据差异，不是宣称 Codex 任意表达都正确或完成了原生对等验收。
+
+## F062-02：环境 cwd 被当成已确定的用户目标（P1）
+
+位置：`src/domain/capture.ts` 的 Git requested target 捕获；derive 将 scope cwd 传作 subject。
+
+合成 scope `/workspace/repo-a` 下输入“提交并推送。”，得到 repository=repo-a 且 targetCaptureStatus=resolved。真实会话的变更在另一个配置仓库，后续用户简短指代提交推送，Guard 仍锁定启动目录。
+
+必须区分用户指定目标、当前工作单元的可追溯目标、环境默认值和执行前解析结果。不能把任意模型提供的 selector 当授权，也不能无条件把 cwd 提升为根用户选择。唯一且有可信来源的上下文目标可复用；多义时保留目标未决，才请求必要澄清。
+
+后续 runtime 的 mutation_requested_target_mismatch 是正确保护。不能以放宽目标比较修复过早捕获，更不能要求模型到错误仓库做一次空提交来配合账本。
+
+## F062-03：准备配方与当前条目不相容（P2）
+
+位置：`src/tools/prepare.ts` 的 semantic_action override 与 runtime.authorizeMutationFromProjection。
+
+实际源工具探针：commit 条目传入 push 与另一仓库的 requested_target，prepare 仍返回 status=prepared 和 push 配方。runtime 后续会拒绝动作/目标不一致。真实会话也反复出现 prepare 给配方、action 才拒绝。
+
+prepare 是只读，不授予授权；因此不能称其已经放行错误动作。但它混合了“当前条目诊断”与“调用者假设动作的手册”，未明确区分 recipe_only 与 current-item readiness，容易把模型带入不可达路径。需要共用兼容判据，在副作用之前一次返回精确不匹配和可达下一步；不把任意准备参数写回用户要求。
+
+## 正确拒绝不能一起放宽
+
+- 使用普通 shell 的效果 call ID 代替 Guard 自有 producer 回执，被 persisted_effect_mismatch 拒绝，不证明 Git 适配器坏了。
+- 缺前置引用时 producer_reference_missing 正确；历史操作不得为了补证重复执行。
+- 没有真实等待/无进展资格的 boundary 被拒绝，不意味着不能普通结束。
+- 不透明复合 shell 不认证，不能据此直接判定所有 shell 工具不可用。
+- source、host、action capability 和 certification 表达不同维度，并非它们取值不同就一定矛盾；必须证明接口误导或状态错误。
+
+原会话模型把首项 answered 列为正常，复核否定这一点：纯问答交付可以关闭，但混合执行要求被误标为问答不是正常行为。不能再用“没有签发证书”概括全链路 fail-closed。
+
+## 为什么既有验证没有发现
+
+本次重跑：v061-conservative-interpretation、v051-target-identity、v062-codex-oracle 三组共 51 项全部通过；上述缺陷仍能稳定复现。通过数量不能证明测试 oracle 正确。
+
+1. 混合请求回归主要使用问号、特定连接词或明确句界；未覆盖逗号连续指令内嵌“是否”的语义等价族。v061 保守修复集中限制解释动词，留下问句存在性匹配作为快捷关闭入口。
+2. v051-target-identity 明确把 cwd fallback 固化为预期。已有测试验证显式路径优先，却未覆盖跨仓库工作后续指代；错误默认因此受到测试保护。
+3. prepare 回归验证 JSON 合法性和各配方字段，缺少“同一个 item/action/target/revision 在 prepare 与 execute 必须得到相容结论”的纵向一致性检查。
+4. 0.6.2 的跨端 oracle 确实执行了真实 Codex 入口，不应称伪造；但覆盖六个 contract 输入、四个 lifecycle 情景，偏重未知清理/缺证/等待/混合工具结果。没有覆盖此次混合语义、跨仓库指代和准备执行一致性。
+5. 原生安装、制品一致性、host-lock 和有限成功场景证明的是对应边界，不能补足上述语义覆盖缺失。
+
+协调与评审责任：前几轮分析识别了“混合请求”和“环境目标”的原则风险，却继续以局部反例和有限跨端验证作为充分交接，未形成覆盖整个缺陷家族的退出条件。0.6.2 计划聚焦诊断，没有修复仍存在的上游解释/目标错误。仅在文档注明“不是完全对齐”不足以防止真实使用再次失败。
+
+## 对齐声明的实际边界
+
+README 明确限定到共享证据规则，Semantic Compatibility 也不声称全产品对等；UPSTREAM_PIN 仍绑定旧的 v1/摘要输入。差异台账对 trusted-answer-delivery 标记 aligned，只能支持已有边界内的宿主交付机制，当前不能支撑“混合任务端到端保持相同义务”的结论。
+
+必须把“共享摘要字节相等”“单个机制类似”“端到端行为对等”分开。当前判断是**核心流程尚未对齐**。与上一事故不同，本次存在 Codex 与 DSH 对同一混合请求的明确判定差异，不能仅以 Codex 静默未认证解释用户感受到的区别。
+
+## 下一轮接受实现前必须满足的证据
+
+这不是新增一个版本号就能消除的风险。下一轮应先固定以下整体合同再实现：
+
+- 根来源→完整语义覆盖→目标来源→准备兼容性→执行→回读→当前闭包，所有阶段使用同一条目的身份和语义；不能分别推断后只在终点拒绝。
+- information 必须是完整信息范围。改变逗号/句号/连接词、中英同义或子句顺序，独立执行要求仍保留；未知尾部不能被吞并。
+- cwd 只提供环境上下文；显式当前仓库、另仓库工作后续指代、多个候选仓库、工具输出伪称目标、模型自行改目标均有正反例。
+- prepare 必须给出当前条目的真实兼容性，并与执行 gate 做同输入差分；拒绝时不可发出不加说明的可执行配方。标准普通工具与显式受控认证入口的责任要清晰，不能通过安装插件就要求所有业务改走认证链。
+- 用零工具最终回复、不相关成功工具、错误目标工具、部分执行完成四类反例验证闭包，不只测试合法链成功；未认证和错误 answered 都要统计。
+- 冻结未用于实现调参的同义留出集，经两端真实入口比较完整投影及用户可见结果。不能靠更多同型正例宣布对齐。
+- 保留正确的 producer/target/boundary 拒绝；修源头解释和准备路径，不能让执行校验迁就错误账本。
+
+当前只有复现与分析证据，未修改运行时、未重做用户安装或提交、未认证新的修复。后续具体实现范围、状态迁移和版本应基于这些合同确定，不先以新补丁版本替代根因修复。

package/docs/SEMANTIC_COMPATIBILITY.md

@@ -39,6 +39,33 @@ Authority rules:
   DSH v0.1.0 port. It is a historical fact, not the current alignment claim;
   current status lives in this document and the delta ledger.
 
+## 0.6.3 core-alignment delta
+
+The 0.6.2 core-alignment review reproduced three domain defects — a question
+marker swallowing a mixed request, the session directory promoted to a resolved
+request target, and preparation returning a recipe the execution gate refuses —
+and a fourth consequence: records an earlier version closed as answered were
+inherited as current passes. 0.6.3 repairs the source readings rather than the
+endpoint checks:
+
+| Capability | 0.6.3 disposition | Evidence |
+| --- | --- | --- |
+| information scope is complete and execution-free | implemented (DSH side) | `tests/domain/v063-core-alignment.test.ts`, `tests/domain/v063-holdout.test.ts` |
+| requested target has an auditable source | implemented (DSH side) | `tests/domain/v063-core-alignment.test.ts` (K2), `tests/domain/v051-target-identity.test.ts` |
+| prepare and execution share one compatibility judgement | implemented (DSH side) | `src/domain/compatibility.ts`, `tests/domain/v063-core-alignment.test.ts` (K3) |
+| earlier answered records are re-checked before terminal filtering | implemented (DSH side) | `tests/domain/v063-core-alignment.test.ts` (K4), `tests/domain/v063-holdout.test.ts` |
+| mixed-request obligation projection equals Codex | **not measured** | `tests/fixtures/cross-end/core_alignment_0_6_3.json` records it `not-applicable` |
+| cross-repository follow-up reference equals Codex | **not measured** | Codex exposes no equivalent target-source entry point |
+| prepare/execute consistency equals Codex | **not measured** | Codex has no equivalent prepare surface; recorded `not-applicable` |
+
+`docs/upstream-deltas.json` carries the same statements in the machine-readable
+ledger (refreshed 2026-09-16 for the 0.6.3 target; the Codex-side release
+comparison it names is unchanged), and
+`tests/fixtures/cross-end/core_alignment_0_6_3.json` is the case-level record. The `trusted-answer-delivery` entry was downgraded from `aligned` to
+`partial-equivalent`: the recorded Codex reply-only judgement returns false for
+the mixed inputs where DSH's delivery judgement would close the information
+range, so the two ends do not agree on that family.
+
 ## Digest v3
 
 Certificate, boundary, and evidence manifests bind to versioned canonical
@@ -152,7 +179,7 @@ Work-unit scope and correction attribution are also shared semantic gaps and sho
 
 ## 0.4.2 and 0.4.3 product boundaries
 
-The 0.4.2 release retained these exact mirrored fixtures and the recorded upstream pin. Its DSH-native rebinding, bounded checkpoint output, and recovery changes do not establish parity with later Codex releases. `upstream-deltas.json` is the dated 2026-09-03 comparison snapshot: its `currentRelease` fields name the releases compared then, not a live latest-version lookup. Refreshing that comparison requires a separate upstream audit; it does not happen merely because either product releases a newer version.
+The 0.4.2 release retained these exact mirrored fixtures and the recorded upstream pin. Its DSH-native rebinding, bounded checkpoint output, and recovery changes do not establish parity with later Codex releases. `upstream-deltas.json` is a dated comparison snapshot (refreshed 2026-09-16 for the 0.6.3 target; originally the 2026-09-03 audit): its `currentRelease` fields name the releases compared then, not a live latest-version lookup. Refreshing that comparison requires a separate upstream audit; it does not happen merely because either product releases a newer version.
 
 The 0.4.3 core policy changes DSH-specific manifest values, not the shared digest-v3 encoding or byte-mirrored fixtures. Core manifest version 2 and `dsh-core/v1` produce a fresh identity after actual-graph inspection. Legacy cohorts remain historical inputs. Market service adapter `context-guard.service.v2` uses version `2.0.0`; old restart credentials cannot become new-instance credentials. Package apply remains a disk-state operation, and unavailable restart work remains pending.
 
@@ -307,3 +334,24 @@ classes, release state, and migration facts.
 - The delta ledger separates source facts, plan status, implementation
   status, deterministic tests, native platform acceptance, and release
   readback; keep all six aligned when a capability moves.
+
+## 0.6.3 narrowed execution qualification (DSH-side)
+
+The DSH side now decides EXECUTION QUALIFICATION once per clause, before any
+partition: a clause whose own reading is a question, an explanation, an
+investigation, a reported question or a quoted scope is `restricted`, and one that
+asks nothing is `granted`. The qualification is stored on the item
+(`executionQualification`), inherited by every partition child, and consumed by
+both the mutation gate and `context_guard_prepare`; a record captured before the
+qualification exists is refused rather than read from its stored disposition and
+is flagged `legacy_missing_execution_qualification` by the upgrade check. The
+same-clause "prove the complement closed" rules of the earlier 0.6.3 revisions are
+removed, so there is exactly one authorization path.
+
+What this means for cross-end work: a question and a coordinated action in ONE
+clause is an UNDECIDED obligation on the DSH side, where earlier revisions recorded
+the action as an order. The machine-readable ledger
+`tests/fixtures/cross-end/core_alignment_0_6_3.json` records that reading at
+revision 4; the Codex side is unchanged, both ends still refuse to let an answer
+close the install, and no feature, runtime or release equivalence may be inferred
+from the shared fixture. See [CONTRACT_REVISION_0_6_3.md](CONTRACT_REVISION_0_6_3.md).

package/docs/upstream-deltas.json

@@ -1,7 +1,7 @@
 {
   "ledgerVersion": "2",
   "description": "Current, evidence-bounded delta ledger for behavior shared between codex-context-guard and dsh-completion-guard. It separates aligned behavior, partial host-native equivalents, missing shared behavior, and Codex-only lifecycle features.",
-  "updatedAt": "2026-09-14",
+  "updatedAt": "2026-09-16",
   "source": {
     "product": "codex-context-guard",
     "currentRelease": "v0.13.9",
@@ -17,12 +17,12 @@
   },
   "target": {
     "product": "dsh-completion-guard",
-    "currentRelease": "v0.6.0",
-    "currentReleaseHead": "not recorded here: the 0.6.0 source candidate is not yet frozen into an artifact, so no commit SHA is asserted in this ledger",
+    "currentRelease": "v0.6.3",
+    "currentReleaseHead": "not recorded here: the 0.6.3 source candidate is not yet frozen into an artifact, so no commit SHA is asserted in this ledger",
     "implementationBaseline": "ffc6fe9e1246a815f0bb630943c59d14b6505716",
-    "host": "DSH 0.1.5-rc.2 || 0.1.5-rc.1 / Cordis 4.0.2 (registry-derived cohort; native audit pending for 0.6.0)"
+    "host": "DSH 0.1.5-rc.2 || 0.1.5-rc.1 / Cordis 4.0.2 (registry-derived cohort; native audit pending for 0.6.3)"
   },
-  "alignmentClaim": "DSH 0.6.0 implements the C01-C12 shared contract of the paired 0.6.0/0.14.0 plans and covers it with production-chain tests. It does NOT claim core alignment with Codex Context Guard: the v2 conformance fixture exists only as a DSH-authored candidate because the upstream has not landed a frozen v2 specification, so the canonical mirror and the cross-language parity comparison remain open. The v1 fixtures, the digest-v3 vectors, and the frozen digest domains are unchanged.",
+  "alignmentClaim": "DSH 0.6.3 implements the C01-C12 shared contract of the paired 0.6.0/0.14.0 plans plus the K1-K4 core-alignment repairs, and covers it with production-chain tests. It does NOT claim core alignment with Codex Context Guard: the 0.6.2 review reproduced three domain defects and one inheritance defect that the recorded Codex behaviour does not share, the v2 conformance fixture still exists only as a DSH-authored candidate because the upstream has not landed a frozen v2 specification, and the mixed-request, cross-repository and prepare/execute families have no measured Codex counterpart. tests/fixtures/cross-end/core_alignment_0_6_3.json records each family's disposition case by case. The v1 fixtures, the digest-v3 vectors, and the frozen digest domains are unchanged.",
   "dispositions": [
     "aligned",
     "partial-equivalent",
@@ -149,14 +149,16 @@
     {
       "capability": "trusted-answer-delivery",
       "introducedBy": "shared C03 (0.6.0 / 0.14.0 plan)",
-      "disposition": "aligned",
-      "targetRelease": "dsh-completion-guard v0.6.0",
-      "plainLanguage": "A question or explanation is closed only by the host's own record of a normally completed turn whose final assistant message was not interrupted; delivery never implies correctness or execution.",
-      "implementation": "domain/delivery.ts derives the fact from assistant/message + turn/end; deriveProjection applies it to information-slot items of that turn's owning unit and its delegated sub-units.",
+      "disposition": "partial-equivalent",
+      "targetRelease": "dsh-completion-guard v0.6.3",
+      "plainLanguage": "A question or explanation is closed only by the host's own record of a normally completed turn whose final assistant message was not interrupted; delivery never implies correctness or execution. DSH bounds the closable range to a COMPLETE information range, which the recorded Codex reply-only judgement does not match on mixed inputs.",
+      "implementation": "domain/delivery.ts derives the fact from assistant/message + turn/end; deriveProjection applies it to information-slot items of that turn's owning unit and its delegated sub-units, after K1 has separated the execution obligations of the same clause.",
       "tests": [
         "tests/domain/v060-units-delivery.test.ts",
-        "tests/domain/v060-portable-v2.test.ts"
-      ]
+        "tests/domain/v060-portable-v2.test.ts",
+        "tests/domain/v063-core-alignment.test.ts"
+      ],
+      "note": "Downgraded from aligned in 0.6.3: the recorded Codex _reply_only_request_shape judgement returns false for the mixed comma-run inputs where 0.6.2 DSH would close the whole clause as answered. Alignment on this family is not established."
     },
     {
       "capability": "work-unit-required-descendant-closure",
@@ -220,6 +222,60 @@
         "tests/domain/v060-v2-runner-independence.test.ts"
       ],
       "dshOnlyReason": "Only the upstream repository can land the canonical v2 specification, schema and reference projection. Until it does, mirroring and parity cannot be established honestly."
+    },
+    {
+      "capability": "information-scope-preservation",
+      "introducedBy": "dsh-completion-guard v0.6.3 (K1; review F062-01)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.3",
+      "plainLanguage": "A question inside an instruction is a question; the work beside it stays work. An answer closes the information range it answers and nothing else. This is a DSH-side implementation of the shared contract; the Codex counterpart for this family is not measured.",
+      "implementation": "domain/semantics.ts classifies a clause as information only when an interrogative opens or ends it, and partitions a mixed clause into an information range plus its directive clauses.",
+      "tests": [
+        "tests/domain/v063-core-alignment.test.ts",
+        "tests/domain/v063-holdout.test.ts"
+      ],
+      "note": "The 0.6.2 rule is retained as legacyQuestionReadingIsInformational so the fixed defect keeps a failing-before regression."
+    },
+    {
+      "capability": "requested-target-provenance",
+      "introducedBy": "dsh-completion-guard v0.6.3 (K2; review F062-02)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.3",
+      "plainLanguage": "Work happens where you said it happens. The directory a session started in is context, not your choice. This is a DSH-side implementation of the shared contract; the Codex counterpart for this family is not measured.",
+      "implementation": "domain/capture.ts records TargetSource (explicit name/path, explicit current repository, host selection, unit inheritance, environment default); derive.ts resolves inheritance across the same work unit; runtime.ts refuses an environment-default target explicitly.",
+      "tests": [
+        "tests/domain/v063-core-alignment.test.ts",
+        "tests/domain/v063-holdout.test.ts",
+        "tests/domain/v051-target-identity.test.ts"
+      ],
+      "note": "Codex exposes no equivalent target-source entry point, so this family is recorded not-applicable rather than aligned."
+    },
+    {
+      "capability": "prepare-execute-shared-compatibility",
+      "introducedBy": "dsh-completion-guard v0.6.3 (K3; review F062-03)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.3",
+      "plainLanguage": "Preparation tells you what the Guard will actually accept for the item you asked about, and it will not hand you a recipe the execution gate would refuse. This is a DSH-side implementation of the shared contract; the Codex counterpart for this family is not measured.",
+      "implementation": "domain/compatibility.ts is the single pure judgement used by tools/prepare.ts and runtime.authorizeMutationFromProjection; it separates semantic compatibility, target compatibility, execution readiness and adapter capability.",
+      "tests": [
+        "tests/domain/v063-core-alignment.test.ts",
+        "tests/domain/v063-holdout.test.ts",
+        "tests/tools/v063-host-materialization.test.ts"
+      ],
+      "note": "Codex has no equivalent prepare surface; recorded not-applicable in the cross-end ledger."
+    },
+    {
+      "capability": "legacy-record-eligibility",
+      "introducedBy": "dsh-completion-guard v0.6.3 (K4)",
+      "disposition": "aligned",
+      "targetRelease": "dsh-completion-guard v0.6.3",
+      "plainLanguage": "An obligation recorded by an earlier version is never inherited as a pass. If its own text still orders work, it blocks a new certificate until you resolve it, and its history is preserved. This is a DSH-side implementation of the shared contract; the Codex counterpart for this family is not measured.",
+      "implementation": "derive.ts runs the eligibility pass before any terminal filtering; closure.ts exposes the blocking set; checkpoint.ts and goal-gate.ts refuse certification and Goal completion; delivery.ts does not close a flagged record.",
+      "tests": [
+        "tests/domain/v063-core-alignment.test.ts",
+        "tests/domain/v063-holdout.test.ts"
+      ],
+      "note": "Codex has no equivalent eligibility layer for previously-closed information records."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-completion-guard",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "A task-contract and completion-certification layer for DeepSeek Harness.",
   "repository": {
     "type": "git",
@@ -113,5 +113,5 @@
     "hooks",
     "typescript"
   ],
-  "gitHead": "63326f22d40407099baa70c8947c37029749588e"
+  "gitHead": "4c26bee90a7b9e8b26ebbe91f335e356e7589fc3"
 }