dsh-completion-guard 0.6.3 → 0.7.1

package/docs/ARCHITECTURE.md

@@ -13,9 +13,34 @@ Context Guard separates DSH-owned execution from Guard-owned certification.
 
 Context Guard does not own Goal, Todo, Compaction, or continuation. It intervenes when completion is claimed without a valid certificate.
 
+## Call-time Host working-directory evidence
+
+For an ordinary named `npm test` or `pnpm test` Host call that omits `workdir`,
+the Guard captures a read-only working-directory receipt before execution and
+defers its provider-visible plugin context until the host has persisted the
+complete tool-result batch. This is a call-time derivation from the original Session header, the scoped sandbox
+policy, the active shell service, and exact audited DSH `0.1.5-rc.2` producer
+bytes. It is **not** a working directory returned by the Host process. The
+notice binds the original call ID, sequence, turn, arguments digest, root
+source, Session digest, Host-lock digest, physical directory, and policy root.
+On replay it is accepted only after the matching result and before the next
+assistant step, with the same source and Host identity. A legacy notice between
+a call and result is not upgraded. The observer always lets the Host tool proceed;
+it grants no ordinary mutation or execution qualification.
+
+The Bash producer chooses the scoped policy workspace root, or the Session
+header cwd when no policy is mounted; this candidate only certifies the
+audited policy route when its physical root equals the immutable header cwd.
+PowerShell uses the immutable header cwd under its separately audited local
+executor. An explicit `workdir` is checked on its own merits. Missing or
+ambiguous provider identity, a lexical filesystem alias, absent physical
+directory, changed policy or graph bytes, background execution, or missing
+call-time notice leaves target attribution insufficient. Historical logs
+without such a notice cannot be upgraded by reading today's Host config.
+
 ## Durable state model
 
-The effective plugin configuration and the DSH Session append-only log are the inputs to the rebuildable Guard projection. Context Guard **appends no custom session event types**: the persisted event vocabulary is harness-owned and the current persistence layer refuses unknown event types. The `activation` configuration supplies the initial enablement state, while all later session state is derived from the natively persisted events DSH already writes:
+The effective plugin configuration and the DSH Session append-only log are the ordinary inputs to the rebuildable Guard projection. Context Guard **appends no custom session event types**: the persisted event vocabulary is harness-owned and the current persistence layer refuses unknown event types. The explicit release and restart paths additionally use the provider-invisible private ledger described below. The `activation` configuration supplies the initial enablement state, while ordinary session state is derived from the natively persisted events DSH already writes:
 
 - effective plugin configuration — initial enablement (`opt-in` starts disabled; `always` starts enabled before log replay);
 - `command/run` — later enablement (`/context-guard on|off|clear`) and epoch transitions;
@@ -41,7 +66,9 @@ Recovery packets keep the existing content-dedup and ride the next entered step.
 
 ## Unified diagnosis and preparation
 
-`deriveItemDiagnosis` is the single pure judge shared by checkpoint, recovery, the rebind item query, `context_guard_prepare`, and `/context-guard status`. Per item it reports a task kind (`inquiry`/`action`/`constraint`/…), certification support (`unsupported`/`needs_target`/`needs_evidence`/`unavailable`/`supported`), repairability (agent-repairable, needs user input, unsupported, historical gap, none), the exact missing target fields and evidence facets, and one concrete next action with a resume condition and a stable attempt fingerprint. Inquiries stay captured obligations whose honest next step is to deliver the answer; they are never prescribed a rebind. An effect recorded without its resolution prestate is a historical gap: read back observed state, never re-execute to mint evidence.
+For default v6 ordinary work, the prepare and checkpoint tools display the confirmed shared-core predicates at the current Session watermark. Historical item statuses and certificate bytes remain available for audit, but a pending legacy item does not become a new execution qualification after its current core predicate is satisfied. A separate information requirement remains open until the final answer is durably delivered. The ordinary checkpoint reply is an observation, not a signed certificate; missing or unprojectable core input stays unknown. Explicit proof, adopted Goal and applicable release work retain the versioned certificate path. Pagination binds the shared-core waterline so an older discovery page cannot silently skip changed obligations.
+
+`deriveItemDiagnosis` is the pure historical and explicit-certificate item judge shared by recovery, rebind queries, and those checkpoint, prepare, and status views that use the versioned certificate contract. Default v6 ordinary prepare and checkpoint instead read `currentV6Feedback` from the confirmed shared-core projection; they preserve the original item and source for display without turning old item status into a current qualification. On the certificate path, item diagnosis reports a task kind (`inquiry`/`action`/`constraint`/…), certification support (`unsupported`/`needs_target`/`needs_evidence`/`unavailable`/`supported`), repairability (agent-repairable, needs user input, unsupported, historical gap, none), the exact missing target fields and evidence facets, and one concrete next action with a resume condition and a stable attempt fingerprint. Inquiries stay captured obligations whose honest next step is to deliver the answer; they are never prescribed a rebind. An effect recorded without its resolution prestate is a historical gap: read back observed state, never re-execute to mint evidence.
 
 0.6.2 adds the shared capability projection beside that verdict (`src/domain/capability-semantics.ts`). Every lane declares one gap kind — unknown interpretation, missing target, missing adapter, legacy migration, missing historical pre-evidence, unattributable operation, pending condition, pending delivery, unavailable host, or standing constraint — and exactly one reachable remedy. Every consumer reads that projection instead of inferring a root cause from one enum, which is what stops a capability this build lacks from being reported as a user-authorization gap. Shell facts additionally carry a layered reading (`processFacts`): the host tool's own return, the console's declared exit status or `unknown`, how far the effect was attributed to this obligation's operation, and the resulting business outcome. Those fields are derived at replay, are excluded from every digest and certificate domain, and never rewrite a historical `outcome` or `parseStatus`.
 
@@ -110,7 +137,7 @@ rules. `/context-guard migration` reports which of the two is in force.
 | `domain/release.ts` | Explicit release contracts, one-shot reservations, readback settlements, coverage surface, and the pre-effect gate |
 | `domain/reason-class.ts` | The frozen seven-class mapping for every reason code |
 | `domain/migration.ts` | Rule set in force, preserved identities, and the rollback precondition |
-| `domain/diagnostics.ts` | The single per-item judge, now carrying its reason class |
+| `domain/diagnostics.ts` | Historical and explicit-certificate per-item diagnosis, including its reason class; default v6 ordinary feedback reads the confirmed core through `domain/v6-feedback.ts` |
 
 ### Delivery
 
@@ -149,13 +176,20 @@ demand the proof the user explicitly asked for.
 
 ### Explicit release
 
-Contracts, reservations and settlements are persisted through the plugin-notice
-channel the host already writes, and each is idempotent by its own identity
-(contract id, call id). Reservations are written before the effect and record
+Release adoption remains a root `command/run`. Reservations, settlements, and
+restart intents use an owner-only append-only private ledger beneath the DSH
+home selected by the host's non-empty `DSH_HOME` or default `~/.dsh`. The
+ledger anchors a hashed Session header, cwd, host lock, and canonical ledger
+root; release rows additionally bind the immutable adopted contract, resolved
+target, and preceding reservation. Each row is hash-chained and carries a
+private-ledger position rather than pretending to be a Session sequence.
+Reservations are flushed before the effect and record
 the SRI the trusted producer read; a settlement records a trusted readback when
-one exists and otherwise stays `unconfirmed`, which preserves the in-flight
-protection and refuses a re-send. Adoption comes only from the root
-`command/run`, and `release status`/`release revoke` are read-only and
+one exists and otherwise remains non-settling (`unknown` or `unconfirmed`), which preserves the in-flight
+protection and refuses a re-send. Missing, truncated, cross-session, mismatched,
+or locked ledger state fails closed. Historical plugin-notice records remain
+readable under their frozen rules but are not migrated into stronger sidecar
+facts. `release status`/`release revoke` are read-only and
 authority-withdrawing respectively — neither is a state corruption.
 
 The contract freezes the candidate scope's `adoptedAtRevision`, and the closure

package/docs/COMPATIBILITY.md

@@ -2,6 +2,12 @@
 
 Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
+## 0.7.0 release-line boundary (2026-09-21)
+
+Public availability of 0.7.0 depends on npm, tag and GitHub Release readback. Historical commit `583035bd90b8ee589d01b12487a057b655d43e41` passed candidate CI and a 34-gate macOS native run with cleanup on its exact canonical tgz; that result skipped real-model requests. That historical tgz has no Windows exact-artifact native or complete fixed-model acceptance. Final release identity, installation and publication require separately bound evidence. Later packaged-document or source changes require a new exact artifact and native acceptance. The existing exact DSH host-lock cohorts remain the test targets. Ordinary file edits, tests and Git operations run through host tools; Guard observes persisted results and uses read-only file/Git/readiness adapters where the named completion predicate needs independent evidence. A package-script readiness observation may select a current test or assessment input; it proves neither that the test ran nor that a root time or approval condition was released. An existing change can be assessed without requiring a new edit. A missing pre-effect state cannot prove create/no-overwrite, and a Git parent object is not an observed pre-effect HEAD. Unsupported predicates remain insufficient rather than being inferred from successful tool return.
+
+The core/v2 JSON and conformance fixture mirrors are bound to the exact Codex Context Guard source commit `cb415cbe374d452e4a0c71e9e292d20e31f23b0e` and per-file hashes in `tests/fixtures/conformance/core_v2/UPSTREAM_PIN.json`. The historical v1/digest pin at `tests/fixtures/conformance/UPSTREAM_PIN.json` retains its prior bytes. This source-mirror identity does not establish product runtime equivalence, publication, or installed behavior. Source and cross-end checks, CI, native acceptance, and exact-artifact acceptance remain separate evidence.
+
 ## 0.5.2 support policy
 
 Version 0.5.2 supports exactly **DSH `0.1.5-rc.2` or `0.1.5-rc.1`**.

package/docs/CONTRACT_REVISION_0_6_3.md

@@ -2,8 +2,8 @@
 
 状态：**用户明确批准的验收合同调整**，不是对旧合同的“全部实现”声明。本文列出被替代的验收条目、
 代价、替代它们的结构性不变量，以及仍然有效的条目。历史材料
-（[开发计划](DEVELOPMENT_PLAN_0_6_3.md)、[0.6.2 复核](REVIEW_0_6_2_CORE_ALIGNMENT.md)、
-[执行提示](EXECUTE_0_6_3_PROMPT.md)、历轮[验收记录](LOCAL_ACCEPTANCE.md)）保持原样，不静默改写；
+（[开发计划](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/DEVELOPMENT_PLAN_0_6_3.md)、[0.6.2 复核](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/REVIEW_0_6_2_CORE_ALIGNMENT.md)、
+[执行提示](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/EXECUTE_0_6_3_PROMPT.md)、历轮[验收记录](LOCAL_ACCEPTANCE.md)）保持原样，不静默改写；
 本文只记录它们之上的一次显式变更。
 
 ## 1. 为什么修订

package/docs/CORE_ALIGNMENT_CONTRACT_V2.md

@@ -0,0 +1,155 @@
+# Context Guard 共同核心合同：DSH 0.7.0 / Codex 0.14.0
+
+规划合同版本：2.0-plan.2，2026-09-18。本文规定新版本的职责、状态与接受条件，不声称已有实现通过，也不是执行、安装或发布授权。产品版本、协议版本与本文版本独立。
+
+## 1. 权威源与适用范围
+
+本轮两份开发计划引用本文的逐字相同副本；协调者维护规划合同，禁止任一产品自行改变语义。产品落地时，Codex Context Guard 仓库是共享规范、JSON schema、reference projection 和中立 fixture 的唯一权威源。先在该仓库完成 P0，再由 DSH 按确切 commit、路径及 SHA-256 镜像；不得把 DSH 单边 candidate 称为共享标准。两份规划副本也必须做字节相等检查。上游的公共文件不得依赖私人协调仓库或本机路径。
+
+本文的 AC01–AC12 补充并约束既有 C01–C12。旧版记录保留历史效力；0.6.3 的文本执行资格与收窄表达合同不得成为 0.7.0 默认路径。新合同不是保证任意自然语言可被确定性证明，而是规定不能从解析不确定性产生执行权限、错误完成或额外普通审批。
+
+只对齐共同语义和可观察行为：要求、来源、工作单元、回答、证据、完成、普通执行职责和显式发布规则。Codex Hook/cache、DSH Session/Goal/Web/Headless、调度和安装分别属于宿主；事件名称、工具名称、消息措辞和制品 hash 不要求相同。
+
+## 2. AC01：三个责任边界
+
+| 路径 | 负责执行与权限的一方 | Guard 必须做什么 | Guard 不得做什么 |
+| --- | --- | --- | --- |
+| standard 普通任务 | 执行助手依据真实用户请求、仓库规则和宿主审批；宿主执行工具 | 保存完整要求/约束，观察真实工具结果，恢复上下文，核验完成事实 | 用文本分类器签发普通执行资格；要求先走 prepare/action/rebind 才能编辑、测试、提交、推送 |
+| strict 普通任务 | 同 standard | 对用户明确要求的视觉/完整范围等 proof 保持强制核验 | 把证明义务转换成普通工具前置审批或重复用户授权 |
+| 显式 release 契约 | 助手仍负责用户授权；宿主仍负责平台审批；Guard 只强制已采用契约 | 精确身份、readiness、单次票据、效果前检查、消费与可信回读 | 从安装、关键词、Skill 或普通 push 自动采用契约；建议或认证绕过已采用契约；把不可拦截的宿主通道说成已被阻止 |
+
+“没有 Guard 否决”不是授权；模型仍必须遵守原始约束。Guard 的解释标签是理解候选或证明范围，不是安全沙箱。host-lock/完整性失败使 Guard 的认证或受控执行 unavailable；普通宿主工具权限仍由宿主决定，不能因插件不可用把整个宿主变成不可操作。
+
+## 3. AC02：DSH 自有执行器的迁移决策
+
+0.7.0 默认路径停止提供 Guard 自有普通 mutation 执行能力。`context_guard_action` 和 evidence 工具内的 effect 执行分支不得仅通过改名、policy 条件或“可选”标记继续承担普通 Git/安装/修改授权；迁移到宿主普通工具执行，Guard 只消费可信观察。prepare 如保留，只给事实/证据诊断，不能给出普通动作的 authorized/granted 结论。
+
+兼容入口可以返回结构化 `ordinary_execution_moved_to_host`，说明使用宿主普通工具，**不能执行效果**，不能要求用户重写或再批准。新任务的工具描述、恢复提示、Skill、README、测试都不得引导普通操作回到这条旧链。旧记录中的 `ExecutionQualification` 可保留用于历史解码，不参与新普通执行、目标选择或当前完成推断。
+
+受控发布可以继续使用专用 action 实现，但只能由已显式采用、覆盖该操作的 release 契约进入；运行时必须重新检查完整契约，不信任调用方传入的模式。停用旧普通执行器不等于删除身份/producer/前置状态校验：这些检查转归证明验证器或受控发布路径。旧工具名、旧会话、模型误调用和 wrapper 均须有无副作用测试。
+
+Codex 0.14.0 保持既有普通工具边界，不为了接口对称新增 DSH action/prepare，也不将新解释内核接回普通 PreToolUse 审批。
+
+## 4. AC03：来源、解释与完整覆盖
+
+根输入/资产身份不可变；语义记录使用 UTF-8 字节半开区间、原文 hash、unit、revision、来源种类及覆盖余项。保留正向要求、禁止、条件、信息与未知范围，引用/工具/子代理/压缩摘要不能增加用户权限。
+
+解释可以由现有助手提出结构化候选，也可由受支持的确定性规则生成。验证器检查来源、覆盖、类型结构、约束、目标关联及修订；模型自报“这是指令/全部覆盖”不是事实证明。未知残余保持可见，不得从闭包丢弃。没有可靠语义依据时不签发信息关闭或执行完成，但这不阻塞普通工具或诚实结束。
+
+不扩张词表来证明开放自然语言的授权；不要求用户改分号、写插件 DSL 或固定重述模板。固定的必修中文/英文常用表达须正常处理，不能通过全部 unresolved 来取得安全结果。真实歧义才请求最小业务澄清；解析器缺能力、证据不足和缺用户权限分别诊断。不得增加插件自己调用外部模型的运行时依赖；Codex 保持标准库边界。
+
+## 5. AC04：状态维度与闭包
+
+P0 必须把下列概念映射为版本化 schema，禁止使用一个 `authorized/completed` 布尔值混合它们：
+
+| 维度 | 最少需要表达的事实 |
+| --- | --- |
+| 来源/解释 | 原始来源、candidate interpretation、已验证结构、unknown residue |
+| 回答交付 | not_observed / delivered，绑定正确 unit/turn/最终回答/范围；不表示答案正确 |
+| 业务效果 | not_observed / success / partial / failure / unknown，绑定真实工具和目标 |
+| 证明资格 | supported / unavailable / insufficient / satisfied / invalidated |
+| 闭包 | 当前 unit + 必需后代的未满足要求、持续约束、等待、legacy review；历史兄弟任务不混入 |
+| Stop 决定 | ordinary_end / bounded_correction / typed_wait；与证书签发分开 |
+| 发布 | 未采用 / 已采用 / 已保留 / 已消费 / 结果未知，按已有 release 状态机扩展 |
+
+信息 delivered 仅覆盖可信最终回答的对应信息项，不覆盖混合执行/资产/proof。执行 verified 需要匹配的证据，final、工具零退出、别项完成或解释分类本身均不充分。父项只有适用必需后代满足才能完整认证。禁止项持续有效，不作为永远待执行的动作计数。
+
+## 6. AC05：普通结束、纠正与 Goal
+
+ordinary_end 可以保持未认证状态；不得把所有 pending/unresolved 自动变成阻止结束的债务。等待或无可执行证据时静默保留；不能通过伪造 typed boundary 才让用户得到答复。恢复时展示真实剩余要求和能力缺口，不制造重复工作。
+
+纠正仅用于有明确可追溯依据的提前完成/漏项或违反显式 proof 的完成声明；每 turn 最多一次可见纠正，进展指纹不变不得自旋。不以动词出现、词表推断、历史 broad resume 或 `ExecutionQualification` 证明当前存在必须自动执行的工作。纠正自身也不产生执行权限。纠正预算用完后保留未认证结论，不伪造通过。
+
+### AC05.1：继续提示所需的当前动作依据
+
+2026-09-18 的 Codex 0.13.9 误报表明，仅禁止“generic 推为 authorized”还不足以指导替换实现。`remaining_action_facts → _action_authorization → resumed_actionable_work → Stop` 可把后续收益观察补成当前动作，再把简短修复指令提升为持续执行要求。该事实只在 Codex macOS 观察与隔离 Hook 回放中成立；DSH 必须实现同一防护，不据此宣称 DSH 已复现。
+
+P0 必须为“提示助手继续执行”冻结可追溯的动作依据及其校验规则，至少关联：当前 unit/revision、根要求及其采用范围、具体动作/对象或仍有效要求的必要子步骤、未满足的完成谓词、负责方、条件与输入是否就绪、来源跨度/事件和截至当前 turn 的判断水位。子步骤不要求用户逐项枚举，但必须解释其与已授权目标的必要关系；仅凭模型补写 owner、类别或 `authorized=true` 不成立。该依据用于 Stop 诊断，不是普通工具权限票据；资料不足保留未决并允许诚实结束，不新增执行前审批。
+
+- 分开本轮具体剩余动作、证据/能力不足、未来效果评估、范围外建议、真实用户/外部等待和已完成状态。含动作词的收益/稳定性限制说明不能单独创建当前待办；同句和跨句的完成片段不得借旁边的未来标记变为未完成。
+- `explicit_user_persistence` 只来自可信根要求中真实的持续执行指令；`resume_with_actionable_work` 必须同时有当前恢复指令和上述具体动作依据。两类独立存储、独立原因码，禁止用 OR 写回“用户要求持续执行”；默认未知类别/不明确范围不能补成 authorized。
+- `registered_external_operation` 需要实际关联的外部操作或可信生命周期事实；“未提交”“以后观察”本身不能创建已登记等待。无法确认等待时可以普通结束且未认证，不能捏造 boundary。保留原始用户明确等待约束，并与外部操作登记分开。
+- 只使用截至该次 Stop 的要求与事实；之后新增“安装/提交/推送”的授权不能回填早先决定。同一结果换掉未来观察措辞不应改变当前动作集合。若用户确实要求立即设计/运行效果评估，或当前测试明确未跑且具备输入，则必须识别该具体剩余动作，不能用“观察类”白名单一概放过。
+
+继续提示要求“有当前动作依据”；错误整项完成/显式 proof 的纠正沿用 AC05 独立判据，不能以没有可执行动作放过错误认证。纠正总预算、无进展规则及恢复范围保持不变。
+
+宿主 Goal 的 `complete` 是完成状态变更，不能与普通聊天结束混同：显式采用的 Guard/Goal 完成合同仍需全部必需证据。无法认证时拒绝 Guard 介导的 Goal 完成并说明缺口，宿主保持实际未完成状态；不自动暂停/重启/改标 blocked，不借“普通结束”宣布 Goal 成功。没有采用这种合同的宿主 Goal 不能由插件擅自接管。DSH 必须核验现有 Goal 接线的采用条件和覆盖；未覆盖旁路公开声明，不伪造全局保障。
+
+## 7. AC06：普通工具证据的进入路径
+
+使用宿主实际提供的工具调用/结果与持久化事件，输出中立 fact：真实 call/operation lineage、producer、subject、时间/水位、结果、可证明的 predicate、原始材料摘要和能力边界。模型给出的 call ID、文本声明或自造 receipt 不能创建可信事实。
+
+宿主适配器负责 observation → fact，核心负责 fact → predicate satisfaction。必须支持已有标准普通工具的有界成功路径：文件改动+回读、测试运行、Git commit/push 的精确 readback，以及只做解释的可信交付。按本次任务所需 predicate 收证据；不是所有普通工具都必须新写认证适配器。
+
+- shell 退出码只证明进程结果。复合命令部分失败、循环/catch 掩盖失败、引用报错文本分别建正反例；不能整段 success 关闭全部子项。
+- action-event（本次发生某操作）与 state-outcome（现在满足某状态）必须区分；现状不能反推历史动作或缺失前态。普通工具已有可信历史只要满足 predicate 可接入，不强迫重执行以制造 Guard producer。
+- 缺适配器返回 capability_unavailable，缺足够事实返回 evidence_insufficient；都不说“请再授权/改成另一动作”。允许诚实普通交付，不能签发超出证据的证书。
+- 视觉、指定资产、完整集合和明确 proof 要求保留原强度。没有可观察生产者时显式记录缺口，不把普通路径迁移当作放宽证明。
+
+## 8. AC07：目标身份与权限来源分离
+
+分别记录根约束、助手在已允许范围内的实现选择、宿主可信选择、执行解析、实际观察身份。cwd、最近工具路径和模型 selector 不自动成为根权限；普通选择也不必被伪装成根用户逐字段指定。
+
+跨仓库“提交并推送”复用当前工作单元内唯一且有来源的合法工作对象；显式目标冲突不得替换，多候选才消歧。该判断用于约束保留和证据匹配，不重建普通操作前置审批。版本/分支/refspec/registry/package 等身份按字段规范化；完整元组冲突不可被同包名或统一小写吞并。
+
+受控发布在效果前固定全部必需身份；普通完成证明在认证时绑定实际身份及用户约束。两者使用同一身份库而非同一授权流程。准备/诊断与认证/发布核验使用同一快照判据；执行前仍重读 revision、目标、证据、host-lock，防止同 revision 的外部状态变化。
+
+## 9. AC08：显式发布的保留范围
+
+共同的必修发布语义为显式采用、精确目标/候选、单次保留/消费、防重放、超时结果未知及可信回读。Codex 保留现有 release adapter；DSH 将其实际可保护的表面单列，不能因没有相同 Hook 名称就删除共同语义测试。
+
+DSH 本版最低必须提供现有受控 registry publish 表面的完整正反例；Codex 的额外 tag/GitHub Release 表面保留其验收。此最低集合不意味着 DSH 的其他发布方式已受保护：若选定契约还要求未覆盖表面，必须在采用/预检时拒绝该不可履行契约；不能效果后才发现，也不能发出“改用普通 shell”的绕行建议。效果前强制拒绝只适用于Guard实际控制的发布入口以及采用/预检。宿主普通shell/opaque runner等无法拦截的通道没有Guard拦截保证，不能为其签发受控发布认证，也不能建议绕行；助手仍须遵守已采用契约，宿主权限继续生效，不宣称插件是沙箱。
+
+root 的普通 push 不自动成为 release 操作；文档、安装、Skill、模型提案不能暗中激活票据。用户明确切换 release profile 的现有语义不得丢失：profile 选定后须进入相应契约流程，缺契约时相关发布失败关闭，普通无关工作保持原边界。
+
+## 10. AC09：旧会话、协议与回滚
+
+支持 DSH 0.6.3 与现存 legacy 读取边界、Codex 0.13.9 及其已支持旧 schema；P0 从仓库实际消费者清单分配新的协议/schema/hash 身份。不能在旧版本号内改变已签发字节，不能仅升级产品号而沿用不兼容状态语义。
+
+新任务用新普通路径；旧任务通过显式版本边界迁移。保留 journal、根输入、旧证书、旧 qualification 原始事实；旧资格不授予新普通执行。当前单元及必需后代内影响新认证的旧 answered/closed 在终态过滤前复查，needs_review 阻断新认证，但不自动成为普通工具审批或无进展 Stop 循环。无关历史不重开；缺原始来源不推断完成。
+
+旧工具调用不可触发普通 mutation；旧 release 契约、已保留票据和不确定效果必须先核对原身份再恢复，不能因新路径重试未知发布。事务性迁移、重复迁移、崩溃恢复、旧新证据共存均有用例。回滚需匹配旧运行时和旧状态快照；旧运行时不得写新状态。不能安全回滚时只读诊断并前滚，不丢工作数据。
+
+## 11. AC10：共同投影与对齐判据
+
+在 Codex 上游产出可独立运行的 Python reference 和 TS consumer；纯核只接收规范事件与真实 fact，不读期望值、case ID 或宿主专属测试开关决定输出。规范输入、Unicode/数值/排序/canonical bytes/hash 规则在 P0 固定，保留 v1/digest_v3 的旧域。
+
+归一化投影至少比较：来源覆盖与未知余项、类型与约束、工作单元闭包、目标来源和身份、delivery、效果与证明资格、普通路径是否被 Guard 干预、Stop 原因与纠正次数、显式发布状态。宿主 ID 只作确定映射；不能删除有分歧的关键字段来获得相等。普通路径不得出现 Guard 签发的执行权限字段。
+
+同一原始自然语言和同一规范事件序列各有比较泳道：前者测试产品真实解释入口，后者定位核心状态机差异。结构化模型候选输入不能代替原文入口测试。解释不确定允许在扩展集显式记录，但固定必修集须满足独立期望和双端相等；两端都误关闭或都永远 unresolved 不能算通过。
+
+状态台账分两个字段：implementation_status（implemented/partial/missing）和 comparison_status（aligned/measured_difference/not_measured/host_specific）。aligned 必须有共同合同版本、双方源码身份、fixture digest、真实入口层级和结果引用；没有相同 API 名称不构成 host_specific。宿主专属能力只能用于真实不存在的语义需求，不能排除共同要求。过时文字与机器状态矛盾必须作为文档缺陷修复。
+
+## 12. AC11：必修验收家族与停止条件
+
+沿用 C01–C12 / S01–S12 全部适用合同，追加以下结构矩阵；阶段性缺证据不能自行改成 not-applicable。每组同时有正向与反向结果，不穷举自然语言。
+
+| ID | 结构家族 | 必修结果 |
+| --- | --- | --- |
+| A01 | mixed 问答/执行，否定、条件、引用、未知尾部，中英标点与顺序变形 | 不丢项、不误关闭；固定明确表达无需用户换标点才能正常工作 |
+| A02 | 纯解释提到安装/重启，真正普通执行，未知动作 | 不创建权限；正确普通工作不被 parser/缺 adapter 阻拦；信息交付可达 |
+| A03 | 当前目标、跨仓库后续指代、候选歧义、模型/工具伪造来源 | 有源唯一对象复用；真正歧义才澄清；证据绑定实际目标 |
+| A04 | 零效果 final、无关成功、错目标、部分成功、完整正确执行 | 前四种不完整认证，最后一种能完成；普通诚实结束可未认证 |
+| A05 | 同事实分别经普通工具与旧 Guard wrapper/伪造 receipt | 普通真实事实可验证；旧普通 mutation 无效果；伪事实不被信任 |
+| A06 | proof 不足、缺 adapter、损坏状态、真实等待、无进展 | 不混淆权限/能力/完成；认证拒绝准确；纠正有界且不重做业务 |
+| A07 | prepare/诊断与认证/发布快照、同 revision 身份变化 | 同输入同结论；陈旧快照不得授予发布或错误认证 |
+| A08 | 原生 Goal complete、普通结束、必需子任务、祖先约束 | Goal 合同不被聊天结束绕过；历史兄弟不阻止当前工作 |
+| A09 | 普通 push、显式采用/撤销/恢复、错制品/过期/重放/不透明 runner | 普通push无票据要求；Guard发布入口/adoption预检拒绝且无效果；不可拦截普通opaque通道只断言无保护保证/不可认证，不伪称被挡；未知效果先回读 |
+| A10 | 旧 answered、缺来源、qualification、旧工具调用、迁移中断/重复/回滚 | 历史不改、无自动效果、新认证不继承假完成 |
+| A11 | UTF-8 中文/emoji/组合字符、换行、路径/大小写、稳定分页与 revision | 跨语言同投影、旧摘要不变、无漏项/重复/越界 |
+| A12 | 真实混合工作流：解释→改文件→测试→用户后续提交推送→compact/resume | 用户无需 Guard DSL/重复授权；有业务结果及证据，不能只测拒绝成功 |
+| A13 | 完成结果+未来收益/稳定性观察；简短恢复/显式持续执行；未提交说明/真实外部操作；真实待跑测试/明确要求当前评估；后续才新增授权；中英同义、跨句和顺序变形 | 限制说明不造待办/授权/外部登记；真实当前动作可提醒；两种继续原因可区分；Stop按当时事实判定，普通结束不等于认证 |
+
+独立维护者先冻结期望与核心集/留出集；实现者不能根据实际输出录 golden。固定负例误关闭、错误认证和受控发布错误效果均为零；正向业务路径、纯问答和真实同义表达全部满足预期。发现测试 oracle 错误可单独审议纠正，保留旧结果与理由，不能把产品失败直接重标“边界”。连续第二个同族反例触发入口×动作×字段×状态的集中审计，再统一返还阻断清单。
+
+本地确定性、生产适配器接线、真实模型任务、原生平台及制品是不同证据。四个产品×平台泳道（DSH/Codex 各自 macOS/Windows）分别跑 A12 的受支持业务路径，并在同一真实模型业务中加入 A13 的诚实限制说明及真实剩余动作对照，记录 loaded version/制品身份、根请求、工具轨迹、业务回读、剩余状态、额外澄清与 Guard 开销。使用一次性仓库/profile，明确批准的隔离 push 目标；没有网络目标授权可先做本地 bare remote 源测试，但不得冒充真实跨主机网络验收。模型对话措辞无需相等，核心结果必须符合 oracle。无需 Guard 的额外用户授权轮次在必修无歧义流程中为零；必要平台审批单独统计。
+
+真实模型预算或通道缺失时停止于该门槛，不能用“28 个安装/拒绝检查通过”替代正向任务。配对核心对齐验收要求全部必修泳道完成；一个产品完成可保留候选，但不能宣称已与另一产品对齐。
+
+## 13. AC12：开发、计划审查与发布边界
+
+本轮交付是规划合同及两份计划，不是产品 schema/fixture 冻结或运行时实现。开发 P0 先完成 schema/fixture/reference 接口、消费者及两宿主最低能力清单（真实工具call/result字段、readback、来源信任、持久化水位和平台可用性，至少覆盖AC06正向路径），独立审查后才开始依赖该合同的双端实现；可以先做不依赖新 schema 的有限接口调查。
+
+计划审查固定 authority、identity、state_effect_readback、canonicalization、platform_feasibility、migration_versioning、verification_release_boundary 七个镜头；可复现正确性矛盾、不可实现要求、互操作冲突为 P1。集中返还，修复只复审受影响部分，无开放 P1 和必要机械检查通过即结束本轮计划评审。新镜头/权限来源/缩减必修范围须显式重开，不能在收尾暗中改合同。
+
+本地开发、提交、CI、制品、原生、发布与日常安装分别授权与记账。实施阶段是否提交由当时用户授权决定；本计划不继承其他任务的发布许可。两个产品独立版本和制品身份，协调验收不要求同一天发布。若双方必修核心无法满足，保持未完成或由用户明确改范围，不以单边更多测试宣布对齐。

package/docs/CORE_ALIGNMENT_PLAN_REVIEW.json

@@ -0,0 +1,144 @@
+{
+  "schema": "multi-repository-plan-freeze/v1",
+  "subject": {
+    "kind": "plan_spec",
+    "paths": [
+      "docs/CORE_ALIGNMENT_CONTRACT_V2.md",
+      "docs/DEVELOPMENT_PLAN_0_7_0.md"
+    ],
+    "sha256": "d9b19bddfa99fff432e1001b762543049a02fcd62060821bfc8b19b4514c7f96",
+    "version": "070-014-plan.2"
+  },
+  "owners": {
+    "mutation_owner": "coordinator",
+    "reviewers": [
+      "mechanism_review",
+      "codex_next_audit"
+    ]
+  },
+  "review_contract": {
+    "lenses": [
+      "authority",
+      "identity",
+      "state_effect_readback",
+      "canonicalization",
+      "platform_feasibility",
+      "migration_versioning",
+      "verification_release_boundary"
+    ],
+    "blocking_severities": [
+      "P1"
+    ],
+    "scope_reopened": false,
+    "scope_reopen_reason": null
+  },
+  "baselines": [
+    {
+      "id": "dsh_source",
+      "kind": "mutable",
+      "value": "0.6.3 at 1735cfadecf0feddfa07bd811fa0297a49c7fd88; workflow/test-only baseline advanced; no 0.7.0 runtime implementation",
+      "refreshed_at": "2026-09-18"
+    },
+    {
+      "id": "codex_source",
+      "kind": "mutable",
+      "value": "0.13.9 at ce667adefd716f829fb1fb070b3089e789ed74c3; no 0.14.0 runtime implementation",
+      "refreshed_at": "2026-09-18"
+    },
+    {
+      "id": "stop_incident",
+      "kind": "mutable",
+      "value": "CGI-20260918-codex-future-observation-stop; Codex 0.13.9 macOS observed and isolated Hook reproduction; no DSH/Windows reproduction or runtime repair",
+      "refreshed_at": "2026-09-18"
+    }
+  ],
+  "issues": [
+    {
+      "id": "D070-R01",
+      "severity": "P1",
+      "status": "resolved",
+      "lens": "platform_feasibility",
+      "summary": "将效果前发布拒绝限定于Guard控制入口及契约预检，明确普通opaque通道无拦截保证/不可认证。",
+      "invalidates": [
+        "normative_spec",
+        "implementation_annex"
+      ]
+    },
+    {
+      "id": "CG14-R01",
+      "severity": "P1",
+      "status": "resolved",
+      "lens": "state_effect_readback",
+      "summary": "继续提示的actionable前提与虚假完成/proof纠正分离，合计每turn一次预算。",
+      "invalidates": [
+        "normative_spec",
+        "implementation_annex"
+      ]
+    },
+    {
+      "id": "CG14-R02",
+      "severity": "P1",
+      "status": "resolved",
+      "lens": "authority",
+      "summary": "显式release profile仍进入发布模式；空契约相关发布fail-closed。",
+      "invalidates": [
+        "normative_spec",
+        "implementation_annex"
+      ]
+    },
+    {
+      "id": "CG14-R03",
+      "severity": "P2",
+      "status": "resolved",
+      "lens": "platform_feasibility",
+      "summary": "P0加入两宿主真实工具事件、来源信任、readback、水位及平台能力清单。",
+      "invalidates": [
+        "normative_spec",
+        "implementation_annex"
+      ]
+    },
+    {
+      "id": "CG14-STOP-R01",
+      "severity": "P1",
+      "status": "resolved",
+      "lens": "state_effect_readback",
+      "summary": "Planning gap closed with AC05.1 action provenance/as-of facts, separate persistence/resume reasons and external-operation registration, plus A13 positive/negative production-path acceptance. Runtime incident remains reproduced and awaits implementation.",
+      "invalidates": [
+        "normative_spec",
+        "implementation_annex"
+      ]
+    },
+    {
+      "id": "D070-STOP-R01",
+      "severity": "P2",
+      "status": "resolved",
+      "lens": "verification_release_boundary",
+      "summary": "D070-00 explicitly freezes AC05.1 fields/version identities and A13 independent oracle at P0; M2 wires the frozen contract rather than defining it late.",
+      "invalidates": [
+        "implementation_annex"
+      ]
+    }
+  ],
+  "gates": [
+    {
+      "id": "structural_docs",
+      "status": "passed",
+      "evidence": "DSH repository audit: 29 Markdown files, zero errors/warnings; documentation unit tests 3/3 and release-pack tests 2/2 passed. Codex scoped audit: 2 Markdown files, zero errors/warnings; full validate-skills passed 36 skills. Native/product implementation acceptance is not claimed."
+    },
+    {
+      "id": "shared_copy",
+      "status": "passed",
+      "evidence": "Byte-identical shared planning copies; SHA256 523f9239168fb11d8daf72d6c3348b3121caa1b05aaa7f32afd3692952c477d5."
+    },
+    {
+      "id": "independent_review",
+      "status": "passed",
+      "evidence": "Plan.1 seven-lens review retained for unchanged contract. Incident reopened authority/state-effect/verification and affected migration only. mechanism_review and codex_next_audit independently read final bytes; D070-STOP-R01 corrected and rechecked. No open P1. Planning freeze only; product P0 and runtime implementation remain pending. Prior subject cd86da843acbc38190307e8e604ddab6a3e464be857f4baa9da4b4b3db3bb755."
+    }
+  ],
+  "freeze_decision": {
+    "status": "frozen",
+    "subject_sha256": "d9b19bddfa99fff432e1001b762543049a02fcd62060821bfc8b19b4514c7f96",
+    "open_p1_ids": []
+  }
+}

package/docs/DEVELOPMENT_PLAN_0_7_0.md

@@ -0,0 +1,93 @@
+# DSH Completion Guard 0.7.0 开发计划
+
+计划版本：1.1，2026-09-18。配对版本：Codex Context Guard 0.14.0。状态：开发规划，未实施新运行时；本轮按新增授权提交并推送规划文档，不安装或发布。后续执行者的操作范围由当时用户指令决定。
+
+## 1. 目标与本版决策
+
+0.7.0 要改变默认工作方式：普通业务由助手通过宿主工具执行，Guard 负责不丢要求、观察事实和检查完成；显式发布契约才进入 Guard 的受控执行。目标是共同职责与可观察结果对齐，不能以“共享了摘要算法”或“双方都拒绝”代替。
+
+这是 pre-1.0 的功能与兼容边界调整，使用 0.7.0；Codex 独立使用 0.14.0。0.6.3 对资格传递、目标字段和旧记录的修复作为历史回归保留，但其 `ExecutionQualification` 不能继续成为普通任务入口。不得继续通过增加疑问词、主体词、动作词、重述模板来证明普通执行权限。
+
+共同规范见 [CORE_ALIGNMENT_CONTRACT_V2.md](CORE_ALIGNMENT_CONTRACT_V2.md)。AC01–AC12 为本计划必须遵守的职责合同；本文负责 DSH 的替换路径、工作包和验证。0.6.3 计划、合同修订、发布事实均保持历史原文，不能将其局部验收复用为新架构已通过。
+
+## 2. 可变基线与已实现资产
+
+实施入口重新核对 HEAD、dirty、分支、宿主 cohort、工具版本与写入者；以下是 2026-09-18 本地观察，不是实施时自动有效的事实。
+
+| 对象 | 基线及影响 |
+| --- | --- |
+| DSH 0.6.3 | `4c26bee90a7b9e8b26ebbe91f335e356e7589fc3`；规划开始时 clean |
+| Codex | 0.13.9，HEAD `ce667adefd716f829fb1fb070b3089e789ed74c3`；0.14.0 尚是计划 |
+| 共享材料 | v1 镜像 pin `b59fcfe1aaf8ead3f0438bc67dc7f725c869a473`；v2 为 DSH 单边 candidate，不是共同验收 |
+| 本地已有能力 | 来源、work-unit/后代闭包、交付、分页、proof、migration、npm release 路径均已有实现；优先重接职责，不重造一套平行状态 |
+| 原生与安装 | 0.6.3 的已记录验收与安装只绑定旧制品；不证明0.7.0行为，不代替重启后的运行状态 |
+
+源码重点：`src/domain/{semantics,capture,derive,closure,checkpoint,stop-policy,goal-gate,compatibility,release}.ts`、`src/runtime.ts`、`src/tools/{evidence,action-preparation,prepare,release}.ts`。实施时检验路径存在，不猜未有的宿主 Hook 或 API。
+
+## 3. 逐机制处理决定
+
+| 0.6.3 机制 | 0.7.0 处理 | 必须保留的保护/替代路径 |
+| --- | --- | --- |
+| 文本生成 executionQualification，再授权普通 action | 新普通路径删除依赖，旧字段仅历史解码；普通操作移至宿主工具 | 原始禁止/等待仍给助手恢复；不把普通工具放行说成授权 |
+| context_guard_action 与 evidence 内 effect 分支 | 默认任务停用副作用；兼容调用只返回迁移诊断 | 已采用 release 的专用表面独立保留完整前置校验；不能用 policy 参数绕开 |
+| prepare 的“当前能执行吗” | 变为只读事实/证明诊断；普通任务无必要前置调用 | 同输入诊断与认证/发布判据一致，陈旧快照不可复用 |
+| Guard 自有 producer 链作为主要效果证据 | 接入真实宿主普通工具及回读，按 predicate 验证 | 来源/目标/前态要求不降低；历史不足不重复业务操作 |
+| informational/executable 的整句语言判定 | 变为覆盖完整原文的解释记录，未知残余保留 | 信息交付与业务执行分开；模型解释不制造事实或权限 |
+| pending/needs_review 与 Stop/Goal 相互牵连 | 普通结束、完整认证、Goal complete 分开 | unknown 不强迫普通工具前置审批；旧误完成仍阻断新认证 |
+| 目标字段与身份检查 | 复用精确身份库，分开根约束、实现选择、解析和观察 | 完整元组、大小写、跨仓库来源及 revision 仍严格 |
+| 现有 release 机制 | 保留并接新事实模型；最低保护现有 registry publish 表面 | 明确覆盖/不可覆盖，采用前拒绝不可履行契约，不引导绕行 |
+| upstream-deltas 的单一 aligned 标签 | 改为实现状态与实测比较状态两维 | 相同 fixture 双端结果及源码身份才可 aligned |
+
+不以删除旧代码行数衡量完成。默认工具描述、恢复提示、实际注册入口、影子调用、Goal 回调、旧会话重放和文档必须一起迁移；仅在普通工具外再包装一层“新认证工具”不满足本版目标。
+
+## 4. 工作包、所有权与先后关系
+
+| 包 | 具体产出 | 依赖及退出条件 |
+| --- | --- | --- |
+| D070-00 共同核输入 | 与 Codex owner 完成 AC01–AC12 的schema（含AC05.1当前动作依据、两类继续原因、as-of水位及版本身份）、规范事件/fact、投影、S/A fixtures（含A13独立oracle/反例）、协议身份、proof/release覆盖及真实宿主工具/事件能力清单 | P0 在 Codex 上游冻结，DSH精确镜像；不先写另一份单边v2 |
+| D070-01 默认路径迁移 | 去除普通 mutation 门禁/效果分支及资格依赖，更新真实工具注册与提示；保留显式release入口 | AC01/02，旧工具误调用无效果；普通任务无Guard授权轮次 |
+| D070-02 原生事实与证明 | tool call/result/持久化水位转换、普通文件/测试/Git回读、action-event/state-outcome分层 | AC06/07；正向可认证，缺能力诚实，副作用不重放 |
+| D070-03 解释与闭包 | 接统一来源/coverage、信息交付、目标关联、supersession、资产和分页；复用现有单元状态 | AC03/04；纯信息正常关闭、混合/未知不丢、相同原文入口可对照 |
+| D070-04 Stop 与 Goal | 普通结束、明确完成主张、proof、Goal completion 分层；落实AC05.1当前动作依据、原因分离、as-of判定；进展指纹与纠正预算 | AC05/08；A13不误造工作/等待，真正漏项仍提示；有界纠正不自旋，不新增host调度/暂停 |
+| D070-05 迁移与退役 | 0.6.3旧资格/answered/工具调用/票据迁移，协议/schema与回滚清单 | AC09；旧历史不改，旧发布效果未知不重做，正向恢复可达 |
+| D070-06 双端差分与声明 | Python/TS纯核、双端原文入口、生产注册/持久化/compact；重建两维delta | AC10/11，必修集无差异，不能用宿主专属标签排除共同需求 |
+| D070-07 候选与交付 | 版本、双语README/changelog、API迁移说明、dist、制品与四泳道原生计划 | AC12；独立证据绑定；按另行授权进入候选/原生/发布 |
+
+00先于依赖新schema的实现；01/02必须作为一个纵向切片验证，避免先拆执行器却留下无证据可完成。03/04接同一状态，05在新路径稳定后完成。06贯穿各包，07不允许用文档把未通过项写成完成。一个worktree一个writer；共享规范由上游owner串行修改，两个产品可各自实现不同宿主适配。
+
+## 5. 首个纵向切片与可执行里程碑
+
+M1（架构可行）：隔离普通任务“解释配置 → 修改指定文件 → 跑测试 → 回读”从真实宿主工具进入新 fact，再到完成判定；同时验证零效果final、无关成功、缺adapter、旧action调用。通过标准是普通工作没有Guard准备/审批步骤、正确结果可认证、缺证不误认证。M1不通过不得继续堆语言用例或候选全矩阵。
+
+M2（共同核心）：加入AC05.1当前动作依据与A13成对用例，再加入同工作单元跨仓库后续提交推送、信息/执行混合、真实歧义、明确等待、compact/resume、资产与完整范围proof；两端原文与规范事件双泳道均比较。完整矩阵见共同合同A01–A13及Codex计划S01–S12。
+
+M3（兼容与受控发布）：0.6.3旧会话/旧工具/旧资格恢复，旧证书历史保留；新完成资格不继承假通过；显式registry发布的成功、错身份、过期、重放、超时未知与读回。普通push全程不自动激活release。
+
+M4（候选）：本地全部必修通过、有限冷审无开放P1、产品文档与生成物一致；准备源码候选，不等于原生或发布放行。M5在另行授权后完成两产品×两平台同源/各自同制品的真实正向业务验收，再给出对齐结论。
+
+## 6. 验证与防止反复返工
+
+- 先锁定合同、独立期望和失败家族，再实现。已有事故是种子，不是期望的唯一来源；保留同义留出集与正常流程，不能全unresolved或只测拒绝来过关。
+- 同族第二个反例触发集中入口×动作×字段×状态审计；统一返还清单，停止“找到一条→全矩阵→再找一条”。修复后只复验受影响合同和开放项。固定集全部满足才冻结，不无限增加语言功能。
+- 按diff运行所属Vitest/portable/conformance；架构定型执行AGENTS规定完整矩阵：typecheck、lint、test、test:release-pack、test:stats、build、pack:check、文档审计及单测、diff check。生成dist须稳定；提交后的clean生成物检查另做，不能为了旧HEAD无diff撤回正确产物。
+- API/schema/摘要改动要跑全部消费者、跨语言和旧状态；不要只测直接函数，至少覆盖真实注册、结果materialization、持久化重放、Stop与Goal接线。
+- 真实模型A12必需，不能再用只有注入请求/检查拒绝的原生探针替代。业务只在一次性仓库/profile，网络push须有明确隔离目标权限；不重放事故原业务。
+- 对齐表列共同合同版本、双方commit、fixture digest、实际生产入口、平台、skip和差异。无相同API名不是不适用理由。必修差异或缺失就是未完成，只有宿主专属细节可不同。
+
+发布门槛保持：候选CI portability → 冻结唯一tgz → macOS/Windows相同字节与各自真实业务验收 → 按授权发布既定制品并公开回读。Codex用自己的runtime/cache身份，不要求两个产品hash相同。不得继承0.6.3原生证据为0.7.0通过。双方完成之前只能声明本侧候选状态。
+
+### 6.1 新增事故：未来观察说明误变成当前工作
+
+Codex 0.13.9 在本轮修复完成答复中，将未来使用效果的限制说明当成 generic 当前待办，随后把修复指令推为持续执行要求并阻止结束。已在安装版本的隔离 `UserPromptSubmit → Stop` 入口复现；改写为稳定性观察仍触发，真实待跑测试正例也会触发。移除限制说明后可静默结束，但“未提交”还可能被误标为 external wait，说明只修一个匹配词会留下相邻错误。
+
+DSH 尚无此具体事故的本机复现，不应复制 Codex 的补词方案。将 AC05.1 作为 D070-04 的共同模型要求：未来评估/能力限制不造待办，明确真实动作才构成续跑依据；解释候选不能签发权限，真实等待有来源。默认工具边界及已有 proof/Goal/release 保护不改变。
+
+新增 A13 在纯核、生产 Session/Stop/Goal 接线、持久化恢复和四泳道真实模型路径复验。成对保留“已做完本轮任务但收益以后观察”和“本轮测试尚未跑/用户明确要求现在评估”；还要测后来的提交推送指令不会反向改变前一次 Stop。独立标注期望：误继续为零、误造已登记等待为零、真实剩余动作不漏掉；不以全部静默或全部未决过关。公共合成 fixture 由 Codex 上游维护；错误素材库记录 `CGI-20260918-codex-future-observation-stop`，仅作为事故索引，不成为公开产品依赖。
+
+## 7. 不在本次范围与停止规则
+
+不重写DSH调度/权限/会话实现，不引入额外远程模型服务，不扩张所有操作的认证适配器，不增加宿主自动化，不追求任意自然语言完备，不把缺能力的动作变成新的强制授权语法。
+
+开发计划已经选定责任分离方向；实际wire/schema/reference在P0冻结。若宿主不能提供最低普通证据路径、旧接口不能安全退役或必修release路径不可履行，记录具体阻塞和最小方案，先修对应合同而不是隐瞒降级。削减必修功能、改变权限来源或让旧资格继续控制普通任务，必须显式重开计划，不能以实现方便自行决定。
+
+本轮仅规划；规划文档按当前授权提交推送。执行实现、跨平台验收、发布和日常升级需由用户后续安排，不能把本计划当作已授权执行全部阶段的提示词。

package/docs/LOCAL_ACCEPTANCE.md

@@ -1,5 +1,25 @@
 # Local Acceptance
 
+## 0.7.1 recovery feedback patch (2026-09-22; source evidence)
+
+The candidate repairs inconsistent ordinary recovery feedback, preserves current prohibitions and waits, and retains the dependency-free cleanup condition. The independent source review exercised normal and unavailable views at 512, 1000 and 4000 characters, complete read-only boundary details, source and revision failures, and historical sibling isolation. The complete local deterministic matrix passed with 2587 tests and four skips; lint retained 30 existing warnings. An independent build matched all six generated runtime files. These results bind to the reviewed source; they do not prove that a running host has loaded the package.
+
+Exact candidate CI and macOS/Windows native annexes must identify the release commit and the same canonical tgz. Use the [versioned Release](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.7.1) for final publication identities and attached results. Until those results are available, this packaged source record supplies no native, model or publication pass. The known combined-wait wording limitation and commentary-answer/compaction continuation boundary remain outside this patch's claims.
+
+## 0.7.0 historical source candidates (2026-09-21)
+
+This entry separates exact candidate source, CI, package, native-host and model evidence. It does not itself establish a tag, npm publication or daily installation. The shared core/v2 source and mirror bytes are pinned to Codex Context Guard commit `cb415cbe374d452e4a0c71e9e292d20e31f23b0e` by `tests/fixtures/conformance/core_v2/UPSTREAM_PIN.json`; the historical v1/digest pin is unchanged. Matching shared files does not establish complete runtime or feature equivalence.
+
+Committed candidate `583035bd90b8ee589d01b12487a057b655d43e41` passed its complete local deterministic source matrix and all ten jobs in [candidate CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/35520634411). Its canonical clean-source npm tgz (SHA-256 `732e6a904ad0fabd1f58281017404ec23416fe84d400b6cc870950bb10f649f9`) passed the macOS `host_bound_v070` native profile: 34 required gates and cleanup passed on the exact artifact. That annex skipped `real_model_request`. That historical artifact has no Windows exact-artifact native or complete fixed-model acceptance. npm publication, tag, GitHub Release and daily-profile installation require separate final-identity evidence. Later source or packaged-document changes create a new candidate: the 583035b artifact and macOS annex remain historical evidence for their original bytes, not acceptance of the changed package.
+
+A later source candidate, `519c9daffd011fdd297d12173dd62f9f8e67d2a3`, passed its complete local deterministic matrix and [candidate CI](https://github.com/GreenLv/dsh-completion-guard/actions/runs/35561059326). Its frozen CI tgz (SHA-256 `9f281f177d3b379ba1349f04206bc08d7d4949c50b73aba3ecdf1e3213f17d9d`) passed all 34 required macOS host-bound gates and cleanup; that native annex also skipped `real_model_request`. Separate macOS model captures established supported observer-backed edit/test/readback and future-observation/resume controls, but did not complete the required integrated A12 workflow or four-platform acceptance. One ordinary-edit capture lacked the required file observation; a persistent nonzero-test capture timed out before its control sequence. These remain recorded gaps, not passing results. Renderer-only nonzero output cannot certify that a named package test script started. New pin or packaged-document bytes require a new artifact identity; the 519c9da results retain their original subjects.
+
+In 0.7.0 ordinary edits, tests and Git operations run through DSH Host tools. The adapter reads the root source, confirmed Session events, persisted Host call/results and independent readback. A relative file or directory keeps its root-time Session locator and canonical filesystem containment; an opaque test or measurement target cannot be relabeled as a file. A successful mutation of a forbidden file stays a sourced completion violation even when an allowed edit succeeded. Old ordinary `context_guard_action` and `context_guard_evidence` calls create no business effect and return migration guidance; read-only file, Git and package-script readiness observations do not perform ordinary mutations.
+
+Stop and checkpoint distinguish a ready current action from future observation, unmet time or approval, and insufficient evidence. A later authorization does not backfill an earlier Stop. Root-scoped persistence, pause, cancellation and resume affect only the requirements in scope when recorded. An explicit observer method remains its own sourced obligation. A named foreground `npm test` or `pnpm test` can support a run requirement only with audited Host renderer bytes and a trusted terminal result; a run-and-report requirement differs from a pass target. Creating a file still needs trustworthy pre-effect absence. Arbitrary package-script metrics, nonzero exit codes inferred only from stdout markers, and unobserved Host effects remain insufficient. Historical v5 and pre-v6 generic records are preserved but cannot be upgraded into current authority.
+
+The versioned native entrypoint is `scripts/native_acceptance.py --gate-profile host_bound_v070`. Run `--preflight` with the intended source, artifact, host cohorts and unused result path before the actual native run. Its `dsh-host-bound/v4` annex binds the source commit, artifact digest, driver files, host locks, platform and cleanup. The nine Web and Headless cases cover real host registration, ordinary file/test readback, Stop, migration, Goal, locally mocked adopted release protection and history; Web restart adds a tenth persisted case. The mock release case performs no public registry request. A source replay or portable/CI pass is not a native, model or release pass.
+
 ## 0.6.3 core-alignment batch (2026-09-16)
 
 Source candidate, uncommitted, not frozen, not installed, not published. macOS,
@@ -924,7 +944,7 @@ errors/warnings, 81 Python tests passed, and both Codex recording checks were
 current. The recorder tests are now included in candidate CI's static job.
 
 The uncommitted candidate is not frozen, installed, or published. D062-04 was partial at that checkpoint; subsequent disposable-ledger probes above close its bounded lifecycle gap. T06/exact-artifact native acceptance and candidate CI remain pending. See the
-[0.6.2 release plan](RELEASE_PLAN_0_6_2.md) for the remaining ordered gates.
+[0.6.2 release plan](https://github.com/GreenLv/dsh-completion-guard/blob/784b5452b0da366a351dff6490fa46eeed2839a9/docs/RELEASE_PLAN_0_6_2.md) for the remaining ordered gates.
 
 
 Each section names its evidence boundary. Deterministic checks, isolated DSH_HOME composition, native-platform lifecycle runs, model sessions, CI, and public release readback are separate claims; none substitutes for another.

package/docs/PRIVACY.md

@@ -8,6 +8,11 @@ Context Guard stores only bounded, deterministic facts. It does not persist prom
 - Stable identifiers (R/A/P/E/C), revision, epoch, and event sequence references.
 - Tool name, call/result seq, outcome enum, capability, subject, and surface.
 - A bounded summary hash (truncated to 240 characters before hashing).
+- Provider-invisible private-ledger rows for explicit release reservations,
+  settlements, and restart intents. They contain hashed Session/header/cwd/
+  host/root bindings, release and target digests, bounded release readback
+  identities, record positions, and a hash chain. POSIX files are owner-only;
+  Windows uses the host account boundary and file flush supported by Node.
 
 ## Never stored
 
@@ -15,9 +20,15 @@ Context Guard stores only bounded, deterministic facts. It does not persist prom
 - Authorization headers, URL query values, credentials, or API keys.
 - Image bytes or binary contents.
 - Authenticated session state or raw transcripts.
+- Raw Session IDs, local paths, prompts, command output, or credential values in
+  the private ledger; those bindings are stored only as SHA-256 values.
 
 ## Failure behavior
 
 - Unknown, failed, or object-mismatched evidence cannot certify completion.
 - Without a durability checkpoint, evidence is recorded as `unknown`.
 - Corrupt or unknown Guard state refuses certification rather than guessing.
+- A missing ledger after its session anchor, a truncated or cross-session row,
+  a conflicting contract/target binding, or an uncertain writer lock refuses
+  release/restart reuse. Historical plugin notices are never promoted into the
+  stronger private-ledger channel.