dsh-completion-guard 0.8.0 → 0.8.1

package/docs/COMPATIBILITY.md

@@ -1,10 +1,26 @@
 # Compatibility
 
-Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
+Guard binds each accepted installation to its exact package identities, implementation bytes and dependency routes. Version admission and implementation qualification are separate checks; a matching version alone does not establish compatibility.
 
-## 0.8.0: DSH 0.1.7-rc.2 only
+## 0.8.1: DSH >=0.2.0-rc.1
 
-Current metadata and the production selector accept exactly `0.1.7-rc.2`, with Cordis `4.0.4`. The sole cohort is `dsh-0.1.7-rc.2-core-v1`: 46 exact package identities, backed by published-tarball SHA-256, SRI and installed module/manifest and actual dependency-path checks in `manifests/rc017-rc2-byte-audit.json`. A higher version is unregistered, not supported. Old cohorts exist only as historical test data.
+Version admission uses strict SemVer precedence, including later-tuple RCs and ignoring build metadata. The floor is `0.2.0-rc.1`, with no upper limit. Below-floor and malformed versions are refused. Cordis has a separate `>=4.0.4` peer range and qualification; a DSH version does not establish arbitrary Cordis compatibility.
+
+The reviewed host baseline is DSH `0.2.0-rc.1` / Cordis `4.0.4`, with 46 package identities and published implementation digests in `manifests/rc020-rc1-byte-audit.json`. Real installed-graph source entry measurements exist for that baseline. Native acceptance of the final Guard artifact on each platform remains a separate gate; no native validation of a future host is claimed.
+
+A newer compatible installation can be rebound with `--rebind-registry`, without adding an internal version row. The generator checks exact official registry metadata, archive SRI, installed manifests/modules and both CJS/ESM routes.
+
+Qualification binds ordered entry-selection fields (`exports`, `main`, `imports`, package type and dependency declarations) as well as the reviewed ECMAScript programs. A changed entry or dependency cannot inherit qualification merely because the old file remains unchanged. `guard-host-contract/v2` probes use actual bare package resolution in separate ESM and CJS processes, including the acquired dependencies. Critical adapter entries must resolve to the same authenticated target in both lanes; auxiliary libraries may have separate authenticated lane implementations. Changed compatible entries can qualify without a version row; incompatible API, Session or guarded-effect behavior fails the contract.
+
+A deterministic per-profile receipt binds all qualified bytes, dependency identities and actual Node startup conditions. Old v1 receipts require rebinding. If Node cannot execute an ESM package through `require`, the receipt explicitly records resolution-only CJS coverage; it does not claim CJS behavior was executed. Runtime and pre-install inspection verify the binding and recheck loading routes; a verified download or self-reported compatibility cannot establish qualification.
+
+An unqualified optional Goal implementation disables only Goal integration and reports `host_contract_goal_qualification_required`; independent core work stays available. Different dependency package versions are allowed when their individual identities and routes agree. New graph/module expectations create a new digest, so prior certificates cannot transfer. See [rebinding](HOST_LOCK_UPGRADE.md#rebinding-compatible-package-versions).
+
+The plain npm/node-semver expression `>=0.2.0-rc.1` excludes later-tuple prereleases by default. The installed DSH `0.2.0-rc.1` plugin manager and market discovery explicitly include prereleases: input probes accept `0.2.1-rc.1` and `0.3.0-rc.1`, and reject below-floor values without exemptions. pnpm 11.22.0's peer helper uses `includePrerelease: true`, and isolated version-form registry fixtures resolve those RCs. In the tested install mode it also resolved a below-floor peer despite strict-peer flags; package installation is therefore not a version-admission proof. The DSH and Guard floor checks independently reject that version. Other consumers must opt into equivalent semantics; plain npm matching is not the runtime version rule.
+
+## 0.8.0: DSH 0.1.7-rc.2 (historical fact, unchanged)
+
+0.8.0 metadata and its production selector accepted exactly `0.1.7-rc.2`, with Cordis `4.0.4`, cohort `dsh-0.1.7-rc.2-core-v1`, manifest `manifests/rc017-rc2-byte-audit.json`. That historical support scope is a property of the released 0.8.0 and is not rewritten by the 0.8.1 adaptation.
 
 Missing, duplicated, mixed, escaped or modified critical packages fail closed. A matching version or `allow-version` cannot bypass host identity. `auditedPlatforms: []` remains empty: local graph/module verification is separate from native acceptance of a frozen Guard tgz. See the [A01–A16 record](DSH_0_1_7_RC2_ACCEPTANCE.md).
 
@@ -61,7 +77,7 @@ Version 0.5.2 advertises only DSH `0.1.5-rc.2` and `0.1.5-rc.1`, with rc.1 retai
 ## Historical compatibility cohorts
 
 These are verification records, not support entries. An installed runtime built
-from any of them fails closed under the 0.8.0 policy.
+from any of them fails closed under the 0.8.0–0.8.1 policy.
 
 - DSH `0.1.1-rc.2` + dshmarket `1.36.0` + Cordis `4.0.1` is a retained, published-line cohort.
 - DSH `0.1.2-alpha.2` + dshmarket `1.38.1` + Cordis `4.0.2` is the published 0.3.2 cohort checked natively on macOS and Windows.
@@ -73,7 +89,7 @@ from any of them fails closed under the 0.8.0 policy.
 
 ## Rejection rules
 
-The sole current core graph is recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json); older graphs remain only in historical test fixtures. All core rows and actual critical dependency routes must match the current graph. Missing, mixed, duplicate, unknown or integrity-drifted core rows reject certification.
+The reviewed baseline core graph is recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json); older graphs remain only in historical test fixtures. For the baseline lock all core rows must match that graph. For a registry rebind, exact individual identities and qualified module expectations bind the new graph. Mixed dependency versions are allowed; missing required, duplicate, untrusted or integrity-drifted identities and wrong critical routes reject certification.
 
 Market versions do not select a core cohort. Market restart has its own protocol and loaded-instance checks; an unavailable adapter does not disable the core or erase pending restart work. Changing the actual core graph changes its digest and invalidates earlier certificates.
 
@@ -93,7 +109,7 @@ The plugin accepts an `activation` configuration value of `opt-in` or `always`.
 
 Before the Guard can certify work, generate and verify the host lock from the active DSH runtime and profile. Use the packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README. The default patch has no `hostLockPackages`, so the Guard fails closed until this flow succeeds.
 
-Since 0.4.3, the generator injects `hostLockPolicy: dsh-core/v1`, the runtime/profile source roots, `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` together. Replay rechecks those actual graph sources; legacy configuration without the policy and roots reports `host_lock_migration_required`. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate, multi-version, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
+Since 0.4.3, the generator injects `hostLockPolicy: dsh-core/v1`, the runtime/profile source roots, `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` together. Mount and protected entries recheck those actual graph sources; ordinary replay uses the mount result; legacy configuration without the policy and roots reports `host_lock_migration_required`. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate reachable instances, untrusted, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
 
 ### Capability groups
 
@@ -123,17 +139,16 @@ The ordinary runtime packages are host-provided peers:
 - `@deepseek-ai/dsh-session`; and
 - `@deepseek-ai/dsh-tools`.
 
-Goal support uses two exact optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
+Goal support uses two identity-bound optional peers as one capability. `@deepseek-ai/dsh-goal` owns Goal state, while `@deepseek-ai/dsh-tool-goal` owns the audited `update_goal` name, schema, and arguments. Both host-graph rows and the live Goal service and tool must agree. A profile without this complete pair can still load, but Goal-dependent integration stays inactive.
 
-Version 0.5.2 publishes `0.1.5-rc.2 || 0.1.5-rc.1` in top-level
+The historical 0.5.2 artifact publishes `0.1.5-rc.2 || 0.1.5-rc.1` in top-level
 `engines.dsh`, nested `dsh.engines.dsh`, and every DSH peer dependency. Cordis
 is versioned independently and remains `^4.0.2`. Plugin markets and package
 managers therefore see the same two exact host releases as the host-lock
 registry; neither an unregistered stable release nor a future version is
 implicitly admitted.
 
-The development dependencies retain exact `0.1.5-rc.1` pins as the build
-baseline. Historical peer declarations belong to their own release sections
+That historical artifact retained exact `0.1.5-rc.1` development pins. The current build pins DSH `0.2.0-rc.1` while public DSH peers declare the floor range. Historical peer declarations belong to their own release sections
 above and are not part of the 0.5.2 contract.
 
 ## Terminal outcome contract

package/docs/HISTORICAL_INCIDENT_COVERAGE.md

@@ -0,0 +1,148 @@
+# Historical incident coverage
+
+Verification date: 2026-09-28 (two evidence rounds). The adjudication round
+ran its working tree on the `1e88176` lineage and the four adaptation cases it
+introduced were first committed in `f4a9497`; the review-repair round added the
+scope-aware auditor fix, the 040 compaction/restore chain and the 042 A–E
+authorization-continuation chain on top; the third repair round fixed the
+core-v2 action-evidence mismatch (a Git operation can no longer satisfy a
+different same-repository action, and same-root clauses bind only their own
+evidence) and made the fully observed 042 chain certify. This document therefore binds each
+row to the NAMED CASE CONTENT and to the commit that first contained it — a
+bare base-commit number is never the evidence. The release candidate commit is
+a later, separate fact and is never referenced from packaged documentation.
+
+## Method and verdict vocabulary
+
+Every one of the 28 records gets its own row and one of four verdicts. A
+verdict is never inherited from a file-level or family-level green run.
+
+- `executed_pass` — the DSH adaptation of the record's failure family is
+  pinned by named `it()` cases with named assertions, and those cases pass at
+  the base commit. Family members may share one case; the case is named for
+  each member.
+- `not_applicable` — the incident surface does not exist in DSH (product
+  boundary). The row must still name the positive/negative controls that pin
+  the analogous invariant DSH does keep.
+- `analogue_only` — the input surface exists in DSH but the original expected
+  behavior is intentionally different. The row must name the tests that prove
+  DSH's actual path in both directions plus the documented difference.
+- `pending` — no replayable DSH evidence exists yet. The row must list the
+  missing minimal events, trigger steps, and observation conditions.
+
+## Library binding
+
+- Historical evidence lives in the maintainer's sanitized historical
+  regression set, kept outside this repository; raw records, private session
+  material and machine-local mappings are never copied into public files.
+  The per-record table below is a historical producer statement for a former
+  28-record subset and is superseded for acceptance purposes by the current
+  full-library adjudication (56 cases / 45 active — 29 Codex, 16 DSH — plus a
+  frozen 16-record legacy lineage), whose per-case verdicts, execution lanes
+  and candidate binding are tracked in that sanitized set.
+
+## New adaptation tests added for this adjudication
+
+1. `tests/v6-recovery-feedback.test.ts` — "a legal correction after the armed
+   follow-up ends the turn safely with the work still pending" (014/023 full
+   chain, see row).
+2. `tests/runtime.test.ts` — "keeps the protocol correction message
+   fixed-size regardless of session debt" (020/029).
+3. `tests/domain/v030-manifests.test.ts` — "routes simulation variants through
+   the same stateful mutation lane as the real mutation" (019/028).
+4. `tests/runtime.test.ts` — "a cleanup request never carries mutation
+   authority for product repair" (012).
+
+Review-repair round additions:
+
+5. `tests/v6-recovery-feedback.test.ts` — "an answered explicit question is
+   not re-injected after compaction and restore while the open one stays
+   current" plus the conversational-phrasing boundary control (040).
+6. `tests/native-file-v2.test.ts` — the CGI-2026-042 A–E describe: one root
+   commit-and-push authorization across five edit/commit shapes, with the
+   fully observed chain certifying through the registered checkpoint tool (042).
+7. `tests/native-file-v2.test.ts` — the action-mismatch review block: a Git
+   operation cannot satisfy a different same-repository action, and a compound
+   root satisfied by only one action keeps the other clause insufficient.
+
+## Per-record verdicts
+
+| ID | Original oracle (sanitized) | DSH production path / adapter | Regression evidence (exact case + assertion) | Verdict |
+| --- | --- | --- | --- | --- |
+| CGI-2026-009 | A-tier high-risk action (tag/release creation) observed with no pre-action decision and no ticket | `authorizeMutationFromProjection` fail-closed chain; every stateful mutation request needs an exact pending root-owned item | `tests/runtime.test.ts` "authorizes a mutation only for the exact pending root-owned action and target" asserts `mutation_contract_item_missing` when no item exists, plus revision/action/target mismatch denials; `tests/runtime.test.ts` it.each "rejects incomplete %s root authority before mutation" denies `publish`/`push` with incomplete root targets; `tests/v081-production-entry-drift.test.ts` "charges one validation to the checkpoint entry and one to the whole publish entry, and refuses drift between entries" pins real production entries to fresh validation | executed_pass |
+| CGI-2026-010 | Declared deferred disposition overrode observed authorized remaining work; disposition was not validated against its owner | `decideTurnBoundary` takes no assistant text at all; declared dispositions are bounded diagnostics only; a typed boundary needs an immutable root qualification | `tests/domain/v030-stop-boundary.test.ts` "keeps completion prose diagnostic-only and protocol decisions metamorphic"; `tests/domain/v030-stop-boundary.test.ts` "accepts user_wait only from a current immutable wait authorization"; `tests/runtime.test.ts` "steers exactly once for root persistence and yields to an active armed Goal" | executed_pass |
+| CGI-2026-011 | Quoted/annotated text was treated as a root correction superseding a prior requirement | Supersession requires an explicit mechanism: identical re-statement, or an explicit rebind confirmation with a proposal id; wrapped/misplaced control is ambiguous | `tests/domain/core.test.ts` "derives distinct IDs and supersedes identical re-statements" (R001 superseded only by an identical re-statement, `supersededBy` pinned); `tests/domain/v050-confirm.test.ts` "a valid control line that is not the first line is ambiguous, never applied" and "two different proposals in one message stay ambiguous without partial effect"; `tests/domain/v061-conservative-interpretation.test.ts` "a verbatim concrete instruction supersedes an unresolved clause (review repro: clarification lane)" names the only legal supersession lane | executed_pass |
+| CGI-2026-012 | Authorized cleanup scope silently continued into new product repair without separate authorization | Cleanup grants no mutation authority; a repair needs its own pending root-owned item with a matching semantic action and target | `tests/runtime.test.ts` "a cleanup request never carries mutation authority for product repair" — `authorizeMutationFromProjection` denies `modify` citing a cleanup item; `tests/domain/v062-capability-and-layers.test.ts` "only dependency_free enters the removal set" and "a clean tree or an empty worktree list never proves \"no dependants\"" bound the cleanup scope itself; `tests/v6-recovery-feedback.test.ts` "a cleanup request keeps the dependency-free condition at every budget and view state" | executed_pass |
+| CGI-2026-013 | Every prompt chained a child work unit; historical items kept entering Stop gating | Units open only from delegation-marked roots; a task switch opens a sibling; stale siblings never join the current view | `tests/domain/v060-unit-closure.test.ts` "an ordinary task switch opens a sibling that never blocks the newer unit"; `tests/domain/v060-unit-closure.test.ts` "the delegation vocabulary is closed: a subagent mention without an act never opens a unit"; `tests/v6-recovery-feedback.test.ts` "a stale pending sibling-unit record does not join the current recovery rows" | executed_pass |
+| CGI-2026-014 | Checkpoint gap re-triggered visible continuations far beyond one bounded correction | Checkpoint rejection arms one bounded follow-up; repeats dedup; a legal correction ends the turn safely; unfinished work is never marked complete | `tests/v6-recovery-feedback.test.ts` "invalid-proof: reminders do not repeat after a persisted continue and the same rejection" and the `failed-flush` twin (0 after 3 rejections); `tests/v6-recovery-feedback.test.ts` "a legal correction after the armed follow-up ends the turn safely with the work still pending" — full chain: reject → one injection → real successful host test → `observed` checkpoint → zero follow-ups → `handleGuardTurnStopping` returns `safe_yield_pending_preserved`, steers nothing, no certificate exists, item stays `pending`; `tests/domain/v051-host-loop.test.ts` "disarms the armed goal and stops further rounds and model calls" (real host loop: two production decisions then the bounded stop, zero further model calls) | executed_pass |
+| CGI-2026-015 | Declared user_wait/deferred were judged mismatched against an observed external_wait and each produced a visible continuation | Dispositions are strictly typed against their qualification source, not lexically compared: external_wait needs a live trusted-adapter operation, user_wait needs a root wait authorization | `tests/tools/boundary-integration.test.ts` "round-trips live jobs readback through derive, boundary tool, and persisted replay" (only a real `running` operation qualifies `external_wait`); it.each "maps pinned ctx.jobs status %s to %s without parsing output text"; `tests/runtime.test.ts` "live-requalifies every external_wait job immediately before effectuation" — a completed job yields `boundary_pre_effect_failure`, never a continuation; `tests/domain/v030-stop-boundary.test.ts` "requalifies a live external operation before yielding or disarming" | executed_pass |
+| CGI-2026-016 | hooks.json attached a statusMessage to every allow event and injected receipts on normal prompts | No DSH counterpart: DSH has no hooks.json surface and no statusMessage writer (`grep statusMessage src/` = 0 hits). Allow-path silence is pinned by controls. The one additional-context producer is the bounded read-only shell-workdir observation on bash/pwsh (`src/runtime.ts` workdir receipt), an evidence channel, not an allow-path status writer | Controls: `tests/v6-recovery-feedback.test.ts` "T0 stays silent; the first root carries the boundary once; …"; `tests/domain/v062-capability-and-layers.test.ts` "an ordinary business tool call gains no Guard approval requirement" and "a pending obligation can end silently without being reported as complete"; `tests/host-workdir-v070.test.ts` "records the same passive notice through the real Cordis tool waterfall" (the bounded receipt's exact scope) | not_applicable |
+| CGI-2026-017 | A-tier mutations always demanded an exact ticket even though no release contract was ever adopted | Release class needs an adopted contract AND the protected release surface; non-release stateful mutations need only root authority; adoption is explicit and durable | `tests/tools/v060-release-chain.test.ts` "publishes under a real adopted contract, reserves, settles, and reconciles" (the only allow path); `tests/domain/v060-release-migration.test.ts` "a keyword, a Skill or an installation never adopts a contract" and "a contract naming an unprotectable operation is refused at adoption"; `tests/domain/review-counterexamples.test.ts` "R2: missing observed repository/ref and invented readiness must not grant" (`releasePreEffectDecision` denied) | executed_pass |
+| CGI-2026-018 | Command classifier accepted any token whose basename matched git/gh, so echo/search arguments became tier-A/B actions | Whitelisted single-command parser: only the executable position is consulted; quoted/argument command words never become executables | `tests/domain/core.test.ts` "parses shell commands quote-aware (P0-2 / P1-2)" asserts `parseShellCommand('echo "ignored; pnpm test"').executables` is exactly `['echo']` and wrappers fail closed; "does not let quoted text invent an executable method (P0-2 negative)" and "does not let echo-only bash close a create requirement (P0-1 negative)" pin the denial side | executed_pass |
+| CGI-2026-019 | Explicit no-side-effect variants (`npm publish --dry-run`) consumed real-mutation authorization (false deny without recourse) | DSH deliberately has no simulation lane: the dry-run spelling classifies as the same stateful `publish` action. The verified boundary is the classification lane; the authorization/reservation/effect behavior beyond it is governed by the named release surfaces, not asserted here | `tests/domain/v030-manifests.test.ts` "routes simulation variants through the same stateful mutation lane as the real mutation" (`npm publish --dry-run` → `publish`, `git push --dry-run origin main` → `push`, both `isStatefulAction`, identical to the real spellings); prose-mention control: `tests/domain/v051-instruction-semantics.test.ts` "explaining a command is not executing it (0.6.1: unresolved, closable only via the interpretation route)" asserts no `publish` obligation from the explanation probe; the release-side denial controls live in `tests/domain/review-counterexamples.test.ts` (R1–R3: identity kind mismatch, invented readiness, failed-without-readback all denied) | analogue_only |
+| CGI-2026-020 | Stop correction message appended every requirement/acceptance id in the session, far beyond the 240-char budget | The real correction message is a fixed notice handed to the model by the production turn-stopping entry; its size is independent of open-item count | `tests/runtime.test.ts` "keeps the protocol correction message fixed-size regardless of session debt" — with 60 extra open items the steered message is byte-identical to the 1-item message, equals `PROTOCOL_CORRECTION_NOTICE`, ≤240 chars, and contains no item ids; packet budgets are a separate, existing surface (`tests/tools/v042-feedback.test.ts` "T08 reserves rules and next steps even after an oversized item") | executed_pass |
+| CGI-2026-021 | MCP thread-read alias set matched only the short name, so the real event never bound a readback subject | No DSH counterpart: DSH has no MCP thread-read tool or alias table (`grep read_thread\\|THREAD_READ src/` = 0 hits). Subject binding happens only through structured native-observation metadata and known adapters | Controls: `tests/domain/v030-capture-targets.test.ts` "$action captures root identity and rejects adapter target substitution" (it.each); `tests/native-file-v2.test.ts` "certifies an observed edit without a Guard execution qualification or resolution call" asserts a text-only or tampered state row yields `insufficient`/`incomplete` — echoed text can never bind as state evidence | not_applicable |
+| CGI-2026-022 | Reproduced supersedes CGI-2026-013 (same work-unit lifecycle family) | Same production path as CGI-2026-013 | Same three named cases as CGI-2026-013 | executed_pass |
+| CGI-2026-023 | Reproduced supersedes CGI-2026-014 (checkpoint failure cascade family) | Same production path as CGI-2026-014 | Same named cases as CGI-2026-014, plus `tests/runtime.test.ts` "steers exactly once for root persistence and yields to an active armed Goal" pinning `protocol_correction_already_issued` on the second attempt at the same boundary | executed_pass |
+| CGI-2026-024 | Reproduced supersedes CGI-2026-015 (disposition subclass family) | Same production path as CGI-2026-015 | Same named cases as CGI-2026-015 | executed_pass |
+| CGI-2026-025 | Reproduced supersedes CGI-2026-016 (allow-path status/ receipt family) | Same product boundary as CGI-2026-016 | Same controls as CGI-2026-016 | not_applicable |
+| CGI-2026-026 | Reproduced supersedes CGI-2026-017 (release machinery without adoption family) | Same production path as CGI-2026-017 | Same named cases as CGI-2026-017 | executed_pass |
+| CGI-2026-027 | Reproduced supersedes CGI-2026-018 (executable-position family) | Same production path as CGI-2026-018 | Same named cases as CGI-2026-018 | executed_pass |
+| CGI-2026-028 | Reproduced supersedes CGI-2026-019 (simulation classification family) | Same production path and verified classification boundary as CGI-2026-019 | Same named cases as CGI-2026-019 | analogue_only |
+| CGI-2026-029 | Reproduced supersedes CGI-2026-020 (unbounded Stop feedback family) | Same production path as CGI-2026-020 | Same named cases as CGI-2026-020 | executed_pass |
+| CGI-2026-030 | Reproduced supersedes CGI-2026-021 (thread readback binding family) | Same product boundary as CGI-2026-021 | Same controls as CGI-2026-021 | not_applicable |
+| CGI-2026-040 | An answered question was replayed into the recovery view after resume; the unit stayed active | Recovery injection consumes the current confirmed view: closed/answered work is not re-injected, unchanged packets dedup, re-injection needs real content change | Full compaction/restore chain: `tests/v6-recovery-feedback.test.ts` "an answered explicit question is not re-injected after compaction and restore while the open one stays current" — question A captured and answered in its own turn, question B captured and left open, then `compaction/summary` and a strict `Session.fromRestore` into a new session; the resumed registered pre-step injects nothing containing A and the restored contract keeps A `answered` while B stays `pending`. Input boundary controls, same file: "the original conversational question phrasing stays outside the contract entirely" (the original record's bare question is conversational in DSH and never becomes an obligation) and the existing resume/dedup lane "injects nothing for an observed ordinary closure after resume", "injects the unmet view after resume, dedups repeats, and follows real changes", `tests/runtime.test.ts` "does not re-arm recovery from a historical compaction summary". The original private question texts are not reproduced; the chain uses structure-preserving sanitized fixtures, so this row is the DSH adaptation of the failure family, not a claimed precise replay of the original inputs | executed_pass |
+| CGI-2026-041 | A mixed update+cleanup request collapsed to cleanup-only and the patch was denied | Mixed requests keep every execution obligation through prepare and the authorizer; answered information ranges are not re-listed | `tests/tools/v063-host-materialization.test.ts` "a mixed request keeps its execution obligations through prepare and the authorizer" — the prepared list keeps both execution items and each commit/push obligation is denied only for the real reason (missing authority), never collapsed; `tests/domain/v063-holdout-round35.test.ts` "an agreeing pair is inherited whole" / "a conflicting pair leaves only the branch open" pin clause-level preservation | executed_pass |
+| CGI-2026-042 | Ordinary host edit/commit/push forced re-authorization when the observer missed edit provenance; insufficient observation still denied | Authorization identity comes from the root contract items and never re-arms; each clause is satisfiable only by observations of its OWN semantic action (`src/core-v2/session.ts` evidence-applicability gate); certification tracks the shared-core closure | `tests/native-file-v2.test.ts` CGI-2026-042 describe, it.each over the five original shapes (A python-recorded edit/direct shell commit, B observed edit/direct commit, C explicit file edit/direct commit, D python-recorded edit/commit, E recognized edit/text-only result; the Python shapes are session-recorded adaptation forms, not native Python-process runs): ONE root message authorizes modify+commit+push, all three items share `sourceMessageId`, and `authorizeMutationFromProjection` authorizes the commit and push from those same root items with no new root input in every shape. The fully observed B chain certifies through the REGISTERED `context_guard_checkpoint` tool with per-clause bindings, each citing exactly its own effect+state ids; A/C/D/E keep the edit (and, for D, the wrapper commit) insufficient and refuse any certificate naming only `current_closure_unmet`, never the push binding. Supporting surfaces: "certifies an observed edit without a Guard execution qualification or resolution call" (tampered/missing observation → `insufficient`, `certifiable: false`), "reads back a native commit and push from fixed Git queries after persisted results" (wrong branch → `incomplete`; unbound amend output → `unavailable`), `tests/host-workdir-v070.test.ts` "does not retrospectively grant old calls that lack a call-time receipt". The same file pins the action-mismatch family directly: a Git operation cannot satisfy a different same-repository action (cross observations rejected, matching actions accepted) and a compound root satisfied by only one action keeps the other clause insufficient with the closure uncertifiable | executed_pass |
+| CGI-20260913-codex-archive-043 (archive 043) | Report-level (Windows 0.12.1): repeated authorized-commit denials after real commits | Analogue surface exists (`tests/native-file-v2.test.ts` commit/push readback; `tests/domain/v051-target-identity.test.ts` refused push targets) but the record itself has no replay | Missing minimal events: (1) the root message binding commit-and-push intent, (2) the real `git commit` in both the compound and independent forms, (3) the denial event with its exact reason code per push attempt, (4) the persisted projection showing the commit evidence at denial time. Trigger steps: fresh Windows rc.2 host, current candidate, ordinary repo, one explicit authorization, edit→commit→push via both command forms. Observation conditions: full hook/session log with reason codes; no private repo content in the record; native Windows only — CI or synthetic hosts do not qualify A cold/warm first-open measurement does NOT produce any of these events and is not acceptance for this record; remaining input: a dedicated native commit/push denial run (owner: coordinator native batch). | pending |
+| CGI-20260913-codex-archive-044 (archive 044) | Report-level (Windows 0.12.1): an unnecessary supersession clarification on an ordinary follow-up | Analogue surface exists (`tests/domain/v061-conservative-interpretation.test.ts` conservative supersession) but the record has no replay and its own pure probes did not reproduce | Missing minimal events: (1) the prior durable state with ≥2 unfinished requirements, (2) the exact follow-up prompt, (3) the emitted clarification event (or its absence) with reason code, (4) a current-version pure-probe run for contrast. Trigger steps: rebuild the two-open-requirement chain on a current host, send the follow-up, compare legacy-state vs pure-probe event streams. Observation conditions: durable session logs on both runs; same version/platform; the comparison, not either run alone, is the evidence A cold/warm first-open measurement does not exercise this chain; remaining input: the paired legacy-state/probe run (owner: coordinator native batch). | pending |
+| CGI-20260913-codex-archive-045 (archive 045) | Report-level (Windows 0.12.1): a generated private diagnostic control was rejected as malformed, with no successful diagnosis | No DSH analog can be named without the control grammar; the record explicitly omits the raw control and the rejecting event is unresolved | Missing minimal events: (1) the regenerated control value with its documented grammar, lifetime and wrapper, (2) the emitting tool/event identity, (3) the exact rejection event with reason code, (4) one accepted-control run for contrast. Trigger steps: on a current host invoke the diagnostic lane with a valid current control and invalid controls; capture accept/reject per input. Observation conditions: rejection captured from the session log; no real private control value archived; the accepting run must show the bounded diagnosis the record never observed A cold/warm first-open measurement exercises none of this; remaining input: regenerated control grammar + paired accept/reject run (owner: coordinator native batch, after the grammar is recovered). | pending |
+
+## Denominator and totals
+
+- `executed_pass`: **19** (009, 010, 011, 012, 013, 014, 015, 017, 018, 020,
+  022, 023, 024, 026, 027, 029, 040, 041, 042)
+- `not_applicable` (Codex-only surface, with controls): **4** (016, 021, 025, 030)
+- `analogue_only` (documented intentional difference, both directions proven): **2** (019, 028)
+- `pending` (report-level, no replay conditions met): **3** (043, 044, 045)
+
+Only the Codex Python/runtime suites of the private library were treated as
+upstream evidence; no row above counts a Codex-runtime pass as a DSH pass.
+
+## Regression suite runs used for this adjudication
+
+- Adjudication round (working tree at `1e88176`, cases first committed in
+  `f4a9497`): batch 1 — `tests/v6-recovery-feedback.test.ts`,
+  `tests/runtime.test.ts`, `tests/domain/v030-manifests.test.ts`: 3 files,
+  105 passed; batch 2 — the 23 remaining evidence files named in the table:
+  23 files, 448 passed, 1 skipped (pre-existing platform skip), 0 failed.
+- Review-repair round: reviewer repro patches verified RED at `b1ae3b6`
+  (4 negative scope cases + the full `revalidateCoreLock` entry), then GREEN
+  after the scope-aware auditor fix; `tests/domain/host-dependency-audit.test.ts`
+  20 passed; rc017-adaptation family 143 passed / 3 skipped; upgrade,
+  target-identity and qualification families 246 passed; full matrix and CI at
+  `a0bf01f` green.
+- Action-mismatch repair round: reviewer patch verified RED at `a0bf01f`
+  (2 failed / 2 passed), then GREEN after the evidence-applicability fix in
+  `src/core-v2/session.ts`; `tests/native-file-v2.test.ts` 16 passed;
+  rc017-adaptation 143 passed / 3 skipped, qualification 172, target-identity
+  168, upgrade 82; mirror/conformance/portable-semantics/081 entries
+  207 passed / 1 skipped. Full deterministic matrix, CI, and packaging stay
+  governed by the candidate freeze record; this page pins per-case evidence
+  only.
+
+## Explicit gaps carried forward
+
+1. 043–045 stay pending on their own listed minimal events. A cold/warm
+   first-open latency measurement produces none of those events (no
+   commit/push denial chain, no legacy-state clarification chain, no
+   diagnostic-control grammar), so it is not an acceptance vehicle for them;
+   each row names its remaining input and owner.
+2. 019/028 remain an intentional architectural difference at the verified
+   classification boundary: DSH classifies simulation spellings as their real
+   stateful mutation. If DSH ever grows a simulation lane, the family needs a
+   dedicated regression before release.
+3. 016/021/025/030 are Codex-product-only surfaces; they cannot regress on
+   DSH and stay recorded for cross-product audits, with the controls named in
+   their rows re-checked if DSH grows an allow-path status writer or an MCP
+   thread-read adapter.

package/docs/HOST_LOCK_UPGRADE.md

@@ -1,6 +1,20 @@
 # Upgrading the core host lock
 
-Version 0.8.0 requires DSH `0.1.7-rc.2` and Cordis `4.0.4` only. Its 46 critical packages must match the registered identities, implementation bytes and actual dependency paths. Guard's exact DSH core is separate from optional market versions.
+Version 0.8.1 requires DSH `>=0.2.0-rc.1` and qualified Cordis `>=4.0.4`. Upgrade order and what each step produces:
+
+1. Stop the host, upgrade DSH to `0.2.0-rc.1` or a later version, then install this Guard version.
+2. Rebuild the host lock for each Guard profile by running `inspect`, `inject` and `verify-dump` from an accepted package or matching source checkout:
+   `node bin/dsh-completion-guard-host-lock.mjs inject --runtime-root <DSH runtime> --profile-root <profile>` — then verify with `... verify-dump --dump-config <file>`. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
+3. Start each Web/Headless profile when needed so it reads the rebuilt lock. The checks above do not require a running host.
+
+Failure readbacks distinguish these cases:
+
+- `host_lock_migration_required`: the configuration lacks the policy or source roots. Supply `--runtime-root` and `--profile-root` when rebuilding the lock.
+- `host_lock_version_below_minimum`: DSH is older than `0.2.0-rc.1`. Upgrade DSH first.
+- `host_lock_version_mismatch`: the installed graph differs from the reviewed baseline in version or integrity. For a later compatible version, use `--rebind-registry` to acquire and qualify the published graph. For the baseline, restore the recorded identities.
+- `host_lock_installed_graph_drift`: installed bytes or routes changed after the audit. Inspect the change before rebuilding the lock.
+
+The floor is `>=0.2.0-rc.1` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
 A normal market update no longer changes the core digest. A plugin that changes
 which core packages actually resolve still invalidates the lock.
 
@@ -31,32 +45,26 @@ dsh --profile web --dump-config | "$GUARD_HOST_LOCK" verify-dump --runtime-root
 
 **Run this block after the runtime is already on the target DSH version, not
 before.** `inject` records the absolute runtime and profile roots and binds the
-graph it finds there, and runtime replay re-reads those same roots. Injecting
-against the old runtime therefore writes a lock that describes a graph the new
-runtime no longer has, and it will fail on the next replay. Order: upgrade the
-runtime, restart it, then inspect/inject/verify.
+graph it finds there, and each session mount validates those same roots once,
+with every security-sensitive entry validating them again at its own decision.
+Injecting against the old runtime therefore writes a lock that describes a graph
+the new runtime no longer has, and it will fail at the next mount or the next
+protected entry. Order: stop the host, upgrade DSH and install Guard, inspect/inject/verify each profile, then start it when needed.
 
 `inject` **writes to `<profile>/cordis.patch.yml`** — it replaces or adds Guard's
 managed block in that file. Back the file up first. The same file is the one
 `docs/LOCAL_ACCEPTANCE.md` tells you to preserve.
 
-**Read the verdict from the JSON body, not from the exit status.** All three
-commands print a JSON object whose `status` is the verdict — `supported`,
-`unsupported` or `unavailable` — together with `cohort_id`, `host_lock_digest` and
-`audit_provenance`. Note that `inspect`, `inject` and `verify-dump` exit **0** even
-when that status is `unsupported`; only `inspect-graph` exits non-zero on an
-unsupported graph, and only a thrown error produces `status: "unavailable"` with a
-`reason_code` on stderr and exit 1. So a shell check of `$?` alone will not tell
-you whether the graph was accepted.
+**Check both the JSON verdict and the exit status.** Accepted commands print `status: "supported"`. A missing graph, drift, incompatible implementation or untrusted registry description reports a specific `reason_code` on stderr and exits 1. `inspect-graph` is a pre-install graph check; it does not grant runtime authority.
 
-For Headless, use its profile path and `--profile headless`. On Windows, use the
+For Headless, use its profile path for the host-lock commands and `dsh --profile headless --dump-config` for the dump. On Windows, use the
 installed `.cmd` launcher and Windows absolute paths. A strict repeat leaves
 the package and profile contents unchanged. Restarting or enabling a daily
 profile remains a separate user action.
 
 ## Check a Headless profile before installation
 
-A DSH `0.1.7-rc.2` Headless profile can have no external dependencies and no private `node_modules` or lockfile. From an accepted package or matching source checkout, `node bin/dsh-completion-guard-host-lock.mjs inspect-graph --runtime-root <runtime> --profile-root <profile>` checks that state without initializing or launching the profile.
+A DSH Headless profile can have no external dependencies and no private `node_modules` or lockfile. From an accepted package or matching source checkout, `node bin/dsh-completion-guard-host-lock.mjs inspect-graph --runtime-root <runtime> --profile-root <profile>` checks that state without initializing or launching the profile.
 
 This narrow case requires exactly the installation-owned `dsh-base` and `dsh-headless` bundles, a complete audited runtime core, and matching bundle versions, package-map origins and patch files. Declared but uninstalled dependencies, partial map/lock pairs, unexplained local modules and foreign parent-module fallbacks are rejected. Existing profiles with both graph files retain their active-importer checks; damaged files are not treated as an empty graph.
 
@@ -65,11 +73,15 @@ The result labels `inspection_scope: pre_install_target` and `profile_graph.stat
 ## What changes in the lock
 
 The generator writes `hostLockPolicy: dsh-core/v1`, the actual runtime/profile
-source roots, platform/profile kind and the complete 46-row core graph. The
-core manifest is version 2. Runtime replay re-reads those graph sources and
-requires the same exact core before using certificate authority.
+source roots, platform/profile kind and the actual core package graph (46 rows in the reviewed baseline). The
+core manifest is version 2. Each session mount validates those graph sources
+exactly once; ordinary replay (resume, compaction, step and command refresh)
+consumes that result without rescanning, and every entry that grants
+certificate authority — completion certificates, mutation authorization,
+release pre-effect decisions and Goal/Stop boundaries — validates the lock
+freshly at the moment of its own decision.
 
-Version 0.8.0 registers only `dsh-0.1.7-rc.2-core-v1`. Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use rc.2's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
+Version 0.8.1 registers `dsh-0.2.0-rc.1-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
 
 The manifest's `registry-derived-pending-native-audit` provenance and empty `auditedPlatforms` list describe its immutable source audit, which is part of the lock digest. Native acceptance belongs to each exact artifact's separate Release annexes; it does not rewrite that digest. Inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest.
 
@@ -88,7 +100,7 @@ that matters for deciding whether you are migrating or just drifting:
   a DSH upgrade, and both are cured by re-running inspect, inject and verify against
   the new runtime rather than by editing the lock.
 
-Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.8.0.
+Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.8.1.
 The shared digest-v3 encoder and its upstream fixtures are unchanged.
 
 ## Market and restart
@@ -120,4 +132,20 @@ exact artifact and platform; publication is recorded on its GitHub Release.
 
 ## Historical 0.5.1 evidence
 
-Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.8.0.
+Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.8.1.
+
+## Rebinding compatible package versions
+
+For a newer compatible installation, add `--rebind-registry` to `inspect-graph`, `inspect`, `inject` and `verify-dump` in the upgrade example above. This acquires the exact official archives and qualifies their consumed API contract. Changed programs run bounded probes in an isolated Node process; the command does not start DSH or install packages. A successful result binds a new lock. Keep the backup until dump verification succeeds.
+
+The version floor admits later releases and RCs by SemVer precedence. A new version does not by itself prove that Guard can read its events or authorize its effects. Rebinding separates published installation identity from adapter qualification:
+
+- Published identity is acquired from the official npm registry for each exact installed `name@version`. The registry integrity must agree with the installed lock, and the downloaded archive must reproduce that integrity. The archive supplies the manifest and module digests; local manifests and local lockfile SRI alone never establish provenance.
+- Qualification is independent of version rows. Comments and formatting can retain reviewed program identity; unrelated unconsumed modules are allowed. Equivalence also checks ordered entry-selection fields and the consumed dependency graph. Changing `exports`, `main`, `imports` or an active dependency requires qualification of the actual selected entry, even when the old file remains intact. Changed programs must pass `guard-host-contract/v2` API and Session V4 behavior checks using actual bare package resolution in separate ESM/CJS Node processes. These check immutable, contiguous event snapshots, restore preservation/refusal, fork recovery and unknown tool outcomes, plus consumed service APIs. A contract failure refuses the affected implementation. Optional Goal failures disable Goal integration while independent core work remains available.
+- The probe uses verified archives and exact installed dependency identities in a temporary directory. It receives no user environment or credentials, cannot write files or launch child processes, and has its network entrypoints disabled. It has bounded time/output and does not boot a host, run installation scripts or contact model providers. This is a finite contract check of official code, not certification of every possible host behavior.
+- CJS and ESM behavior results are recorded separately. Critical adapter routes must agree on one authenticated target; auxiliary dependencies may use separately authenticated CJS/ESM files. When Node lacks ESM-through-`require` execution, CJS resolution is checked and its behavior remains explicitly unavailable.
+- The generator stores a deterministic qualification receipt under the declared profile's `.dsh-completion-guard/host-contracts/` directory and puts its binding in managed configuration. The receipt binds exact package/module bytes and Node startup conditions; a package compatibility declaration or a descriptor without its issued receipt cannot establish qualification. Earlier v1 receipts are refused; run the same rebind commands to issue v2 receipts. Pre-install `inspect-graph` uses the same qualifier and byte/route audit. Inspection and authorization recheck the mixed-version graph, qualified bytes and both CJS/ESM routes in one fresh audit session; they do not repeat the behavioral probes.
+- Route checks use actual startup conditions from command-line flags and `NODE_OPTIONS`, including custom conditions, disabled addons and `module-sync` availability. Changing these inputs creates a new binding. Custom loaders or ambiguous configuration are refused rather than approximated.
+- A changed graph or trust description creates a new lock identity. Existing completion certificates and private authority records retain their old digest and cannot transfer. Reinject the lock, restart the profile under the user's control, and obtain new evidence.
+
+Rebinding writes only its qualification receipt and, for `inject`, the managed lock configuration. It does not start DSH, install packages, publish, or mutate session history. Foreground/default-workdir interpretations retain their narrower reviewed-byte qualification. Native acceptance of a later DSH version remains separate from this source-level compatibility rule.

package/docs/LOCAL_ACCEPTANCE.md

@@ -875,7 +875,7 @@ replaces it:
 | documentation audit | `python3 scripts/audit_repository_documentation.py .` | 27 markdown files, 0 errors, 0 warnings |
 | documentation audit test | `python3 -m pytest tests -q` | 84 passed |
 | whitespace | `git diff --check` | clean |
-| reviewer probes (supplementary evidence, not the acceptance) | the fourteen counterexample files under `/tmp/dsh-063-review`, `/private/tmp/dsh-063-independent-review`, `/private/tmp/dsh-063-review3`, `/private/tmp/dsh-063-review4`, `/tmp/dsh-063-review-20260917`, `/tmp/dsh-063-review-20260917-next`, `/tmp/dsh-063-review-20260917-r8`, `/tmp/dsh-063-review-20260917-r9`, `/tmp/dsh-063-review-20260917-r10`, `/tmp/dsh-063-review-20260917-r11`, `/tmp/dsh-063-review-20260917-r12`, `/tmp/dsh-063-review-20260917-r13`, `/tmp/dsh-063-review-20260917-r14` and `/tmp/dsh-063-review-20260917-r15`, run from `tests/domain/` | all fourteen files passed against the final source; every copy was removed afterwards |
+| reviewer probes (supplementary evidence, not the acceptance) | the fourteen counterexample files under maintainer-local review workspaces, run from `tests/domain/` | all fourteen files passed against the final source; every copy was removed afterwards |
 | recorded 0.6.2 fixture | `node scripts/record_legacy_upgrade_fixture.mjs --module-dir <baseline dist> --commit 63326f2… --output tests/fixtures/upgrade/legacy-0.6.2.json` | exit 0; re-running reproduces the committed fixture byte for byte |
 
 `NODE_PATH` was unset for the test runs. The DSH harness injects a `NODE_PATH`
@@ -1877,7 +1877,7 @@ pnpm pack --dry-run --json
 ## Isolated profile composition (macOS, no real ~/.dsh)
 
 ```sh
-export DSH_HOME=/tmp/dsh-context-guard-smoke
+export DSH_HOME=<local smoke directory>
 DSH=/path/to/dsh
 "$DSH" plugin --profile web add "file:/abs/path/to/dsh-context-guard"
 "$DSH" --profile web --dump-config | grep context-guard

package/docs/THIRD_PARTY_LICENSES.md

@@ -0,0 +1,27 @@
+# Bundled third-party license
+
+The runtime bundles Acorn 8.15.0 for ECMAScript program parsing. Its license is reproduced below.
+
+```text
+MIT License
+
+Copyright (C) 2012-2022 by various contributors (see AUTHORS)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```