dsh-completion-guard 0.8.4 → 0.10.0

package/docs/HOST_LOCK_UPGRADE.md

@@ -1,20 +1,23 @@
 # Upgrading the core host lock
 
-Version 0.8.4 requires DSH `>=0.2.0-rc.2` and qualified Cordis `>=4.0.4`. Upgrade order and what each step produces:
+Version 0.10.0 requires DSH `>=0.2.1-rc.2` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
 
-1. Stop the host, upgrade DSH to `0.2.0-rc.2` or a later version, then install this Guard version.
-2. Rebuild the host lock for each Guard profile by running `inspect`, `inject` and `verify-dump` from an accepted package or matching source checkout:
-   `node bin/dsh-completion-guard-host-lock.mjs inject --runtime-root <DSH runtime> --profile-root <profile>` — then verify with `... verify-dump --dump-config <file>`. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
-3. Start each Web/Headless profile when needed so it reads the rebuilt lock. The checks above do not require a running host.
+1. Stop the relevant host/session writers. For an **existing installation**, preserve the old installed package and sanitized effective-mode sources, then prepare the public persistence inventory and frozen receipt with the [prepared-candidate migration toolkit](ACTIVATION_MIGRATION.md), **before replacing DSH or Guard**. Unresolved old provenance stays pending. A **fresh installation with no old Guard sessions** skips this old-mode preparation.
+2. Upgrade DSH to `0.2.1-rc.2` or a later version, then install this Guard version, keeping writers stopped.
+3. Rebuild the host lock for each profile with `inspect`, `inject` and `verify-dump` from the accepted package or matching prepared source. For a POSIX shell, the entry is `node /absolute/prepared-package/bin/dsh-completion-guard-host-lock.mjs`; pass the actual runtime/profile roots. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
+4. For an **existing installation**, run mode `adopt` and `verify` with its frozen old receipt while writers remain stopped, **before starting any host**. Host-lock rebuilding does not perform adoption. For a fresh installation there is no old receipt to adopt.
+5. Start each Web/Headless/Desktop profile only after the applicable mode and host-lock checks pass. These checks do not require a running host.
+
+0.10.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
 
 Failure readbacks distinguish these cases:
 
 - `host_lock_migration_required`: the configuration lacks the policy or source roots. Supply `--runtime-root` and `--profile-root` when rebuilding the lock.
-- `host_lock_version_below_minimum`: DSH is older than `0.2.0-rc.2`. Upgrade DSH first.
+- `host_lock_version_below_minimum`: DSH is older than `0.2.1-rc.2`. Upgrade DSH first.
 - `host_lock_version_mismatch`: the installed graph differs from the reviewed baseline in version or integrity. For a later compatible version, use `--rebind-registry` to acquire and qualify the published graph. For the baseline, restore the recorded identities.
 - `host_lock_installed_graph_drift`: installed bytes or routes changed after the audit. Inspect the change before rebuilding the lock.
 
-The floor is `>=0.2.0-rc.2` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
+The floor is `>=0.2.1-rc.2` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
 A normal market update no longer changes the core digest. A plugin that changes
 which core packages actually resolve still invalidates the lock.
 
@@ -22,7 +25,7 @@ which core packages actually resolve still invalidates the lock.
 
 Choose the published Guard package and DSH version from the
 [compatibility guide](COMPATIBILITY.md). Keep the existing profile backup and
-its disabled/activation settings. Installation does not authorize enablement.
+its disabled/activation settings. Before replacing either DSH or Guard, stop writers and preserve the old package/effective-mode sources and frozen inventory/receipt as above. After replacement, adopt and verify that receipt before startup. Installation does not authorize enablement.
 Web and Headless are separate profiles and must be checked separately.
 
 If the profile still declares `dsh-context-guard`, replace it through DSH's
@@ -73,7 +76,7 @@ The result labels `inspection_scope: pre_install_target` and `profile_graph.stat
 ## What changes in the lock
 
 The generator writes `hostLockPolicy: dsh-core/v1`, the actual runtime/profile
-source roots, platform/profile kind and the actual core package graph (46 rows in the reviewed baseline). The
+source roots, platform/profile kind and the actual core package graph (47 rows in the reviewed baseline). The
 core manifest is version 2. Each session mount validates those graph sources
 exactly once; ordinary replay (resume, compaction, step and command refresh)
 consumes that result without rescanning, and every entry that grants
@@ -81,7 +84,7 @@ certificate authority — completion certificates, mutation authorization,
 release pre-effect decisions and Goal/Stop boundaries — validates the lock
 freshly at the moment of its own decision.
 
-Version 0.8.4 registers `dsh-0.2.0-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
+Version 0.10.0 registers `dsh-0.2.1-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
 
 The manifest's `registry-derived-pending-native-audit` provenance and empty `auditedPlatforms` list describe its immutable source audit, which is part of the lock digest. Native acceptance belongs to each exact artifact's separate Release annexes; it does not rewrite that digest. Inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest.
 
@@ -100,14 +103,14 @@ that matters for deciding whether you are migrating or just drifting:
   a DSH upgrade, and both are cured by re-running inspect, inject and verify against
   the new runtime rather than by editing the lock.
 
-Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.8.4.
+Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.10.0.
 The shared digest-v3 encoder and its upstream fixtures are unchanged.
 
 ## Official Desktop profile
 
 Stop the Desktop app before installing or rebuilding its lock. Use the CLI carrier shipped with that app: `Contents/Resources/runtime/cli/bin/dsh` on macOS, or `resources\runtime\cli\bin\dsh.cmd` in the Windows installation. A separately installed `dsh` CLI cannot manage the reserved Desktop profile.
 
-Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.8.4`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
+For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.10.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
 
 ```sh
 DSH_DESKTOP_ASAR=/absolute/path/to/DeepSeek-Harness.app/Contents/Resources/app.asar
@@ -156,7 +159,7 @@ exact artifact and platform; publication is recorded on its GitHub Release.
 
 ## Historical 0.5.1 evidence
 
-Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.8.4.
+Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.10.0.
 
 ## Rebinding compatible package versions
 
@@ -173,3 +176,15 @@ The version floor admits later releases and RCs by SemVer precedence. A new vers
 - A changed graph or trust description creates a new lock identity. Existing completion certificates and private authority records retain their old digest and cannot transfer. Reinject the lock, restart the profile under the user's control, and obtain new evidence.
 
 Rebinding writes only its qualification receipt and, for `inject`, the managed lock configuration. It does not start DSH, install packages, publish, or mutate session history. Foreground/default-workdir interpretations retain their narrower reviewed-byte qualification. Native acceptance of a later DSH version remains separate from this source-level compatibility rule.
+
+## 0.9.0 session modes / 会话模式
+
+The default-mode change introduced in 0.9.0 applies only to new root sessions and remains in 0.10.0. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
+
+0.9.0 引入的默认模式变化只适用于新建根会话，0.10.0 继续保留该规则。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
+
+## Old-format migration refusals / 旧格式迁移拒绝
+
+Before replacing the host or Guard, preserve old sources and use the [activation migration guide](ACTIVATION_MIGRATION.md). An official format refusal is a pending host-support boundary. `inventory` plus user-reviewed `select` permits readable rows to proceed while binding full coverage and excluded metadata; pass the same `--selection` to inspect/adopt/verify and distinguish `selected_complete` from whole inventory completion. Keep original logs and old-mode sources for pending rows; future host support requires a fresh scan and source/scope verification.
+
+替换宿主或 Guard 前保留旧来源并按上述迁移说明清点。官方格式拒绝是 pending 的宿主支持边界；inventory 加用户审核的 select 可让可读项先行，同时绑定全库存与排除项元数据。inspect/adopt/verify 全程携带同一 --selection，selected_complete 不当作整库完成。pending 保留原日志及旧模式来源，等待官方支持后重新清点、核验来源和范围。

package/docs/LOCAL_ACCEPTANCE.md

@@ -1,8 +1,8 @@
 # Local Acceptance
 
-## 0.8.3 RC.2 and Desktop acceptance
+## 0.10.0 / DSH 0.2.1-rc.2 acceptance contract
 
-The candidate keeps the 0.8.x task, certificate and data protocols. Its host floor remains DSH `0.2.0-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
+Guard 0.10.0 retains the existing task, certificate and data protocols. This section defines the current acceptance contract; it does not report a passing native, model or GUI run. Its host floor is DSH `0.2.1-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
 
 Run the repository entrypoint twice for each native platform, always with the same frozen tgz and source commit. `host_bound_v070` covers Web/Headless. `desktop_bound` takes the physical app archive as `--runtime-root` and the exact DSH version as `--desktop-cohort`; it creates an isolated profile and uses the signed app's bundled CLI and actual Electron Node backend. Pass `--preflight` to each intended command before execution, with distinct unused external output and transfer-receipt paths.
 
@@ -12,7 +12,7 @@ pnpm 11.7.0 builds hoisted-location mappings asynchronously and writes their ins
 
 The backend annex also covers carrier/graph authentication, installation parity, injection and real composed readback, loaded Guard behavior, graceful stop, uninstall and cleanup. It expressly skips `graphical_shell` and `real_model_request`. Those skips require separate GUI/model evidence before the complete Desktop release gate closes. Portable tests, source composition against a real archive and a backend annex cannot substitute for those observations.
 
-每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.0-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
+每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.1-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
 
 ## 0.8.0 rc.2 source-stage snapshot
 

package/docs/PRIVACY.md

@@ -32,3 +32,7 @@ Context Guard stores only bounded, deterministic facts. It does not persist prom
   a conflicting contract/target binding, or an uncertain writer lock refuses
   release/restart reuse. Historical plugin notices are never promoted into the
   stronger private-ledger channel.
+
+Session activation bindings store only immutable birth identity, mode and provenance digests in the private `activation-bindings-v1` directory. Migration receipts contain per-session identity/mode/cohort and relevant non-secret input digests, never raw prompt bodies or credential values. They are operator-owned integrity records, not signatures. Model file/shell protection has the bounded scope and platform gaps described in [activation migration](ACTIVATION_MIGRATION.md); arbitrary same-owner or in-process attackers are not excluded by checksums.
+
+会话模式绑定只保存不可变出生身份、模式与来源摘要。迁移收据只含逐会话身份、模式、来源组及相关非秘密输入摘要，不含原始提示正文或凭据值。它们是操作者完整性记录，不是签名；工具保护及平台缺口见迁移说明，摘要不排除任意同 owner 或同进程攻击。

package/manifests/desktop-distribution.v1.json

@@ -0,0 +1,124 @@
+{
+  "schema": "dsh-desktop-distribution-qualification/v1",
+  "provenance": {
+    "repository": "https://github.com/deepseek-ai/deepseek-harness",
+    "sourceCommit": "3dce1c93d04494376118d574b862d51a7d2ec2f1",
+    "removalCommit": "f028f25667dbf378c83da80fbb29685b197d00e3",
+    "compiler": "TypeScript 5.9.3",
+    "compilerOptions": {
+      "target": "ES2024",
+      "module": "ESNext",
+      "sourceMap": true,
+      "rewriteRelativeImportExtensions": true,
+      "verbatimModuleSyntax": false
+    },
+    "scope": "Exact Desktop distribution supplements only; these are not registry package inventories. The declared Desktop build commit is an opaque signed identity, not a claim that it equals the public source pin."
+  },
+  "files": [
+    {
+      "package": "@deepseek-ai/dsh-agent",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 1058,
+      "sha256": "ff96b77450ecd0b7b75d94e7aa07f073e7d378924f2484866a6a04ffe4542bc3",
+      "sourcePath": "packages/core/agent/src/invariant.ts",
+      "sourceSha256": "9ddb2ac93ba30f723d3d80d5ec0c9d5d645c879e6b6c051ec5408e656dd5fec6"
+    },
+    {
+      "package": "@deepseek-ai/dsh-session",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 8982,
+      "sha256": "975e1640ad5dba930b6031315ee7d98dd01151155d2db7e993021de1feef4f32",
+      "sourcePath": "packages/core/session/src/invariant.ts",
+      "sourceSha256": "f1dda850ed2abad99f773d13dc21aca335a81bbfef86a63a0aa407248eeab000"
+    },
+    {
+      "package": "@deepseek-ai/dsh-tools",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5628,
+      "sha256": "955311912d27f945c9298bc2add074b04fd04414312ef4f9dec92635639dd121",
+      "sourcePath": "packages/core/tools/src/invariant.ts",
+      "sourceSha256": "919744eaa6c1e6489a68a4ea3be9831e1e6c576a4a2fce96801d0a3a33ac2a79"
+    },
+    {
+      "package": "@deepseek-ai/dsh-goal",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3206,
+      "sha256": "2eda87df2fffc21e2f761b138d54c9be523627e3b41bd1508906be5cf69a410d",
+      "sourcePath": "packages/goal/goal/src/invariant.ts",
+      "sourceSha256": "92b2156e0ca89f98af1cf904bad892bd68efc986951c7697880132e9780155d1"
+    },
+    {
+      "package": "@deepseek-ai/dsh-commands",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3034,
+      "sha256": "e4bdb34890eb5b917fb26e5d8987929ef61be4e0587f8975c6cb7692e22be996",
+      "sourcePath": "packages/interaction/commands/src/invariant.ts",
+      "sourceSha256": "bebedf4440f99d6a9f275557edf10081d3ef9e1e22e82e0f3c603313a05c7d8c"
+    },
+    {
+      "package": "@deepseek-ai/dsh-user-approval",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4858,
+      "sha256": "0ee679ea1449b99266df9dc3c53606a61573caa432cfca3d44badfdac71a0ef8",
+      "sourcePath": "packages/interaction/user-approval/src/invariant.ts",
+      "sourceSha256": "0d91ae6637974853dbb43088d65495840e96e21667b2ffd8237b7889aa4771c4"
+    },
+    {
+      "package": "@deepseek-ai/dsh-jobs",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5474,
+      "sha256": "8d7b9de3a4928849ef504ea379642e4c60826ec0032ff92ff6fe89839f7fb490",
+      "sourcePath": "packages/jobs/jobs/src/invariant.ts",
+      "sourceSha256": "86633d18b1e73ec1667abb39a1a364f1db46cdb6db732ef8f828964db9d42b47"
+    },
+    {
+      "package": "@deepseek-ai/dsh-llm",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4401,
+      "sha256": "31e6ab4e29731d461b2bd49fd285666ea1a1fb96fa71ecd5c449c6c27e95d889",
+      "sourcePath": "packages/llm/llm/src/invariant.ts",
+      "sourceSha256": "ba2fd65ba8a0d886b5f21810f5f5d008984ac64387b024de0237ff71a7e483bd"
+    }
+  ],
+  "distributions": [
+    {
+      "id": "desktop-0.2.1-rc.2-darwin-arm64",
+      "platform": "darwin",
+      "arch": "arm64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "4ab76d0724d8124801413e8e939a75c254c8625f9007267bd1531eb3b993e8f8",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/mac-arm64/deepseek-harness-0.2.1-rc.2-mac-arm64.zip",
+      "releaseSha512": "vgGV720lZGEd2MnjVFOvhLVafwQH3iUDindQwwSjQ7AJaeZuu6UvjR2Msae2dkGS1SeMxxYCBu5Ks13n+K9Ydw==",
+      "vendorTeam": "NAN929V4UM",
+      "vendorIdentifier": "com.deepseek.dsh"
+    },
+    {
+      "id": "desktop-0.2.1-rc.2-win32-x64",
+      "platform": "win32",
+      "arch": "x64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "487721b329cacfe1a15d206ebc72a096f9ff5b94ba0400c8763c73535429daf2",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/win-x64/deepseek-harness-0.2.1-rc.2-win-x64.exe",
+      "releaseSha512": "39POl5osl9PKMqrPXQA52dh/bCV0Z02vOV9cTjOJDHE6gsJwp5bv7lfgB3mVWAKspX7a/w1iTi+8Listdhq45g==",
+      "vendorPublisher": "Hangzhou DeepSeek Artificial Intelligence Co., Ltd."
+    }
+  ]
+}