dsh-doublecheck 0.9.12 → 0.9.14

package/lib/events.d.ts

@@ -13,6 +13,7 @@
  * @module dsh-doublecheck/events
  */
 import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ContextFormed } from '@deepseek-ai/dsh-llm';
 import type { Session, SessionEventMap } from '@deepseek-ai/dsh-session';
 import type { GrilledSpec, ReviewFinding, ReviewVerdict, ReportVerdict, VerifyCheck } from './domain/vocabulary.js';
 import type { GateState, GateVerdict } from './domain/gate.js';
@@ -72,6 +73,18 @@ export interface GateAppend {
 }
 declare module '@deepseek-ai/dsh-llm' {
     interface MessageSourceMap {
+        /**
+         * The discipline notices injected into the session — the grill/red/green
+         * reminders, the delivery-report expectation, the adversary steer, and the
+         * `/doublecheck on|off` switch notice. All carry `form: 'notice'` and a
+         * stable one-line `summary` the guard's durable `remindOnce` fold reads
+         * back (model-visible ⟺ logged). Producer-owned on purpose: the harness
+         * removed the shared catch-all `plugin` kind, and its physical-row
+         * admission refuses one outright, so a source must name this package.
+         */
+        'dsh-doublecheck': {
+            kind: 'dsh-doublecheck';
+        } & ContextFormed;
         /**
          * The adversary review injected into the session: the durable record of
          * one settled critique. The model-facing text is the rendered findings
@@ -200,3 +213,48 @@ declare module '@deepseek-ai/cordis' {
         }): void;
     }
 }
+/** The source shape an injected doublecheck notice carries, as read back from an unsettled log value. */
+export interface NoticeSourceShape {
+    kind?: unknown;
+    plugin?: unknown;
+    form?: unknown;
+    summary?: unknown;
+}
+/**
+ * The durable notice summaries the guard's `remindOnce` fold recognizes, and
+ * the prose each one announces. A summary is a stable wire constant, not
+ * prose: it identifies which reminder is already on record.
+ */
+export type NoticeSummary = 'requirements check' | 'red/green check' | 'green gate' | 'delivery report' | 'adversary review' | 'doublecheck state';
+/**
+ * Build the producer-owned source for one doublecheck notice.
+ * @param summary - the stable notice summary the fold reads back.
+ * @returns the `MessageSourceMap` member this package declares.
+ */
+export declare function noticeSource(summary: NoticeSummary): {
+    kind: 'dsh-doublecheck';
+    form: 'notice';
+    summary: string;
+};
+/**
+ * Read the notice summary out of a durable `user/message` source, or undefined
+ * when the source is not a doublecheck notice.
+ *
+ * Three shapes are recognized, because the durable log outlives any one
+ * release line:
+ *
+ * - `{ kind: 'dsh-doublecheck', form: 'notice', summary }` — what this package
+ *   writes now.
+ * - `{ kind: 'plugin:dsh-doublecheck', form: 'notice', summary }` — the host's
+ *   V3→V4 migration lifts a released catch-all `plugin` wrapper to a
+ *   `plugin:<name>` kind for producers it does not know, and preserves the
+ *   rest of the source. A session recorded before this package adopted its own
+ *   kind therefore arrives here.
+ * - `{ kind: 'plugin', plugin: 'dsh-doublecheck', form: 'notice', summary }` —
+ *   the released wrapper itself, kept for a log value that has not been
+ *   through that migration (an in-process array from an older composition).
+ *
+ * @param source - one `user/message` event's source, of unknown shape.
+ * @returns the summary when this is a doublecheck notice, else undefined.
+ */
+export declare function noticeSummaryOf(source: NoticeSourceShape): string | undefined;

package/lib/events.js

@@ -12,4 +12,41 @@
  *
  * @module dsh-doublecheck/events
  */
-export {};
+/**
+ * Build the producer-owned source for one doublecheck notice.
+ * @param summary - the stable notice summary the fold reads back.
+ * @returns the `MessageSourceMap` member this package declares.
+ */
+export function noticeSource(summary) {
+    return { kind: 'dsh-doublecheck', form: 'notice', summary };
+}
+/**
+ * Read the notice summary out of a durable `user/message` source, or undefined
+ * when the source is not a doublecheck notice.
+ *
+ * Three shapes are recognized, because the durable log outlives any one
+ * release line:
+ *
+ * - `{ kind: 'dsh-doublecheck', form: 'notice', summary }` — what this package
+ *   writes now.
+ * - `{ kind: 'plugin:dsh-doublecheck', form: 'notice', summary }` — the host's
+ *   V3→V4 migration lifts a released catch-all `plugin` wrapper to a
+ *   `plugin:<name>` kind for producers it does not know, and preserves the
+ *   rest of the source. A session recorded before this package adopted its own
+ *   kind therefore arrives here.
+ * - `{ kind: 'plugin', plugin: 'dsh-doublecheck', form: 'notice', summary }` —
+ *   the released wrapper itself, kept for a log value that has not been
+ *   through that migration (an in-process array from an older composition).
+ *
+ * @param source - one `user/message` event's source, of unknown shape.
+ * @returns the summary when this is a doublecheck notice, else undefined.
+ */
+export function noticeSummaryOf(source) {
+    if (source.form !== 'notice' || typeof source.summary !== 'string')
+        return undefined;
+    if (source.kind === 'dsh-doublecheck' || source.kind === 'plugin:dsh-doublecheck')
+        return source.summary;
+    if (source.kind === 'plugin' && source.plugin === 'dsh-doublecheck')
+        return source.summary;
+    return undefined;
+}

package/lib/guard/command.js

@@ -17,6 +17,7 @@ import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { Session, SessionId } from '@deepseek-ai/dsh-session';
 import { sessionEvents } from "../session-events.js";
 import { deriveReportVerdict, foldReportFacts, renderReportMarkdown } from "../domain/report.js";
+import { noticeSource } from "../events.js";
 import { PROSE } from "./prose.js";
 /**
  * Whether this host's `Session.append` stamps the `ignorable` envelope marker.
@@ -63,7 +64,7 @@ export function effectiveDoublecheckEnabled(events, fallback) {
 }
 /** The switch notice injected after `/doublecheck on|off`. */
 function switchNotice(enabled, durable, prose) {
-    const source = { kind: 'plugin', plugin: 'dsh-doublecheck', form: 'notice', summary: 'doublecheck state' };
+    const source = noticeSource('doublecheck state');
     const text = enabled
         ? durable ? prose.switchOnDurable : prose.switchOnLocal
         : durable ? prose.switchOffDurable : prose.switchOffLocal;

package/lib/guard/gate.d.ts

@@ -89,7 +89,18 @@ export interface GateConfig {
 }
 /** The default gate configuration: every phase on, the six key questions required. */
 export declare const DEFAULT_GATE_CONFIG: GateConfig;
-/** The delivery-gate configuration schema (the pluggable checklist + knobs). */
+/**
+ * The delivery-gate configuration schema (the pluggable checklist + knobs).
+ *
+ * Annotated with the bare `Schema<GateConfig>` alias on purpose. The guard row
+ * marks this whole block `.volatile()`, and that call's result is derived from
+ * the *declared* schema type — so the alias is what keeps `Config`'s emitted
+ * declaration nameable instead of pointing into the package manager's store.
+ * The alias carries no root-default mode, which is why the guard row's
+ * interface declares the field `Volatile<GateConfig | undefined>` and resolves
+ * the absence once, at the read: the runtime value still comes from the
+ * `.default(...)` below.
+ */
 export declare const GateConfigSchema: Schema<GateConfig>;
 /**
  * Validate the gate configuration fail-loud: checklist ids unique and

package/lib/guard/gate.js

@@ -67,7 +67,18 @@ export const DEFAULT_GATE_CONFIG = {
         maxFindings: 5,
     },
 };
-/** The delivery-gate configuration schema (the pluggable checklist + knobs). */
+/**
+ * The delivery-gate configuration schema (the pluggable checklist + knobs).
+ *
+ * Annotated with the bare `Schema<GateConfig>` alias on purpose. The guard row
+ * marks this whole block `.volatile()`, and that call's result is derived from
+ * the *declared* schema type — so the alias is what keeps `Config`'s emitted
+ * declaration nameable instead of pointing into the package manager's store.
+ * The alias carries no root-default mode, which is why the guard row's
+ * interface declares the field `Volatile<GateConfig | undefined>` and resolves
+ * the absence once, at the read: the runtime value still comes from the
+ * `.default(...)` below.
+ */
 export const GateConfigSchema = z.object({
     enabled: z.boolean().default(true),
     planSuggestion: z.boolean().default(true),

package/lib/guard/index.d.ts

@@ -26,9 +26,9 @@
  *
  * @module dsh-doublecheck/guard
  */
-import type { Context } from '@deepseek-ai/cordis';
+import type { Context, Volatile } from '@deepseek-ai/cordis';
 import type { SessionEvent } from '@deepseek-ai/dsh-session';
-import type Schema from '@deepseek-ai/schemastery';
+import z from '@deepseek-ai/schemastery';
 import { type DisciplineState } from '../domain/stages.js';
 import type { GuardIntensity } from '../events.js';
 import { type ProseLanguage } from './prose.js';
@@ -36,18 +36,14 @@ import { type GateConfig } from './gate.js';
 import { type GateVerdict } from '../domain/gate.js';
 export declare const name = "doublecheck-guard";
 export declare const inject: string[];
-/**
- * The gate's settings namespace. Hyphenated on purpose: the host's
- * `NAMESPACE_PATTERN` (`/^[a-z][a-z0-9-]*$/`) rejects a dot with a
- * `TypeError`, and a rejected registration never reaches
- * `ctx.settings.describe()`, so no settings surface can see it. v0.9.8 and
- * earlier registered `doublecheck.gate`, which never took effect anywhere.
- */
-export declare const GATE_SETTINGS_NS = "doublecheck-gate";
 /**
  * Guard configuration. `intensity` is shared by all three gates; `modules`
  * selects them. The `adversary` module (v0.3) dispatches a forked critic
  * subagent at the turn boundary once the delivery reaches green.
+ *
+ * Only `gate` is a live field: the delivery gate's checklist is the one block
+ * users tune per project, and it is the block this row's settings card edits.
+ * Every other knob is ordinary composition config from the profile patch.
  */
 export interface Config {
     /** Enforcement strength of the grill, red/green, and review gates. */
@@ -84,10 +80,89 @@ export interface Config {
     testCommandPatterns: string[];
     /** Regexes identifying test-file paths, exempt from the red gate. */
     testFilePatterns: string[];
-    /** The delivery quality gate: the configurable checklist and the panel. */
-    gate: GateConfig;
+    /**
+     * The delivery quality gate: the configurable checklist and the panel. A live
+     * field on a host that has them, so the block is edited from this row's
+     * settings card; on an older host line it stays ordinary composition config
+     * and there is no card. Either way it is read through
+     * {@link resolveGateBlock}; see {@link apply} for when the value is taken.
+     * `| undefined` is the schema alias's shape (see `GateConfigSchema`), not a
+     * real state: the block carries a root default.
+     */
+    gate: Volatile<GateConfig | undefined> | GateConfig;
 }
-export declare const Config: Schema<Config>;
+/**
+ * Resolve the guard row's `gate` block from whatever shape the host produced:
+ * a `Volatile` reference on a host with live Config fields, the plain resolved
+ * object on one without. One build therefore spans the whole peer band.
+ * @param value - the resolved `gate` field.
+ * @returns the gate configuration block.
+ * @throws when the block is absent — the schema carries a root default, so this
+ * is a loud guard rather than a supported state.
+ */
+export declare function resolveGateBlock(value: Volatile<GateConfig | undefined> | GateConfig): GateConfig;
+/**
+ * The guard row's Config schema.
+ *
+ * Deliberately NOT annotated with the `Schema<Config>` alias: a live field's
+ * value is a `Volatile` reference, and the alias's output mapping cannot
+ * express one (it would demand a plain `GateConfig`). The interface above
+ * documents what `apply` reads; this schema is the runtime contract — the same
+ * split the harness's own provider rows use (`@deepseek-ai/dsh-llm`'s
+ * deepseek row declares `retryPolicy: Volatile<...>` against an un-annotated
+ * schema).
+ */
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    intensity: z<"warn" | "remind" | "block", "warn" | "remind" | "block", "defined">;
+    modules: z<Schemastery.ObjectS<NoInfer<{
+        grill: z<boolean, boolean, "defined">;
+        tdd: z<boolean, boolean, "defined">;
+        adversary: z<boolean, boolean, "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        grill: z<boolean, boolean, "defined">;
+        tdd: z<boolean, boolean, "defined">;
+        adversary: z<boolean, boolean, "defined">;
+    }>>, "defined">;
+    adversaryModel: z<string | null, string | null, "defined">;
+    adversaryProvider: z<string, string, "defined">;
+    adversaryMaxFindings: z<number, number, "defined">;
+    adversaryTools: z<string[], string[], "defined">;
+    adversaryTimeoutMs: z<number, number, "defined">;
+    guardTools: z<string[], string[], "defined">;
+    vagueTaskMaxChars: z<number, number, "defined">;
+    remindOnce: z<boolean, boolean, "defined">;
+    language: z<"en" | "zh", "en" | "zh", "defined">;
+    enableByDefault: z<boolean, boolean, "defined">;
+    testToolNames: z<string[], string[], "defined">;
+    testCommandPatterns: z<string[], string[], "defined">;
+    testFilePatterns: z<string[], string[], "defined">;
+    gate: z<GateConfig>;
+}>>, Schemastery.ObjectT<NoInfer<{
+    intensity: z<"warn" | "remind" | "block", "warn" | "remind" | "block", "defined">;
+    modules: z<Schemastery.ObjectS<NoInfer<{
+        grill: z<boolean, boolean, "defined">;
+        tdd: z<boolean, boolean, "defined">;
+        adversary: z<boolean, boolean, "defined">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        grill: z<boolean, boolean, "defined">;
+        tdd: z<boolean, boolean, "defined">;
+        adversary: z<boolean, boolean, "defined">;
+    }>>, "defined">;
+    adversaryModel: z<string | null, string | null, "defined">;
+    adversaryProvider: z<string, string, "defined">;
+    adversaryMaxFindings: z<number, number, "defined">;
+    adversaryTools: z<string[], string[], "defined">;
+    adversaryTimeoutMs: z<number, number, "defined">;
+    guardTools: z<string[], string[], "defined">;
+    vagueTaskMaxChars: z<number, number, "defined">;
+    remindOnce: z<boolean, boolean, "defined">;
+    language: z<"en" | "zh", "en" | "zh", "defined">;
+    enableByDefault: z<boolean, boolean, "defined">;
+    testToolNames: z<string[], string[], "defined">;
+    testCommandPatterns: z<string[], string[], "defined">;
+    testFilePatterns: z<string[], string[], "defined">;
+    gate: z<GateConfig>;
+}>>, "plain">;
 /** Cached per-session guard facts, folded incrementally from the append-only log. */
 export interface Snapshot {
     /** The log snapshot this fold last consumed; an append yields a new one. */

package/lib/guard/index.js

@@ -32,6 +32,7 @@ import z from '@deepseek-ai/schemastery';
 import { DEFAULT_MUTATION_TOOLS, DEFAULT_TEST_COMMAND_PATTERNS, DEFAULT_TEST_FILE_PATTERNS, DEFAULT_TEST_TOOL_NAMES, compileDetection, isTestFilePath, mutationTargetPath, parseRawArguments, } from "../domain/evidence.js";
 import { emptyDisciplineState, foldDisciplineRange } from "../domain/stages.js";
 import { isVagueTask } from "../domain/vagueness.js";
+import { noticeSource, noticeSummaryOf } from "../events.js";
 import { runAdversaryReview, reviewInjection } from "./review.js";
 import { PROSE } from "./prose.js";
 import { gateHandler, gateInjection, GateConfigSchema, runGate, settleGate, validateGateConfig, } from "./gate.js";
@@ -43,13 +44,47 @@ import { doublecheckHandler, hostStampsIgnorable } from "./command.js";
 export const name = 'doublecheck-guard';
 export const inject = ['commands'];
 /**
- * The gate's settings namespace. Hyphenated on purpose: the host's
- * `NAMESPACE_PATTERN` (`/^[a-z][a-z0-9-]*$/`) rejects a dot with a
- * `TypeError`, and a rejected registration never reaches
- * `ctx.settings.describe()`, so no settings surface can see it. v0.9.8 and
- * earlier registered `doublecheck.gate`, which never took effect anywhere.
+ * The gate block as a live Config field where the host has one, else as plain
+ * composition config.
+ *
+ * `.volatile()` first exists in `@deepseek-ai/schemastery` 3.18.3, but the peer
+ * band still admits host lines that ship an older one. Detected once, at load:
+ * on such a host the block stays ordinary config and the settings card is
+ * simply absent — the row must not fail to mount over a missing optional
+ * surface.
+ */
+function gateField() {
+    const candidate = GateConfigSchema;
+    return typeof candidate.volatile === 'function' ? candidate.volatile() : GateConfigSchema;
+}
+/**
+ * Resolve the guard row's `gate` block from whatever shape the host produced:
+ * a `Volatile` reference on a host with live Config fields, the plain resolved
+ * object on one without. One build therefore spans the whole peer band.
+ * @param value - the resolved `gate` field.
+ * @returns the gate configuration block.
+ * @throws when the block is absent — the schema carries a root default, so this
+ * is a loud guard rather than a supported state.
+ */
+export function resolveGateBlock(value) {
+    const live = value;
+    const resolved = typeof live.get === 'function' ? live.get() : value;
+    if (resolved === undefined) {
+        throw new Error('dsh-doublecheck: gate config resolved to undefined; the Schema root default is missing');
+    }
+    return resolved;
+}
+/**
+ * The guard row's Config schema.
+ *
+ * Deliberately NOT annotated with the `Schema<Config>` alias: a live field's
+ * value is a `Volatile` reference, and the alias's output mapping cannot
+ * express one (it would demand a plain `GateConfig`). The interface above
+ * documents what `apply` reads; this schema is the runtime contract — the same
+ * split the harness's own provider rows use (`@deepseek-ai/dsh-llm`'s
+ * deepseek row declares `retryPolicy: Volatile<...>` against an un-annotated
+ * schema).
  */
-export const GATE_SETTINGS_NS = 'doublecheck-gate';
 export const Config = z.object({
     intensity: z.union(['remind', 'warn', 'block']).default('remind'),
     modules: z.object({
@@ -70,7 +105,7 @@ export const Config = z.object({
     testToolNames: z.array(z.string()).default([...DEFAULT_TEST_TOOL_NAMES]),
     testCommandPatterns: z.array(z.string()).default([...DEFAULT_TEST_COMMAND_PATTERNS]),
     testFilePatterns: z.array(z.string()).default([...DEFAULT_TEST_FILE_PATTERNS]),
-    gate: GateConfigSchema,
+    gate: gateField(),
 });
 /**
  * Install the guard listeners.
@@ -80,34 +115,42 @@ export const Config = z.object({
 export function apply(ctx, config) {
     assertPositiveInteger('vagueTaskMaxChars', config.vagueTaskMaxChars);
     assertGuardTools(config.guardTools);
-    validateGateConfig(config.gate);
-    // The effective gate config: the user's stored `doublecheck-gate` section
-    // overrides this row's composition entry, which overrides the Schema
-    // defaults (the settings service resolves exactly that order). The service
-    // is a weak seam — without it, or when the stored section is unusable, the
-    // composition entry stands and the reason is logged. `applies: 'restart'`
-    // is deliberate: `gate.enabled` decides whether the turn-stopping notice is
-    // installed at load, so a live swap could not honor it; the resolved value
-    // is therefore read once here and an edit takes effect on the next load.
-    const settings = ctx.get('settings');
-    let gateConfig = config.gate;
-    if (settings !== undefined) {
-        try {
-            const resolved = settings.register(GATE_SETTINGS_NS, GateConfigSchema, {
-                base: config.gate,
-                applies: 'restart',
-                validate: validateGateConfig,
-            }).get();
-            // The host validates the resolved section at registration, so this only
-            // fires on a host that ignores the `validate` option; degrade rather
-            // than fail the whole row over a settings typo.
-            validateGateConfig(resolved);
-            gateConfig = resolved;
-        }
-        catch (error) {
-            ctx.logger.warn(`dsh-doublecheck: gate settings namespace skipped, using the composition entry: ${String(error)}`);
-        }
-    }
+    // The effective gate config: the profile patch's `gate` block, layered over
+    // the Schema defaults (the host resolves exactly that order and hands the
+    // result over as this live field's value). Read ONCE here, deliberately:
+    // `gate.enabled` decides whether the turn-stopping notice is installed at
+    // load, so a live swap could not honor it. An edit made through the settings
+    // card lands in the profile patch and is picked up on the next load — the
+    // same restart-scoped semantics the removed `doublecheck-gate` namespace had
+    // (`applies: 'restart'`), minus the separate document that no longer exists.
+    //
+    // The one assertion in this module: on a host with live Config fields,
+    // `Volatile.get()` hands back a deeply readonly snapshot, and every consumer
+    // below (the command seam, the four gate phases, the report renderer) takes
+    // the hand-written `GateConfig`. Nothing in this package writes the block, so
+    // the snapshot's readonly wrapper is dropped once, at this single boundary —
+    // and on a host without live fields there is no wrapper to drop.
+    const gateConfig = resolveGateBlock(config.gate);
+    // Fail loud on an unactable checklist. The host validates the Config schema
+    // on every settings write, but this cross-field check (unique, non-empty,
+    // in-range checklist ids and the thresholds they bound) is this package's own
+    // rule, so it runs here — the write path cannot carry it.
+    validateGateConfig(gateConfig);
+    // Expose this row's live fields on the settings page. `auto: false` keeps the
+    // generated card off: the gate knobs are rendered from the schema by the
+    // form owner, and the package ships no custom page. The policy is an effect
+    // so it unwinds with the row. Feature-detected: the settings service of a
+    // host line without live Config fields has no `configure` at all, and the row
+    // must still mount there.
+    ctx.inject(['settings'], (child) => {
+        const settings = child.settings;
+        if (typeof settings.configure !== 'function')
+            return;
+        // Bound: the policy is read off the service instance, and the host's
+        // implementation (like this row's stand-in) keeps its state on `this`.
+        const configure = settings.configure.bind(settings);
+        child.effect(() => configure({ auto: false }, ctx.fiber));
+    });
     if (config.modules.adversary) {
         assertBoundedInteger('adversaryMaxFindings', config.adversaryMaxFindings, 20);
         assertPositiveInteger('adversaryTimeoutMs', config.adversaryTimeoutMs);
@@ -156,14 +199,15 @@ export function apply(ctx, config) {
                 continue;
             if (event.type === 'user/message') {
                 const source = event.data.source;
-                if (source.kind === 'plugin' && source.plugin === 'dsh-doublecheck' && source.form === 'notice') {
-                    if (source.summary === 'requirements check')
+                const summary = noticeSummaryOf(source);
+                if (summary !== undefined) {
+                    if (summary === 'requirements check')
                         snapshot.grillReminded = true;
-                    else if (source.summary === 'red/green check')
+                    else if (summary === 'red/green check')
                         snapshot.redReminded = true;
-                    else if (source.summary === 'green gate')
+                    else if (summary === 'green gate')
                         snapshot.greenReminded = true;
-                    else if (source.summary === 'delivery report')
+                    else if (summary === 'delivery report')
                         snapshot.reportReminded = true;
                 }
                 else if (source.kind === 'doublecheck-review') {
@@ -251,15 +295,9 @@ export function apply(ctx, config) {
         }
         return refold(session, events);
     }
-    /** A plugin-sourced notice message carrying the given prose. */
+    /** A producer-owned notice message carrying the given prose. */
     function notice(summary, text) {
-        const source = {
-            kind: 'plugin',
-            plugin: 'dsh-doublecheck',
-            form: 'notice',
-            summary,
-        };
-        return createUserMessage({ content: [{ type: 'text', text }], source });
+        return createUserMessage({ content: [{ type: 'text', text }], source: noticeSource(summary) });
     }
     /** The grill reminder for this reaction, or undefined when already reminded. */
     function nextGrillReminder(snapshot) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-doublecheck",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Delivery quality gate for DeepSeek Harness: grill the requirements, test the implementation, prove the delivery, and gate the handoff with a deliverable/rework decision.",
   "packageManager": "pnpm@11.7.0",
   "repository": {
@@ -63,6 +63,7 @@
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "verify:skills": "node scripts/verify-skills.mjs",
+    "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "check:readmes": "node scripts/check-readme-sync.mjs",
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
     "verify:artifacts": "node scripts/verify-artifacts.mjs",
@@ -115,7 +116,8 @@
     "compatibility": {
       "dshVersions": [
         "0.1.2-rc.1",
-        "0.1.5-rc.2"
+        "0.1.5-rc.2",
+        "0.1.7-alpha.1"
       ]
     },
     "capability": {
@@ -148,21 +150,22 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/cordis": "^4.0.3",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-fs": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-skill": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-subagent": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-workflow": "0.1.5-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/dsh-agent": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-commands": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-fs": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-invariants": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-llm": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-settings": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-skill": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-subagent": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-tools": "0.1.7-alpha.1",
+    "@deepseek-ai/dsh-workflow": "0.1.7-alpha.1",
+    "@deepseek-ai/schemastery": "^3.18.3",
     "@eslint/js": "^9.30.0",
     "@types/node": "^22.15.0",
     "@vitest/coverage-v8": "^3.2.0",