dsh-model-jury 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project will be documented here.
+
+## [0.1.0] - 2026-08-31
+
+### Added
+
+- Blind concurrent first-round answers from GPT through native Codex, GLM, and DeepSeek.
+- Random P1/P2/P3 position mapping and anonymous cross-critique.
+- Structured revision, deterministic quorum and vote aggregation, explicit dissent, and critical-risk handling.
+- Provider health checks through `/jury doctor`.
+- Owner-only redacted run artifacts, deterministic fake integration tests, and a real three-provider validation transcript.
+- Prebuilt DSH bundle packaging and compatibility documentation for DSH `0.1.2-alpha.2` at `0a53fb55bea101816fa226bb964ae2bed71c343b`.
+
+### Release validation
+
+- 3 providers, 3 rounds, and 9 successful real model calls from the installed package.
+- Native Codex/ChatGPT subscription authentication passed with `OPENAI_API_KEY` absent.
+- Round 1 ran concurrently with a maximum 6 ms dispatch skew in the final validation.
+- Anonymous competitor packets produced zero provider-identity leaks.
+- Degraded 2/3 quorum, failed 0–1/3 quorum, dissent preservation, and critical-risk policy passed automated tests.

package/COMPATIBILITY.md

@@ -0,0 +1,17 @@
+# Compatibility
+
+| Component | Tested value |
+|---|---|
+| DeepSeek Harness | `0.1.2-alpha.2`, commit `0a53fb55bea101816fa226bb964ae2bed71c343b` |
+| DSH Codex provider baseline | `@openai/codex` `0.149.1` through `@deepseek-ai/dsh-subagent-codex` |
+| Host Codex CLI observed | `codex-cli 0.146.0` |
+| Node.js | `v25.2.1` |
+| pnpm | `11.7.0` for the pinned DSH workspace; local default observed as `10.28.2` |
+| Operating system | macOS 26.4.1, Apple Silicon |
+| GPT route | `ctx.subagents` provider `model-jury-codex` backed by first-party Codex app-server |
+| GLM route tested | `ctx.llm` provider `glm`, model `glm-5.3`, through `llm-pi-ai` OpenAI-compatible configuration |
+| DeepSeek route tested | `ctx.llm` provider `deepseek-official`, model `deepseek-v4-flash` |
+
+The bundle imports only public package entry points. It does not import DSH source subpaths or patch the host.
+
+The package-local Codex binary actually selected by the first-party provider was `@openai/codex` `0.149.1`. The host-wide `codex --version` value is recorded only for comparison and was not the backend selected by Model Jury.

package/CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing to dsh-model-jury
+
+Thank you for improving structured cross-model peer review for DeepSeek Harness.
+
+## Before opening a change
+
+- Keep provider credentials outside the repository, fixtures, logs, and artifacts.
+- Preserve Round 1 blindness and Round 2 anonymity.
+- Keep aggregation deterministic. A model must not become a permanent chairman or silently replace quorum, vote, dissent, or critical-risk policy.
+- Keep Model Jury deliberation-only. Do not add automatic code changes, commits, pushes, deployments, or mutation tools to the protocol.
+- Use public DSH APIs and provider-neutral routes where available.
+
+## Development
+
+Use Node.js `^22.19.0` or `>=24` and pnpm `10.28.2` or a compatible release:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm test
+pnpm typecheck
+pnpm build
+pnpm pack
+```
+
+Tests must use fake seats unless a change specifically requires an opt-in real-provider validation. Never put API keys into test fixtures. Real-provider transcripts must contain only visible structured responses and safe metadata.
+
+## Pull requests
+
+Explain the user-visible problem, the resulting behavior, and how you verified it. Keep protocol changes separate from provider or documentation changes when practical. Add a regression test when a bug could confuse anonymous labels, leak provider identity, change quorum behavior, drop dissent, or alter critical-risk handling.
+
+By contributing, you agree that your contribution is licensed under the MIT License.

package/DEMO.md

@@ -0,0 +1,64 @@
+# Complete deterministic demo run
+
+This transcript is produced by the same `CouncilStateMachine`, Zod schemas, and
+aggregator exercised in `tests/state-machine.test.ts`. The seats are deterministic
+test doubles so the protocol can be demonstrated without provider credentials.
+
+## Input
+
+- Question: Should the service use strategy A or strategy B?
+- Style: balanced
+- Anonymous mapping for this run: GPT → P2, GLM → P3, DeepSeek → P1
+
+## Round 1 — blind independent positions
+
+All three seats receive the same prompt and none receives another seat's answer.
+
+| Seat | Thesis / recommendation | Confidence |
+|---|---|---:|
+| GPT | Choose A | 70 |
+| GLM | Choose B | 70 |
+| DeepSeek | Choose A | 70 |
+
+Each position also returns the validated fields `reasoning`, `assumptions`,
+`risks`, and `evidence_needed`. In this fixture those are, respectively,
+`Reason for <choice>`, `Stable requirements`, `Execution risk`, and `A benchmark`.
+
+## Round 2 — anonymous cross-critique
+
+The positions are redistributed only as P1, P2, and P3. These participant labels
+are separate from the strategy A/B names in the question.
+Provider and model identity terms are scrubbed before redistribution.
+
+| Reviewing seat | Preferred anonymous position | Critique | Confidence |
+|---|---:|---|---:|
+| GPT | P1 | Clear objective; limited evidence; benchmark data is missing | 72 |
+| GLM | P2 | Clear objective; limited evidence; benchmark data is missing | 72 |
+| DeepSeek | P1 | Clear objective; limited evidence; benchmark data is missing | 72 |
+
+## Round 3 — final revision
+
+| Seat | Final vote | Final recommendation | Changed mind | Confidence |
+|---|---:|---|---:|---:|
+| GPT | P1 | Choose A | no | 78 |
+| GLM | P2 | Choose B | no | 78 |
+| DeepSeek | P1 | Choose A | no | 78 |
+
+All seats agree that outcomes should be measured. Their remaining disagreement is
+the implementation order. No critical-risk flag is active.
+
+## Deterministic verdict
+
+- Valid: yes
+- Result: majority
+- Quorum: 3/3
+- Vote distribution: P1 = 2, P2 = 1
+- Recommendation: Choose A
+- Consensus: Measure outcomes
+- Minority view: GLM — Choose B
+- Evidence still needed: A benchmark
+- Changed-mind count: 0
+- Critical review required: no
+
+The test suite separately verifies unanimous, split, degraded 2/3, failed 0–1/3,
+hybrid, and matching critical-risk-category outcomes.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-model-jury contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PRE_FLIGHT.md

@@ -0,0 +1,39 @@
+# Model Jury preflight
+
+Verified on 2026-08-31 against `deepseek-ai/deepseek-harness` commit `0a53fb55bea101816fa226bb964ae2bed71c343b` (`0.1.2-alpha.2`). The source checkout remained unmodified.
+
+## Public APIs
+
+- `ctx.commands.register()` accepts a lowercase slash-command definition and an abortable handler. Command results are rendered by the UI without entering model history.
+- `ctx.llm.stream()` accepts a hand-built provider-neutral request with `provider`, `model`, messages, optional output controls, and an `AbortSignal`. `BlockAssembler` is the public stream assembly helper. `ctx.llm.listProviders()` exposes the active route set.
+- `ctx.subagents.start(provider, request)` starts a named one-shot provider and returns a disposable run. The first-party `@deepseek-ai/dsh-subagent-codex` package registers a Codex provider backed by the official `codex app-server --stdio` protocol.
+- The Codex provider exposes provider name, model, environment overlay, permission mode, and process shutdown grace as public configuration. It preserves native Codex configuration and authentication.
+- `@deepseek-ai/dsh-llm-pi-ai` supports named custom routes using `openai-completions` or `openai-responses`, a configurable base URL, credential reference, and model list. This is sufficient for GLM without a Model Jury-owned adapter.
+- `@deepseek-ai/dsh-llm-deepseek` owns the first-party `deepseek-official` route and accepts configurable model IDs at call time.
+
+## Native Codex authentication proof
+
+The preflight launched a real child through `ctx.subagents.start('codex', ...)` with the first-party DSH Codex provider and the official package-local app-server. The process environment was launched with `OPENAI_API_KEY` unset. The child returned exactly `CODEX_SUBSCRIPTION_OK` and settled with `stopReason: completed`.
+
+The preflight did not write or replace `~/.codex/config.toml`, did not set `OPENAI_API_KEY`, and did not configure an OpenAI API fallback. Native Codex account state remained authoritative.
+
+The final built `CodexSeat` was then checked independently through the bundle's
+`model-jury-codex` provider with `OPENAI_API_KEY` explicitly removed. Its real
+app-server child returned `ok: true` with the detail `native Codex authentication
+completed a real app-server child`.
+
+## Bundle validation
+
+The final package was packed with `npm pack`, installed through `dsh plugin` into
+a fresh isolated Web profile, found in the composed configuration, and booted by
+the pinned DSH Web host. `/jury doctor` returned READY through the real Web
+command surface. Full real GPT + GLM + DeepSeek runs completed Blind Round 1,
+anonymous Round 2, Round 3 revision, and deterministic aggregation.
+
+## Risks and deviations
+
+- The public Codex provider has no strict read-only permission mode. Its safest exposed mode is `never`, which disables approval prompts but leaves the sandbox to native Codex configuration. Model Jury prompts prohibit tools, project modifications, installs, commits, pushes, deployments, and network mutations. This is prompt enforcement rather than a hard capability boundary.
+- The Codex provider does not accept an output schema. The seat requests JSON and performs one bounded repair call when validation fails.
+- GLM and DeepSeek credentials were discovered in the user's existing API file and injected only into the isolated DSH launch process. Both real provider probes and full Model Jury calls passed. No credential value was copied into this package, its docs, tests, configuration, logs, or artifacts.
+- Model Jury artifacts are intentionally written beneath `.dsh-model-jury/`; ordinary project files are not changed by runs.
+- Round 2 and Round 3 include all three anonymous labels, including the reviewing seat's own position, because the required `P1|P2|P3|hybrid|undecided` vote schema has no `own` value. The original answer is also supplied separately, so this duplicates content but preserves stable aggregation without explicitly exposing the provider mapping.

package/README.md

@@ -0,0 +1,196 @@
+# dsh-model-jury
+
+> **Structured cross-model peer review for DeepSeek Harness.**
+
+**Models deliberate. Code counts. Dissent survives.**
+
+Blind independent answers → anonymous peer critique → revision → deterministic verdict.
+
+**No permanent chairman. The judge is code.**
+
+> Compatibility: verified on DeepSeek Harness `0.1.2-alpha.2` at commit `0a53fb55bea101816fa226bb964ae2bed71c343b`. DSH is in developer preview and may introduce breaking changes. See [COMPATIBILITY.md](COMPATIBILITY.md).
+
+```text
+                         One Question
+                              │
+            ┌─────────────────┼─────────────────┐
+            ▼                 ▼                 ▼
+      GPT via Codex          GLM             DeepSeek
+    ChatGPT subscription     API                API
+            │                 │                 │
+            └──────── Blind Round ─────────────┘
+                              │
+                         P1 / P2 / P3
+                              │
+                    Anonymous Peer Review
+                              │
+                           Revision
+                              │
+                  Deterministic Aggregation
+                    ┌─────────┼─────────┐
+                    ▼         ▼         ▼
+                Majority    Dissent    Risks
+```
+
+Release validation: **3 providers · 3 rounds · 9 real model calls · 0 identity leaks · 6 ms maximum Round-1 dispatch skew**.
+
+The full redacted provider transcript, vote, dissent, risk, and timing record is in [REAL_DEMO.md](REAL_DEMO.md).
+
+## Install in 30 seconds
+
+Install the prebuilt `v0.1.0` tarball into the DSH Web profile, inspect the composed layer, and boot DSH:
+
+```sh
+dsh plugin --profile web add ./dsh-model-jury-0.1.0.tgz
+dsh --profile web --dump-config
+dsh web
+```
+
+After an npm release, the first command can instead be:
+
+```sh
+dsh plugin --profile web add dsh-model-jury
+```
+
+The tarball and npm package contain compiled `lib/` output. Installation does not require permission to run a package build script.
+
+## Setup
+
+Model Jury uses DSH's provider-neutral public services. It does not implement private HTTP clients or proxy provider traffic.
+
+### GPT through native Codex authentication
+
+The GPT seat uses DSH's first-party Codex app-server provider and the user's native ChatGPT/Codex subscription authentication. `OPENAI_API_KEY` is not required. The bundle registers an isolated `model-jury-codex` route so GLM and DeepSeek provider configuration cannot replace Codex authentication.
+
+### GLM
+
+Configure a GLM route through DSH's `@deepseek-ai/dsh-llm-pi-ai` provider. Keep the credential in DSH settings or the DSH launch environment:
+
+```yaml
+- id: llm-pi-ai
+  config:
+    providers:
+      glm:
+        displayName: GLM
+        api: openai-completions
+        baseURL: '<GLM OpenAI-compatible base URL>'
+        apiKeyEnv: GLM_API_KEY
+        models:
+          - id: '<your GLM model id>'
+            name: GLM jury model
+```
+
+### DeepSeek and jury models
+
+The DSH base profile supplies the first-party `deepseek-official` route. Configure `DEEPSEEK_API_KEY` through DSH settings or the launch environment, then override the complete `model-jury` row in the profile's `cordis.patch.yml` with the model IDs available to your account:
+
+```yaml
+- id: model-jury
+  config:
+    storageDir: .dsh-model-jury
+    maxQuestionChars: 12000
+    maxFieldChars: 6000
+    codex:
+      provider: model-jury-codex
+      timeoutMs: 180000
+      maxRetries: 1
+    glm:
+      provider: glm
+      model: '<your GLM model id>'
+      timeoutMs: 120000
+      maxTokens: 16384
+      maxRetries: 1
+    deepseek:
+      provider: deepseek-official
+      model: '<your DeepSeek model id>'
+      timeoutMs: 120000
+      maxTokens: 16384
+      maxRetries: 1
+```
+
+Credentials never belong in this package, patch, test fixtures, or run artifacts.
+
+## Doctor
+
+```text
+/jury doctor
+```
+
+Doctor performs one minimal real request per seat, so it can consume provider quota. It reports provider, model, status, duration, safe diagnostics, and native Codex authentication without printing credential values.
+
+## Run
+
+```text
+/jury Should this inference runtime prioritize iOS support or ARM SIMD optimization?
+/jury --style adversarial Should this inference runtime prioritize iOS support or ARM SIMD optimization?
+```
+
+`balanced` is the default. `adversarial` strengthens the critique instructions without changing provider topology or aggregation.
+
+## Why Model Jury
+
+Most model councils ask several models, then ask another model to judge them. Model Jury takes a different approach:
+
+1. Models answer independently.
+2. Competing answers are anonymized.
+3. Models critique one another.
+4. Models get a chance to revise.
+5. Code computes quorum and vote state.
+6. Dissent and critical risks remain visible.
+
+The current reference deployment uses GPT/Codex, GLM, and DeepSeek. The protocol itself is provider-neutral: `CouncilSeat` implementations can route other compatible models through the same blind, anonymous, structured state machine.
+
+## Protocol
+
+Round 1 sends the same question, instructions, and JSON schema to all three seats concurrently. No seat sees another response. A random per-run mapping then assigns the responses to P1, P2, and P3. These labels identify participant positions only; answer choices such as Strategy A/B remain ordinary question content.
+
+Round 2 gives each model its own first answer plus the anonymized positions. Provider, model, and common product identity terms are scrubbed from redistributed fields. The prompt requests strongest points, weakest points, missing evidence, actual disagreement, and calibrated severity without rewarding consensus.
+
+Round 3 allows each surviving model to revise, merge, remain undecided, or preserve dissent. The deterministic aggregator accepts only `P1`, `P2`, `P3`, `hybrid`, or `undecided`; computes vote state and quorum; and keeps named final dissent visible to the user.
+
+Three final seats produce a normal verdict. Two produce an explicit `DEGRADED` verdict. Zero or one produces a failed report. A single structured critical-risk flag is surfaced prominently but has no veto. Two compatible normalized critical-risk categories trigger `CRITICAL REVIEW REQUIRED`.
+
+## Artifacts
+
+Every run writes owner-only trace files beneath:
+
+```text
+.dsh-model-jury/runs/<run-id>/
+  request.json
+  config.json
+  state.json
+  prompts/round1|round2|round3/<seat>.txt
+  round1|round2|round3/<seat>.json
+  redistribution.json
+  calls.json
+  verdict.json
+  report.md
+```
+
+Artifacts contain visible structured responses, safe call metadata, prompts, aggregation data, and the final report. They exclude environment snapshots, request headers, API keys, OAuth state, provider request bodies, and hidden chain-of-thought. Credential-shaped fields are recursively redacted.
+
+## Safety
+
+Model Jury is deliberation-only. It never applies a recommendation, edits project files, installs dependencies, commits, pushes, deploys, or performs deliberate network mutations. GLM and DeepSeek receive no tools. Codex uses `permissionMode: never` plus mutation-prohibiting prompts; DSH's tested public Codex provider does not expose a strict read-only flag, so this remains a documented limitation. Read [SECURITY.md](SECURITY.md) before using sensitive workspace content.
+
+## Develop and package
+
+```sh
+pnpm install --frozen-lockfile
+pnpm test
+pnpm typecheck
+pnpm build
+pnpm pack
+```
+
+The deterministic fake transcript is in [DEMO.md](DEMO.md). Provider and host validation is recorded in [PRE_FLIGHT.md](PRE_FLIGHT.md). Contributions are welcome under [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Known limitations
+
+- GLM and DeepSeek require user-supplied provider credentials and model IDs.
+- The tested public DSH Codex provider cannot enforce a hard read-only sandbox through its plugin configuration.
+- Vote consensus uses explicit structured labels, not semantic clustering of textual `hybrid` proposals.
+- Each Codex call starts an ephemeral app-server thread.
+- There is no automatic implementation, research, chairman model, deployment, or five/seven-seat mode.
+
+MIT licensed. See [LICENSE](LICENSE).

package/REAL_DEMO.md

@@ -0,0 +1,78 @@
+# Real three-provider Model Jury demo
+
+This is a visible-output transcript summary from a real installed-package run on 2026-08-31. It contains no credentials, request headers, environment snapshot, or hidden reasoning. Public route names are shown after the nonfunctional `dsh-model-jury` branding migration; the provider backends and protocol are unchanged.
+
+## Question
+
+> For a small engineering team building a local-first developer tool, should the core orchestration engine use a deterministic workflow or allow the LLM to dynamically select the next agent? Compare reliability, debuggability, flexibility, cost, failure recovery, and long-term maintainability.
+
+## Providers
+
+| Seat | Provider | Model/backend | Health |
+|---|---|---|---|
+| GPT | `model-jury-codex` | native Codex app-server `0.149.1` | PASS with `OPENAI_API_KEY` absent |
+| GLM | `glm` | `glm-5.3` | PASS |
+| DeepSeek | `deepseek-official` | `deepseek-v4-flash` | PASS |
+
+Anonymous mapping for this run:
+
+| Seat | Position |
+|---|---|
+| GPT | P2 |
+| GLM | P1 |
+| DeepSeek | P3 |
+
+## Round 1 — blind independent positions
+
+- **GPT:** deterministic, versioned state-machine control should be the core, with narrowly allowlisted LLM routing only where explicit rules are inadequate. Confidence 92.
+- **GLM:** deterministic workflow control with schema-validated, bounded LLM discretion; avoid fully dynamic agent selection. Confidence 78.
+- **DeepSeek:** deterministic state machine or DAG, with LLM variability confined to predefined recoverable nodes. Confidence 82.
+
+The three prompts were byte-identical and contained no other seat output. Their calls started within 80 ms of one another.
+
+## Round 2 — anonymous cross-critique
+
+Only P1/P2/P3 identified competing positions. No GPT, OpenAI, Codex, GLM, Zhipu, DeepSeek, provider id, or model id appeared in any competitor packet.
+
+- **GPT** preferred P2 and argued it best combined deterministic reliability with bounded routing; it criticized P1 for overclaiming exact replay and P3 for understating flexibility costs. Confidence 94.
+- **GLM** preferred P2, emphasizing its operational detail while challenging unsupported assumptions about bounded routing and future retrofit cost. Confidence 72.
+- **DeepSeek** preferred P3, arguing that even allowlisted next-step routing can reintroduce nondeterministic control flow and harder replay. Confidence 84.
+
+Every response named the strongest point, weakest point, possible error, and missing evidence for both competing positions. The critiques contained substantive disagreement and were not consensus-only summaries.
+
+## Round 3 — revision and rebuttal
+
+- **GPT:** P2, unchanged. Deterministic state machine with guarded, recorded, allowlisted routing checkpoints. Confidence 86.
+- **GLM:** changed to `hybrid`. It retained deterministic graph control, narrowed routing, and added an explicit concern that the recommendation depends on task decomposability. Confidence 82.
+- **DeepSeek:** changed to P2 after accepting guarded next-step routing with deterministic fallbacks and persisted decisions. Confidence 80.
+
+Both `changed_mind: true` and `changed_mind: false` were accepted in the same real run.
+
+## Deterministic verdict
+
+```text
+Result: MAJORITY
+Quorum: 3/3
+Votes: P2 = 2, hybrid = 1
+Winning choice: P2
+Changed minds: 2
+Critical review required: no
+```
+
+Recommendation: use a deterministic, versioned state machine or DAG as the core. Permit LLM routing only at selected checkpoints over a small allowlist, with schema validation, recorded decision context, retry limits, checkpoints, and an explicit safe fallback.
+
+Minority / dissent: GLM retained a distinct hybrid recommendation. It warned that a stable workflow graph and testable bounded routing are assumptions; a product centered on novel, unstructured autonomy could reverse the recommendation. This single structured critical risk was surfaced but did not veto the majority.
+
+## Timing
+
+| Round | GPT | GLM | DeepSeek |
+|---|---:|---:|---:|
+| Round 1 | 33.279 s | 35.889 s | 10.866 s |
+| Round 2 | 26.759 s | 103.273 s | 45.349 s |
+| Round 3 | 27.786 s | 70.860 s | 35.887 s |
+
+Run id: `20260831T084039975Z-e819e49e`.
+
+## Deliberation stress run
+
+A second real run compared Apple/iOS support with ARM64/SIMD optimization. DeepSeek initially chose ARM64/SIMD while GPT and GLM chose Apple support. Anonymous critique changed both GLM and DeepSeek to guarded hybrid proposals. The final deterministic vote was `hybrid = 2, P3 = 1`, with GPT preserved as the named minority. All three submitted structured critical risks, demonstrating that critical-risk reporting remains independent of the vote.

package/SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+Model Jury is decision support. It never applies a recommendation, edits project files, installs software, commits, pushes, deploys, or sends deliberate network mutations. Provider calls are the only intended network activity. Run artifacts are written with owner-only file permissions beneath the configured Model Jury directory.
+
+Prompts sent to every seat prohibit tool use and mutations. GLM and DeepSeek seats call `ctx.llm` without tools. The Codex seat uses the first-party one-shot app-server provider with `permissionMode: never`; the current public provider API cannot force `sandbox: read-only`, so Codex confinement also depends on the user's native Codex sandbox configuration. This limitation is reported by `/jury doctor` and in `PRE_FLIGHT.md`.
+
+Credentials stay in DSH credential and provider services. The plugin configuration contains credential references only indirectly through the selected provider route. Persistence recursively redacts fields whose names indicate keys, tokens, secrets, passwords, authorization, cookies, or credentials. It never serializes environment snapshots, headers, OAuth state, or provider request bodies.
+
+The plugin stores only final structured model responses, safe call metadata, protocol prompts, aggregation data, and the user-visible report. It does not request or store hidden chain-of-thought.

package/cordis.patch.yml

@@ -0,0 +1,30 @@
+# Register the first-party Codex provider under a Model Jury-owned name so this
+# bundle does not collide with a user's ordinary `codex` provider instance.
+- insert:
+    - id: model-jury-codex-provider
+      name: '@deepseek-ai/dsh-subagent-codex'
+      config:
+        providerName: model-jury-codex
+        permissionMode: never
+        disposeGraceMs: 3000
+
+    - id: model-jury
+      name: 'dsh-model-jury'
+      config:
+        storageDir: .dsh-model-jury
+        maxQuestionChars: 12000
+        maxFieldChars: 6000
+        codex:
+          provider: model-jury-codex
+          timeoutMs: 180000
+          maxRetries: 1
+        glm:
+          provider: glm
+          timeoutMs: 120000
+          maxTokens: 16384
+          maxRetries: 1
+        deepseek:
+          provider: deepseek-official
+          timeoutMs: 120000
+          maxTokens: 16384
+          maxRetries: 1

package/lib/command.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { CouncilService } from './council-service.js';
+import type { CouncilStyle } from './protocol/prompts.js';
+interface ParsedCouncilInput {
+    readonly style: CouncilStyle;
+    readonly question: string;
+}
+/** Parse the intentionally small `/jury` option surface. */
+export declare function parseCouncilInput(rawInput: string): ParsedCouncilInput;
+/** Register `/jury` and `/jury doctor` on the documented command seam. */
+export declare function registerCouncilCommand(ctx: Context, service: CouncilService): void;
+export {};
+//# sourceMappingURL=command.d.ts.map

package/lib/command.js

@@ -0,0 +1,45 @@
+import { renderDoctor } from './council-service.js';
+/** Parse the intentionally small `/jury` option surface. */
+export function parseCouncilInput(rawInput) {
+    let remaining = rawInput.trim();
+    let style = 'balanced';
+    if (remaining.startsWith('--style')) {
+        const match = /^--style(?:=|\s+)(\S+)(?:\s+|$)/u.exec(remaining);
+        if (match === null)
+            throw new Error('usage: /jury [--style balanced|adversarial] <question>');
+        const selected = match[1];
+        if (selected !== 'balanced' && selected !== 'adversarial') {
+            throw new Error(`unsupported Council style "${selected}"; use balanced or adversarial`);
+        }
+        style = selected;
+        remaining = remaining.slice(match[0].length).trim();
+    }
+    if (remaining.length === 0)
+        throw new Error('usage: /jury [--style balanced|adversarial] <question>');
+    return { style, question: remaining };
+}
+/** Register `/jury` and `/jury doctor` on the documented command seam. */
+export function registerCouncilCommand(ctx, service) {
+    ctx.commands.register({
+        name: 'jury',
+        description: 'Run structured cross-model peer review',
+        input: { hint: '[--style balanced|adversarial] <question> | doctor' },
+        async handler({ agent, rawInput, signal }) {
+            try {
+                if (rawInput.trim() === 'doctor') {
+                    return { kind: 'success', text: renderDoctor(await service.doctor(agent, signal)) };
+                }
+                const input = parseCouncilInput(rawInput);
+                const run = await service.run(input.question, input.style, agent, signal);
+                const suffix = `\n\nArtifacts: ${run.directory}`;
+                return run.result.verdict.valid
+                    ? { kind: 'success', text: `${run.report}${suffix}` }
+                    : { kind: 'error', text: `${run.report}${suffix}` };
+            }
+            catch (error) {
+                return { kind: 'error', text: error instanceof Error ? error.message : String(error) };
+            }
+        },
+    });
+}
+//# sourceMappingURL=command.js.map

package/lib/config.d.ts

@@ -0,0 +1,35 @@
+import Schema from '@deepseek-ai/schemastery';
+/** Shared retry and timeout policy for one Council seat. */
+export interface SeatConnectionConfig {
+    /** DSH provider route or subagent provider name. */
+    provider: string;
+    /** Maximum wall-clock duration for one structured invocation. */
+    timeoutMs: number;
+    /** Maximum transient transport retries after the first attempt. */
+    maxRetries: number;
+}
+/** Provider/model policy for a `ctx.llm` seat. */
+export interface LlmSeatConnectionConfig extends SeatConnectionConfig {
+    /** Model id passed to the configured DSH route; omission leaves the seat unavailable. */
+    model: string | null;
+    /** Maximum response tokens for each structured model call. */
+    maxTokens: number;
+}
+/** Public Council plugin configuration. */
+export interface Config {
+    /** Artifact directory, resolved from the receiving session workspace. */
+    storageDir: string;
+    /** Maximum accepted user-question length. */
+    maxQuestionChars: number;
+    /** Maximum length of one string before it is redistributed to another seat. */
+    maxFieldChars: number;
+    /** Native Codex subagent route used for the GPT seat. */
+    codex: SeatConnectionConfig;
+    /** Configurable DSH LLM route used for the GLM seat. */
+    glm: LlmSeatConnectionConfig;
+    /** First-party or configured DSH LLM route used for the DeepSeek seat. */
+    deepseek: LlmSeatConnectionConfig;
+}
+/** Schemastery validation and defaults for the public plugin configuration. */
+export declare const Config: Schema<Config>;
+//# sourceMappingURL=config.d.ts.map

package/lib/config.js

@@ -0,0 +1,39 @@
+import Schema from '@deepseek-ai/schemastery';
+const seatConnection = Schema.object({
+    provider: Schema.string().min(1).required(),
+    timeoutMs: Schema.number().min(1).required(),
+    maxRetries: Schema.number().min(0).max(1).required(),
+});
+const llmSeatConnection = Schema.object({
+    provider: Schema.string().min(1).required(),
+    model: Schema.union([Schema.string().min(1), Schema.const(null)]).default(null),
+    timeoutMs: Schema.number().min(1).required(),
+    maxRetries: Schema.number().min(0).max(1).required(),
+    maxTokens: Schema.number().min(1).required(),
+});
+/** Schemastery validation and defaults for the public plugin configuration. */
+export const Config = Schema.object({
+    storageDir: Schema.string().min(1).default('.dsh-model-jury'),
+    maxQuestionChars: Schema.number().min(1).default(12_000),
+    maxFieldChars: Schema.number().min(256).default(6_000),
+    codex: seatConnection.default({
+        provider: 'model-jury-codex',
+        timeoutMs: 180_000,
+        maxRetries: 1,
+    }),
+    glm: llmSeatConnection.default({
+        provider: 'glm',
+        model: null,
+        timeoutMs: 120_000,
+        maxTokens: 16_384,
+        maxRetries: 1,
+    }),
+    deepseek: llmSeatConnection.default({
+        provider: 'deepseek-official',
+        model: null,
+        timeoutMs: 120_000,
+        maxTokens: 16_384,
+        maxRetries: 1,
+    }),
+});
+//# sourceMappingURL=config.js.map