dsh-modellix 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -6,6 +6,49 @@ The format follows Keep a Changelog.
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-08-31
+
+### Added
+
+- Added six explicit, namespaced Agent media tools: live model list, live model Schema, natural-language Schema preparation, session/workspace file upload, one-shot generation, and result lookup.
+- Added explicit `modellix_web_search` and `modellix_web_fetch` tools plus Agent routing context so current, external, URL, and source-verification questions can browse automatically without requiring the user to name a tool.
+- Added chat-native media result cards with Preview/JSON tabs, image enlargement, native video/audio players, URL insertion, and downloads.
+- Added the right-side **Modellix Design** session panel with a fixed 360 px desktop content width, full-width narrow behavior, close/focus restoration, a collapsible result list, and independently collapsible result cards.
+- Added background Client job watchers that reconcile submitted cards to terminal state without another Agent result call.
+- Added task ownership by Harness session id, legacy WAL migration compatibility, and per-session result filtering.
+- Added bilingual release/acceptance checklists and twelve new 1920×1080 real-session screenshots covering the current chat-first workflow.
+
+### Changed
+
+- Removed the standalone Design tab. Natural-language chat is now the primary media creation and transformation interface.
+- Kept the advanced exact-parameter editor implementation but hid its entry for this release.
+- Moved parameter preparation to the top of the retained advanced editor.
+- Instructed media routing to reuse the latest relevant result URL for edits and transformations, preventing source-dependent requests from falling back to text-to-media.
+- Changed nonterminal assistant wording to acknowledge submission without embedding immutable queued/running/generating status text.
+- Removed routine payment-warning copy from plugin UI flows; account state and usage details remain available in Modellix.
+- Replaced previous Design-page documentation and screenshots with current chat result, drawer, media player, model selector, Settings, and automatic Web examples in separate English and Chinese sessions.
+
+### Fixed
+
+- Fixed duplicate media cards when `modellix_media_generate` and the required one-shot `modellix_media_get_result` referenced the same job.
+- Fixed completed jobs remaining visually “Running” in chat by reconciling stored tool output with the live session controller.
+- Fixed background watchers being disposed during layout slot remounts or temporary drawer closure.
+- Fixed cross-session result leakage by persisting and filtering task session ownership.
+- Fixed running and failed cards exposing empty Preview/JSON panels; these tabs now appear only for successful results.
+- Fixed schema parsing compatibility for current Modellix OpenAPI responses and shared-reference layouts while retaining bounded safety limits.
+- Fixed repeated Agent media generation caused by stale nonterminal prose and ambiguous task ownership.
+
+### Security
+
+- Kept Credential data write-only and out of media tools, Client state, task WAL records, screenshots, evidence, and diagnostics.
+- Preserved no-automatic-replay behavior for generation and upload submissions with unknown outcomes.
+- Restricted local path uploads to regular, non-symlink files within the active session workspace.
+
+### Verification
+
+- Added regression coverage for duplicate-card arbitration, background status convergence, controller retain/release across layout remounts, session isolation, legacy WAL records, explicit Web tools, media uploads, and non-stale Agent routing.
+- Verified real image, image-to-video, audio, DeepSeek Agent, Modellix LLM, automatic Web Search/Fetch, native media playback, bilingual 1920×1080 browser flows, responsive behavior, keyboard interactions, and zero browser Console errors/warnings.
+
 ## [0.1.1] - 2026-08-26
 
 ### Fixed

package/README.md

@@ -2,36 +2,44 @@
 
 # dsh-modellix
 
-A Modellix Profile Bundle for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): one Modellix API Key provides schema-driven Design media generation, a live LLM model catalog, and native Web providers.
+`dsh-modellix` brings Modellix media generation, LLM models, and Web research into [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). One Modellix API Key enables a chat-first workflow: ask naturally, keep the context in the conversation, and inspect completed work without leaving the session.
 
-> Harness and this plugin currently use prerelease interfaces. Before upgrading Harness, check this package's peer dependencies and [CHANGELOG](CHANGELOG.md).
+> Harness and this plugin currently use prerelease interfaces. Check the peer dependencies and [CHANGELOG](CHANGELOG.md) before upgrading Harness.
 
-![English Modellix Design desktop layout in a real Harness session, with model and parameters on the left and results on the right](docs/assets/design-desktop-en.webp)
+![A real English Harness conversation showing a completed Modellix image result](docs/assets/chat-media-generation-en.webp)
 
-## Feature overview
+## What changed in 0.2.0
 
-| Feature | User experience | Actual behavior |
-| --- | --- | --- |
-| Design | Select a model, enter a prompt, and adjust parameters on the left; review tasks and results on the right | Reads the live image, video, and audio catalog and each model's public Schema; submits a billed generation only once |
-| LLM | Quickly switch Modellix models in the Harness model selector | Merges the live catalog into the Harness `llm-pi-ai` Modellix provider |
-| Web | Use the native Harness `web_search` and `web_fetch` tools | Registers Modellix Search/Fetch providers without creating duplicate custom tools |
+- Removed the standalone Design tab. Chat is now the primary media workflow.
+- Added six explicit Agent tools for media catalog, Schema, parameter preparation, uploads, generation, and result lookup.
+- Added explicit Modellix Web Search and Fetch tools so the Agent can use them automatically when current or source-backed information is needed.
+- Added **Modellix Design** as a right-side session panel. It is 360 px wide on desktop, full-width on narrow screens, and does not squeeze its internal content during opening or closing.
+- Added live chat result cards. A submitted card updates in place when the background task finishes; the one-shot result lookup does not create a duplicate card.
+- Added session-scoped result history, collapsible result lists and cards, image enlargement, native video/audio players, **Add URL to chat**, and **Download**.
+- Kept the exact-parameter editor internally, but its entry is intentionally hidden in this release while the chat-first experience is finalized.
+- Removed routine payment prompts from the UI. A configured Modellix Key already establishes the expected usage model; consumption and details remain available in Modellix.
+
+## Capabilities
 
-The first-run dialog contains an API Key field and Design, LLM, and Web switches. All three switches are on by default and can later be disabled independently in Modellix settings.
+| Area | User experience | Registered capability |
+| --- | --- | --- |
+| Media | Ask the Agent to create, edit, animate, or narrate media | `modellix_media_list`, `modellix_media_schema`, `modellix_media_prepare`, `modellix_media_upload_file`, `modellix_media_generate`, `modellix_media_get_result` |
+| Results | Review media in chat or in the right-side session panel | Live status reconciliation, Preview/JSON for successful jobs, image/video/audio presentation, URL insertion, download |
+| LLM | Select live Modellix models from the Harness model selector | Modellix OpenAI-compatible provider with a live catalog and provider retries set to `0` |
+| Web | Ask a current, external, URL, or source-verification question normally | `modellix_web_search` and `modellix_web_fetch`, selected automatically by Agent routing instructions |
 
 ## Requirements
 
 - DeepSeek Harness `0.1.1-rc.2`
 - Published-package runtime: Node.js `^22.19.0 || >=24.0.0`
-- Source development and release verification: Node.js `24.18.1` and pnpm `11.24.0` (see `.nvmrc` and `packageManager`)
+- Source development and release verification: Node.js `24.18.1`, pnpm `11.24.0`
 - A valid [Modellix API Key](https://docs.modellix.ai/get-started)
 
-`dsh-modellix` contains its own Harness integration. It neither installs nor invokes `modellix-cli` at runtime.
+The plugin contains its own Harness integration. It does not install or invoke `modellix-cli` at runtime.
 
 ## Installation
 
-For a Windows-first walkthrough from this source checkout, see [Using dsh-modellix locally](docs/en-US/LOCAL_USAGE.md) or its [Chinese edition](docs/zh-CN/LOCAL_USAGE.md).
-
-Install the published package into the target Web profile, inspect the merged configuration, then start or restart that profile:
+Install the package in the target Web profile, inspect the merged configuration, and start or restart that profile:
 
 ```sh
 dsh plugin --profile web add dsh-modellix
@@ -39,223 +47,150 @@ dsh --profile web --dump-config
 dsh --profile web
 ```
 
-`--dump-config` should show the `dsh-modellix` Bundle layer and a plugin row whose id is `modellix`. Replace `web` if you use a different profile.
+`--dump-config` should contain the `dsh-modellix` Bundle layer and a plugin row with id `modellix`. Replace `web` if you use another profile.
 
-You can also build a tarball from trusted source and install the artifact:
+To install a trusted local build:
 
 ```sh
 pnpm install --frozen-lockfile
 pnpm run verify:release:static
 pnpm pack
-dsh plugin --profile web add ./dsh-modellix-0.1.1.tgz
+dsh plugin --profile web add ./dsh-modellix-0.2.0.tgz
 ```
 
-Installing TypeScript source directly from Git requires the installation phase to produce `lib/`. Until the package provides a verified `prepare` flow, use the published package or a local tarball.
+See [local usage](docs/en-US/LOCAL_USAGE.md) for the complete Windows-first workflow.
 
-## First-time setup
+## Configure the API Key
 
-1. Open the Harness Web UI and wait for the “Connect Modellix” dialog.
-2. Enter the API Key and confirm whether the three default-on Design, LLM, and Web switches match your needs.
-3. Select “Save and enable.” After a successful save, the browser never displays the Key again; it only shows Credential status and source.
-4. Select “Configure later” if you are not ready. This does not mark the plugin as usable; the next explicit use of an enabled Modellix capability that needs a Credential requests it again.
+On first use, enter the Key in **Connect Modellix**, keep the required services enabled, and select **Save and enable**. The saved Credential is write-only: the Client receives only configuration status and source, never the stored Key.
 
-The API Key can come from either source:
+Alternatively, provide `MODELLIX_API_KEY` to the Harness launch environment. Environment Credentials are read-only in the UI and require a Harness restart after replacement.
 
-- Enter it during first-time setup or in settings, where the Harness Credential service stores it.
-- Supply `MODELLIX_API_KEY` in the Harness launch environment. An environment-sourced Key is read-only in the UI; restart Harness after updating it.
+Do not put a real Key in a repository, command argument, URL, browser storage, log, screenshot, HAR, recording, or test snapshot.
 
-Never put a real Key in a repository, command argument, log, screenshot, HAR, recording, or test snapshot.
+## Chat-first media workflow
 
-See the [user guide: first-time setup and Credentials](docs/en-US/USER_GUIDE.md#first-time-setup) for the complete flow.
+Describe the outcome, not the tool sequence. For example:
 
-## Quick use
+> Create a polished 16:9 architectural hero image of a glass botanical research pavilion floating above a dawn cloud sea, with restrained lapis-blue and warm-gold tones, realistic premium materials, no people, no text, and no watermark.
 
-### Design: generate images, video, or audio
+The Agent can then:
 
-1. Open the **Design** view in Harness.
-2. Search, filter by output type, and select a model. The plugin first restores the most recently selected available model; otherwise it chooses a preferred available model from the current catalog.
-3. Enter the primary prompt. Many models need only a prompt; all other fields come from the model's current `api_schema`, including public defaults.
-4. For exact control, edit enum, switch, numeric, text, or JSON parameters directly. Values that violate the Schema prevent submission.
-5. To adjust parameters in natural language, describe the change under “Adjust parameters by chat.” This uses the same Key with the fixed `openai/gpt-5.6-luna` model and may incur LLM usage. It produces a reviewable diff and never starts media generation by itself.
-6. Review parameters and the billing notice, then select “Confirm and generate” once. The billed POST is never retried automatically; read-only task status checks use only bounded safe retries.
-7. The right results pane groups records as Running, Succeeded, or Diagnostics and supports enlarged images, video/audio playback, and safe downloads.
+1. Search the live media catalog if a compatible model is not already known.
+2. Read that model's live API Schema and use only published fields and values.
+3. Reuse the latest relevant result URL for edit, image-to-video, or video-to-video requests instead of silently switching back to text-to-media.
+4. Upload a local or conversation file when the selected Schema requires a public media URL.
+5. Submit the generation exactly once. An unknown submission outcome is never replayed automatically.
+6. Check once in the Agent turn. A background watcher then updates the existing card to its terminal state without another Agent tool call.
 
-For example, select an available image model whose live Schema exposes `quality` and `size`, then enter this acceptance prompt:
+While a task is nonterminal, immutable assistant prose only confirms acceptance and points to the live result card and Modellix Design. It does not leave behind a stale “running” sentence.
 
-> A premium editorial architectural photograph of a quiet cliffside library above a misty alpine lake at blue hour, carved pale stone arches, warm amber reading lamps, one thoughtful reader, subtle greenery, natural reflections, cinematic but realistic lighting, restrained navy and ivory palette, precise composition, no text, no logo.
+### Result behavior
 
-This is the exact prompt used for the documented real-API image, not a placeholder. The screenshot below was captured after the task completed in the real Design results list.
+- **Running and failed:** show a concise header/status only; Preview and JSON are not offered without a successful result.
+- **Succeeded:** show Preview and JSON tabs. Images enlarge in a focus-managed dialog; video and audio use native players.
+- **One task, one card:** a `generate` card takes ownership of its task; the corresponding `get_result` call does not render a second copy.
+- **Session isolation:** the right panel shows only tasks owned by the current Harness conversation. Legacy records without a session owner are not injected into new sessions.
+- **Actions:** **Add URL to chat** appends the selected resource URL to the composer; **Download** opens the upstream resource safely.
+- **Expiry:** the displayed expiry follows the upstream result. If none is provided, the plugin applies a seven-day local display limit; it does not extend the upstream URL or keep a permanent media copy.
 
-Set `quality` to `high` and `size` to `1536x1024`, leaving other fields at the model's current defaults. You can edit those controls directly or ask the parameter assistant to propose the two changes, then review and apply the diff. The proposal may incur LLM usage but does not generate an image. Only the final “Confirm and generate” action starts the billed media request, and the plugin does not retry it automatically. If the selected model does not advertise either field, do not add it manually—choose values and fields from that model's live Schema.
+![The English Modellix Design right-side panel showing three session-scoped results](docs/assets/design-results-drawer-en.webp)
 
-Results remain accessible only while the upstream resource is valid. If the upstream response has no expiry, the plugin uses a seven-day local display limit. This does not extend the upstream URL or copy media into permanent local storage.
+![The real generated video playing in chat while the session result panel remains available](docs/assets/media-players-en.webp)
 
-### LLM: switch models quickly
+## Modellix Design panel
 
-1. Keep LLM enabled and configure a valid Key.
-2. In Modellix settings, inspect catalog status, model count, and last refresh time; refresh manually when needed.
-3. Select a model under the Modellix provider in the Harness model selector. The choice applies to the next model call.
+The **Modellix Design** button sits at the far right of the conversation header, beside **Session log**. It opens a split-panel experience on large screens and a full-width overlay on narrow screens.
 
-LLM uses the OpenAI Completions-compatible endpoint `https://llm.modellix.ai/v1`. The plugin sets provider retries to `0` to avoid repeating model calls at the plugin layer; it never fabricates a static model list when the catalog is unavailable.
+- The entire Results list is expanded by default and can be collapsed.
+- Every result card is expanded by default and can be collapsed by selecting its header.
+- The close button returns focus to the launcher.
+- The advanced exact-parameter editor remains implemented but its entry is hidden in `0.2.0`; ordinary users work through chat.
+- At 560 px and below, the panel uses the available viewport width. At 360 px and below, the launcher becomes a reachable compact control.
 
-### Web: search and fetch
+## LLM models
 
-When Web is enabled and a Key is available, ask Harness to search the public Web and, when needed, fetch a selected result. The native `web_search` and `web_fetch` tools run through the Modellix provider; the plugin does not add a duplicate Tool UI. The provider is unavailable when Web is disabled or no valid Key exists. Web requests may incur Modellix usage and are not automatically retried by the provider. If a paid Fetch outcome is unknown, inspect the Harness transcript or Modellix-side record before repeating it manually.
+When LLM is enabled, the plugin reads the live Modellix catalog and adds those models to the Harness model selector. It does not fabricate fallback entries when the catalog is unavailable. Refresh status and model count are available in Modellix settings.
 
-## Settings, states, and recovery
+![The live Modellix model catalog in the English Harness selector](docs/assets/llm-model-selector-en.webp)
 
-The Modellix settings page provides:
+## Automatic Web Search and Fetch
 
-- Credential configuration, source, and verification status, plus replacement and removal for a local writable Credential;
-- independent Design, LLM, and Web switches;
-- LLM catalog health, model count, last refresh time, and manual refresh.
+Users do not need to name a tool. For current, changing, external, or source-verification questions, the Agent is instructed to use `modellix_web_search`. When the user provides a public URL or a search result needs full-page reading, it uses `modellix_web_fetch`.
 
-Only an explicit HTTP 401 marks the current Credential invalid and opens recovery. A 402, 429, network failure, or 5xx is not reported as an invalid Key. If an environment-sourced Key is invalid, update `MODELLIX_API_KEY` in the launch environment and restart Harness; the UI cannot override it.
+The explicit Modellix tools and the native Harness providers share the same underlying service, but the routing instruction prevents both tool families from being called for the same operation. Failed or unknown Web requests are not repeated automatically.
 
-Recovery is coordinated across plugin dialogs: concurrent 401 responses produce one Credential dialog. An already-open local Key editor upgrades in place; if an ordinary removal confirmation or image viewer is open, recovery waits until it closes instead of stacking another modal. Save a replacement Key and retry the intended capability. For an environment-sourced Key, update it outside the UI and restart Harness.
+![A real English Agent turn automatically using Modellix Search and Fetch](docs/assets/web-tools-auto-en.webp)
 
-If a disconnected billed submission has an unknown outcome, Design shows “Submission outcome unknown.” Check Results or the Modellix-side record before any manual resubmission to avoid duplicate charges.
+## Settings and recovery
 
-## Accessibility and responsive behavior
+The Modellix settings section shows:
 
-- Dialogs explicitly manage initial focus, `Tab` / `Shift+Tab` wrapping, background inertness, and focus restoration after closing.
-- A mandatory Credential gate cannot close implicitly through Escape or the backdrop, but always has a visible “Configure later” action. Ordinary confirmation dialogs support Escape.
-- Fields have visible labels, linked errors, busy states, and live status announcements; state is not conveyed by color alone.
-- Design uses a left-workspace/right-results layout when its container is wider than `992px`; narrower host slots stack into one column, with a viewport fallback at `768px`. The implementation targets `320px`, 200% text zoom, light/dark themes, forced colors, 48px coarse-pointer targets, and reduced motion.
-- UI text follows the current Harness locale. `README.md` is the default English entry, with a complete Chinese edition alongside it.
+- Credential configured/verification status and source;
+- replacement and removal actions for a writable local Credential;
+- independent Design, LLM, and Web switches;
+- live LLM catalog health, count, refresh time, and manual refresh.
 
-## Uninstallation
+Only HTTP 401 marks a Credential invalid. HTTP 402, 429, network failures, and 5xx retain their own recovery states. Concurrent 401 responses are coalesced into one Credential dialog.
 
-If the Key is stored in a local writable Credential, remove it from Modellix settings first. Revoke an environment-sourced Key in the external launch environment or secret manager. Then remove the plugin from the target profile and restart it:
+![English Modellix settings with a configured write-only Credential and live catalog](docs/assets/settings-ready-en.webp)
 
-```sh
-dsh plugin --profile web remove dsh-modellix
-dsh --profile web --dump-config
-dsh --profile web
-```
+## Accessibility and responsive behavior
 
-Uninstalling the plugin does not promise to remove external environment variables, upstream tasks, or every piece of persisted Harness data. Handle each system separately if your policy requires cleanup.
+- Dialogs manage initial focus, Tab/Shift+Tab wrapping, background inertness, Escape behavior where allowed, and focus restoration.
+- Result tabs support standard keyboard navigation; result/status changes use polite live regions.
+- State is conveyed with text in addition to color.
+- Layouts were checked at 320, 560, 768, and 1440 CSS px, at 200% text scaling, in light and dark themes, forced colors, coarse pointer, and reduced motion.
+- Narrow layouts preserve every result action without horizontal page overflow.
 
-## UI previews and safe screenshots
+## Documentation
 
-- [完整中文用户指南](docs/zh-CN/USER_GUIDE.md)
 - [Complete English user guide](docs/en-US/USER_GUIDE.md)
-- [Chinese README](README.zh-CN.md)
-
-The repository includes six English full-screen screenshots captured from a real configured Harness session. The Chinese guide uses a separate six-image Chinese set of the same workflows. The captures use the live Modellix catalog, a real Schema-constrained parameter proposal, one completed `gpt-image-2` result, a real Modellix LLM turn, and real native Web Search/Fetch. None contains an API Key, Network request details, HAR, or Credential file:
-
-| Suggested file | Alt text |
-| --- | --- |
-| `docs/assets/settings-ready-en.webp` | English Modellix settings with a verified local Credential, all three feature switches, and 26 live LLM models |
-| `docs/assets/design-desktop-en.webp` | English Modellix Design two-pane desktop workspace using the live `gpt-image-2` Schema |
-| `docs/assets/design-proposal-en.webp` | English real parameter proposal with Schema-valid before/after values and explicit Reject/Apply actions |
-| `docs/assets/design-results-media-en.webp` | English result pane with the real 1536×1024 image, expiry, enlargement, and download actions |
-| `docs/assets/llm-model-selector-en.webp` | English Harness model selector populated from the live Modellix LLM catalog |
-| `docs/assets/web-tools-en.webp` | English Harness chrome showing real Modellix Search and Fetch results for public official documentation |
-
-The Credential is shown only as a write-only configured status. Never open the Key editor, Network, HAR, Console, Credential files, Cookies, or request details while capturing a real session.
-
-## Current limitations
+- [English release and acceptance checklist](docs/en-US/RELEASE_CHECKLIST.md)
+- [完整中文用户指南](docs/zh-CN/USER_GUIDE.md)
+- [中文发布与验收清单](docs/zh-CN/RELEASE_CHECKLIST.md)
+- [Local source usage](docs/en-US/LOCAL_USAGE.md)
 
-- The Design parameter assistant is constrained by the current Schema; it is not an open-ended agent.
-- There is no upstream cancellation call, and the UI has no task cancellation button.
-- The results pane persists task metadata and upstream resource URLs, not the API Key, prompt, or media copies.
-- A complex Schema with a blocking unsupported constraint disables submission instead of guessing parameter meaning.
-- LLM materializes only models advertised by the live catalog and does not provide fabricated fallback models.
+The repository contains six English and six Chinese 1920×1080 screenshots captured from separate real-language sessions. They cover settings, chat image generation, the result drawer, media players, live LLM models, and automatic Search/Fetch. No capture contains a Key, request header, Network/HAR data, Credential file, or browser storage.
 
-## Development and verification
+## Development and release verification
 
 ```sh
 pnpm install --frozen-lockfile
-pnpm run verify:env
-pnpm run typecheck
-pnpm run lint
-pnpm run test
-pnpm run build
+pnpm run check
 pnpm run verify:pack
 pnpm run verify:fresh-install
 pnpm run verify:node22-install
 pnpm run verify:release:static
 ```
 
-`pnpm run check` runs environment verification, type checking, lint, the complete unit/contract suite, global hard coverage thresholds, and file-specific regression floors for the Host runtime and Design parameter planner. `verify:pack` checks the exact artifact allowlist, bilingual documentation, twelve locale-specific metadata-free WebP screenshots by actually decoding them, entries, embedded Source Map source, and sensitive-file exclusions. `verify:fresh-install` installs the final tarball in a temporary project, loads Host, executes the Client factory, checks subpath exports, and compiles consumer type smokes. `verify:node22-install` repeats the tarball runtime smoke with an explicitly configured or NVM-discovered Node.js `^22.19.0` binary and fails instead of silently skipping when none exists. `pnpm run verify:release:static` chains these static gates with the production dependency audit.
-
-### Complete release evidence gate
-
-Use `pnpm run verify:release` for an actual release. First commit the final code, documentation, and screenshots and keep the worktree clean. Create two Secret-free JSON files outside the repository. Each must be smaller than 32 KiB, target the current package version and lowercase 40-character HEAD, and use a canonical UTC ISO-8601 `completedAt` no more than 72 hours old. Browser evidence must contain every fixed check below:
-
-```json
-{
-  "version": 1,
-  "kind": "browser",
-  "status": "passed",
-  "package": { "name": "dsh-modellix", "version": "0.1.1" },
-  "commit": "<current-40-character-lowercase-git-head>",
-  "completedAt": "<canonical-utc-iso-8601>",
-  "checks": {
-    "onboarding": "passed",
-    "settings": "passed",
-    "design": "passed",
-    "llm": "passed",
-    "web": "passed",
-    "401": "passed",
-    "a11y": "passed",
-    "theme": "passed",
-    "viewports": "passed"
-  }
-}
-```
+`pnpm run verify:release` additionally requires fresh Secret-free browser and real API/Agent evidence bound to the exact package version and 40-character Git commit. The complete procedure is documented in [RELEASE_CHECKLIST.md](docs/en-US/RELEASE_CHECKLIST.md).
 
-Real API/Agent evidence must cover catalogs, parameter planning, all three media types, the LLM Agent, and Web. `billedCallsExplicitlyAuthorized` attests only that the operator explicitly authorized this run's billed calls; never put a Key, request header, or any other Secret in evidence:
-
-```json
-{
-  "version": 1,
-  "kind": "api-agent",
-  "status": "passed",
-  "package": { "name": "dsh-modellix", "version": "0.1.1" },
-  "commit": "<current-40-character-lowercase-git-head>",
-  "completedAt": "<canonical-utc-iso-8601>",
-  "checks": {
-    "catalogs": "passed",
-    "planner": "passed",
-    "image": "passed",
-    "video": "passed",
-    "audio": "passed",
-    "llm-agent": "passed",
-    "web": "passed"
-  },
-  "billedCallsExplicitlyAuthorized": true
-}
-```
-
-To produce this evidence from live services, first complete and verify one Modellix-backed DSH Agent turn in an isolated Web profile. Then let the acceptance process supply `MODELLIX_API_KEY` directly from a controlled environment, file, or Credential and run `pnpm run test:real:modellix` with these non-secret controls:
+## Current limitations
 
-```powershell
-$env:MODELLIX_ALLOW_BILLED_E2E = '1'
-$env:MODELLIX_REAL_AGENT_ATTESTED = '1'
-$env:MODELLIX_REAL_E2E_OUTPUT_DIR = 'D:\outside-repo\modellix-real-results'
-$env:MODELLIX_API_AGENT_E2E_EVIDENCE_FILE = 'D:\outside-repo\api-agent-evidence.json'
-pnpm run test:real:modellix
-```
+- The advanced exact-parameter editor entry is intentionally hidden in this release.
+- Upstream generation cancellation is not exposed.
+- Result history stores task metadata and upstream URLs, not permanent media copies.
+- A complex unsupported Schema blocks submission instead of guessing or dropping constraints.
+- The Modellix LLM catalog has no fabricated offline fallback.
 
-The runner performs live authenticated catalogs and Schema planning, submits exactly one billed image, video, and audio POST, polls those tasks with bounded reads, executes real Web Search/Fetch, saves all media outside the repository for independent decoding checks, and writes Secret-free evidence. It refuses to run without both explicit billing authorization and the prior Agent attestation. It never supplies or accepts a Key as a command argument.
+## Uninstallation
 
-Supply both absolute paths and run the gate. Paths may be environment variables; the API Key must not be:
+Remove a locally stored Credential from Modellix settings first, or revoke an environment Credential in its external secret manager. Then remove the plugin and restart the profile:
 
 ```sh
-MODELLIX_BROWSER_EVIDENCE_FILE=/absolute/path/browser-evidence.json \
-MODELLIX_API_AGENT_E2E_EVIDENCE_FILE=/absolute/path/api-agent-evidence.json \
-pnpm run verify:release
+dsh plugin --profile web remove dsh-modellix
+dsh --profile web --dump-config
+dsh --profile web
 ```
 
-Evidence is a strictly shaped acceptance attestation; it does not execute or retry billed calls. The gate fails for a missing, failed, or unknown check, unknown field, in-repository or stale file, package/commit mismatch, or dirty worktree.
+Uninstallation does not remove upstream Modellix tasks, external environment variables, or all Harness profile data.
 
 ## References
 
 - [Modellix getting started](https://docs.modellix.ai/get-started)
 - [Modellix LLM overview](https://docs.modellix.ai/llm/overview)
-- [Modellix GPT Image 2 example](https://www.modellix.ai/zh_CN/models/openai/gpt-image-2)
+- [Modellix model catalog](https://www.modellix.ai/models)
 - [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
 
 ## License