kiokuko-dsh 0.2.19 → 0.2.21

package/docs/curator-classification.md

@@ -0,0 +1,76 @@
+# Curator semantic classification (opt-in)
+
+Curator no longer treats Japanese/English keywords or character count as semantic
+proof. The provider-neutral `curator-classification` Typed Decisions contract asks
+three independent questions: reusable meaning, actionable procedure, and
+project-bound meaning. It is not correction classification and does not assign
+trust, verification, skill readiness, or permission.
+
+## Safe rollout
+
+The feature defaults to off. Explicitly set
+`typedDecisions.curatorClassification.mode` to `auto` in the existing Typed
+Decisions configuration when intentionally testing or enabling the classifier.
+The host passes the configured DecisionService to `curator_check`; it never
+substitutes a provider or lowers its acceptance gates. Default-off means Curator
+returns no admitted candidates until classification is enabled, with an explicit
+`classificationStatus` explaining withheld candidates. Ordinary memory capture,
+retrieval, and existing trusted global entries are not disabled.
+
+Current evidence is offline only. Do not interpret the new contract as a claim of
+multilingual model accuracy. Validate the selected provider/model against the
+benchmark, especially missed project-local boundaries, before enabling it for
+real data. Enabling may send complete title, summary and body to the configured
+provider, subject to the existing credential, secret filtering and size limits.
+
+## Persistence and approval
+
+Inference is not guaranteed deterministic. A successful classification is stored
+with source identity/revision/content digest, schema/policy version, configuration
+digest, provider/model metadata, and result digest. The first persisted result
+wins for that exact identity. Repeated views and restarts replay it; downstream
+scoring and draft rendering are deterministic. This is integrity/reproducibility,
+not evidence that the model is correct. The existing deterministic draft version
+continues to describe only draft generation, not inference.
+
+Unknown, abstained, malformed, oversized, timed-out, stale or unavailable results
+cannot admit candidates or authorize globalization. No semantic regex fallback
+exists. Unsuccessful assessments are not cached by the Curator store (the
+DecisionService may retain its own request-bound outcome). A later bounded
+invocation can attempt classification again. A view processes at most 50 new
+assessments with a 10-second inference budget and reports deferred rows; narrow
+filters if necessary. Cached rows are still checked for cancellation and current
+configuration.
+
+Globalization remains an explicit application action, never a classifier side
+effect. Its synchronous API requires the reviewed assessment digest and a
+separate host-owned current configuration digest. Callers must obtain that digest
+from the initialized current DecisionService, not from model or user input.
+Changed source/configuration, corrupted evidence or missing review identity
+reject the action. Project-bound assessments are previewable but cannot be
+globalized: revise the source into genuinely portable knowledge, then reclassify
+and review it. Lexical draft normalization is not multilingual portability proof.
+Existing trust/projection checks and qualified-application evidence stay intact;
+classification does not enable the separate automatic globalization route.
+
+## Reproducible evaluation
+
+Run `node --import tsx --test tests/dsh/unit/curator-classification.test.ts` for
+SQLite, restart, score-threshold, failure, approval and trust-boundary tests.
+
+Run `node --import tsx scripts/evaluate-curator.ts --oracle` for offline plumbing.
+Its 20 cases cover Japanese, English, Chinese, Korean and Spanish with reusable,
+local-only, negated and quoted meanings. The oracle supplies expected labels:
+20/20 is therefore not a model accuracy measurement.
+
+Run `node --import tsx scripts/evaluate-curator.ts --live config.json` only with
+an explicitly enabled standalone Typed Decisions configuration and a configured
+provider. It supports TypeSafe, Nimble and Laya through their existing adapters.
+TypeSafe reads TYPESAFE_API_KEY; Nimble reads only its configured credentialRef.
+The harness does not create, save or print credentials and never globalizes.
+Review all unavailable/abstained attempts, not only classified samples. It does
+not retry failed samples to compute admission. Per-case elapsed time includes
+classification and, on success, cached candidate projection/DB reads. Token and
+cost fields are explicitly unavailable, not zero. The fixtures are a small
+handwritten set, not statistical or deployment qualification; use further
+paraphrases, adversarial text and repeated independent runs for that purpose.

package/docs/dependency-security.md

@@ -77,3 +77,29 @@ inference, and the installer skip path with a blocked-network negative control.
 When a symlink extraction fix is published, update both override definitions
 and lockfiles, rerun those checks and both audits, and re-evaluate the temporary
 CI mitigation.
+
+
+## Repository lifecycle approvals
+
+The repository pnpm policy explicitly allows esbuild and denies onnxruntime-node,
+protobufjs, sharp and @google/genai. This is a CPU/prebuilt development policy, not a GPU or
+source-build installation recipe, and does not change a user's DSH profile.
+
+- @google/genai 2.21.0 preinstall only echoes a no-op message; its published
+  runtime is already built. Deny that unnecessary lifecycle explicitly.
+- esbuild 0.28.2 is a direct development dependency. Its postinstall validates and
+  prepares the platform executable; fallback installation can use the network.
+- onnxruntime-node 1.24.3 bundles the CPU runtime. Denying its lifecycle prevents
+  optional CUDA downloads/extraction, consistent with the npm/CI skip mitigation
+  above. Keep ONNXRUNTIME_NODE_INSTALL=skip for npm, which does not read this map.
+- protobufjs 7.6.6 postinstall only emits a version-scheme compatibility warning;
+  it does not generate runtime files or invoke npm. Its separate prepublish
+  scripts contain the cli npm install command, not postinstall.
+- sharp 0.35.5 has no install lifecycle script. Its build script is an explicit
+  source-build command, not an automatic installer. Prebuilt optional packages
+  supply the native runtime, and must not be omitted during installation.
+
+The dependency tests check these explicit booleans, the absence of sharp install
+hooks, esbuild transformation, protobuf encoding/decoding, sharp image processing,
+and bundled ONNX CPU inference. Platform coverage is limited to the hosts where
+these tests actually run; upgrades that introduce new hooks need review.

package/docs/provider-auth-boundaries.md

@@ -7,6 +7,34 @@ credential-resolving `listModels` just to show that inventory. Validation of an
 existing head/worker pair lists only those two selected providers. Current model
 selection validates its call configuration once, in the Models service.
 
+Head/worker candidates and template previews check catalog membership only. They
+do not resolve call configurations or inspect authenticated transports. Preview
+labels say the connection is unverified; a saved pair with matching catalog
+entries reports `currentAvailable: null`. Missing entries remain unavailable.
+Final adoption re-reads only selected providers and validates each distinct
+binding once; errors prevent a ready selection.
+
+The native catalog's display seam uses Kiokuko-owned read-only model metadata or
+the installed pi-ai public discovery with **only** a provider ID. The latter
+answers from its installed catalog, or refuses before credentials when the ID is
+unknown and no endpoint was supplied. It never receives a base URL, credential,
+or fallback request. Redacted configured `models` IDs and `modelOverrides` keys
+also remain candidate metadata for aliases and the DeepSeek account provider.
+Providers lacking static metadata are marked **unverified**, separately from an
+actual catalog failure. Existing draft IDs and shipped template IDs remain
+candidates; the custom picker permits an explicit exact model ID. This preserves
+selection without pretending the account's remote catalog was read. The host's
+dynamic account model names cannot be shown before confirmation without its own
+non-authenticating metadata API. Explicit validation retains native `listModels`
+and `resolveCallConfig` for the selected providers only; absent models still fail.
+
+Deep's role and alternative-model picker follows the same incomplete-inventory
+contract: select a registered provider and enter an exact model ID, then validate
+only on Save. Unknown providers, absent models and connection failures cannot
+become an applied configuration. Native test adapters explicitly attest their
+pure display metadata; separate native cases disable that seam to exercise the
+real incomplete-inventory path rather than authenticating during display.
+
 The legacy Models transport still accepts an explicitly injected `CredentialFile`
 and owns OAuth/API-key transport authentication. Read-only listing must never
 refresh OAuth or acquire its mutation lock. Explicit Nous refresh uses the plugin

package/migrations/046_curator_classification.sql

@@ -0,0 +1,12 @@
+-- Host-owned, content-bound assessments; no source text or authority labels.
+CREATE TABLE curator_classifications (
+  workspace TEXT NOT NULL,
+  entry_id TEXT NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
+  entry_revision INTEGER NOT NULL CHECK(entry_revision > 0),
+  input_digest TEXT NOT NULL,
+  policy_version TEXT NOT NULL,
+  configuration_digest TEXT NOT NULL,
+  result_json TEXT NOT NULL,
+  result_digest TEXT NOT NULL,
+  PRIMARY KEY(workspace,entry_id,entry_revision,input_digest,policy_version,configuration_digest)
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",