kiokuko-dsh 0.2.36 → 0.2.37

package/docs/typesafe.md

@@ -31,9 +31,14 @@ not verified. Invoke the same command with a new key to replace it immediately.
 
 The first command reports configuration, source and writability. Clear removes
 the stored key and reports any remaining source. DSH resolves `TYPESAFE_API_KEY`
-for each call. Its inherited environment takes precedence and makes changes
-read-only; the managed credential store precedes project/user environment files.
-To change an inherited key, update that launch environment and restart DSH.
+for each call. With the standard credentials-local provider, the saved file wins,
+then the launch environment, project `.env` and harness-home `.env`. Saving writes
+the higher-priority file even when an environment fallback exists. Default file
+watching applies valid edits without a restart; an environment-only change must
+be present when DSH is launched. Preserve existing `refs` and `records`.
+See [credential paths, permissions and precedence](typed-decisions.md#openai-credentials).
+Those storage rules also apply to `TYPESAFE_API_KEY`, but `/kioku-typesafe-key`
+does not set `OPENAI_API_KEY`; ChatGPT/Codex OAuth is separate from both keys.
 With no credential provider, evaluation can use the host's `TYPESAFE_API_KEY`,
 but save/clear return `TYPESAFE_STORAGE_UNAVAILABLE`. Kiokuko creates no separate
 credential file and never supplies the key to workers or their subprocesses.

package/docs/verification.md

@@ -15,9 +15,19 @@ Native fixture preparation is deferred until a selected, executable check declar
 root dependencies (`npm ci`), not the DSH runtime fixture. Missing or invalid native
 fixtures remain `prerequisite-missing` for checks that require them.
 
-The required CI `verify` aggregate waits for `verify-main`, the complete Protected
-Lisp matrix and the complete semantic platform matrix. All three dependency results
-must be `success`; failure, cancellation, skipped or missing results fail the aggregate.
+CI schedules **Linux x64** and **macOS ARM64**. Full selection has 21 jobs:
+selection, two native micro-judge builds, 17 verification lanes and the aggregate.
+Linux ARM64 is not scheduled or claimed as CI coverage. Its runtime/build support
+remains in the native target registry; this workflow does not produce its binary.
+
+The required `verify` aggregate consumes `select`, `micro-judge-native` and `checks`.
+Every selected lane and native artifact must be present, successful, fresh and
+bound to the same selected plan and source. Failure, cancellation, a missing
+selected report, an extra target or an altered artifact fails acceptance. Only
+prose-only selection can legitimately skip both executable job groups. The
+remaining Linux x64/macOS ARM64 check inventories and their deadlines are unchanged.
+The CI review bundle contains exactly its selected targets; standalone native
+bundle verification still requires the complete supported-target inventory.
 
 Output defaults to a fresh OS temporary directory. Supply an empty directory
 outside the repository with `--output`. `plan.json`, per-command logs, official
@@ -80,6 +90,21 @@ arbitrary stdout or a successful no-op process is insufficient.
 
 ## Consolidated duplicate invocations
 
+Selected CI dependency installs set `KIOKUKO_CI_DEFER_PREPARE=1` only on the root
+`npm ci` step. With `CI=true`, this defers this package's `prepare` build to the
+verifier's required clean build; it does not disable dependency lifecycle scripts.
+Ordinary npm/pnpm preparation still builds, including in CI without this explicit
+flag, and build failure remains a failed prepare. The verifier's source/build
+digests, packed-artifact receipts and stale-source rejection remain mandatory.
+
+For full coverage, Linux ARM64 removal changes the planned job count from 27 to
+21 and official DSH fixture builds from 19 to 15. Deferring prepare removes one
+redundant plugin build in each of the remaining 17 verification lanes. This is an
+execution-plan comparison, not a measured hosted-CI duration improvement. Official
+DSH still builds separately for each selected fixture lane; no OS/architecture,
+Node/ABI or native dependency is reused across platforms.
+
+
 - `skill-prompts` is covered by `native-unit`: `tests/dsh/unit/skill-compiler.test.ts`, `tests/dsh/unit/skill-snapshot.test.ts`.
 - `index-reasoning` is covered by `native-integration`: `tests/dsh/integration/index-reasoning.test.ts`, `tests/dsh/integration/index-reasoning-native.test.ts`, `tests/dsh/integration/index-reasoning-evaluation.test.ts`.
 - `index-evaluation` is covered by `native-integration`: `tests/dsh/integration/index-reasoning-evaluation.test.ts`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -24,6 +24,7 @@
     "skills/",
     "dsh/cordis.patch.yml",
     "docs/",
+    "scripts/prepare-build.mjs",
     "scripts/backfill-akinator-memory.mjs",
     "scripts/setup-dsh.mjs",
     "scripts/repair-session-log.mjs",
@@ -168,7 +169,7 @@
         "Enabled source-candidate assessment distinguishes unavailable and incomplete checks from proof; the micro judge is native-verified on Apple Silicon macOS only, unsupported platforms report unavailable, and explicit typed-decision OFF records no assessment"
       ],
       "lifecycleEvidence": [
-        "prepare runs only npm run build",
+        "prepare builds by default; selected CI installs defer to the verifier clean build",
         "Git installs use repository-scoped pnpm allowBuilds approval on a supporting pnpm version; source revision pinning is optional and separate",
         "Disposable-profile install, Web start, and uninstall evidence is recorded by CI"
       ]
@@ -201,7 +202,7 @@
     "publint": "publint",
     "pack:check": "node scripts/pack-check.mjs",
     "prepublishOnly": "node scripts/prepublish.mjs",
-    "prepare": "npm run build",
+    "prepare": "node scripts/prepare-build.mjs",
     "test:agenticreplay:package": "npm run build && node scripts/verify-agenticreplay-consumer.mjs && node scripts/verify-agenticreplay-consumer.mjs --pnpm",
     "test:memory-review": "node scripts/run-tests.mjs tests/dsh/unit/memory-review tests/dsh/integration/memory-review",
     "test:evolution": "node scripts/run-tests.mjs tests/dsh/unit/evolution tests/dsh/integration/evolution",

package/scripts/prepare-build.mjs

@@ -0,0 +1,13 @@
+// CI dependency installation may defer only this package's duplicate build.
+// Dependency lifecycle scripts still run; the selected verifier builds from source.
+import { spawnSync } from 'node:child_process'
+
+if (process.env.CI === 'true' && process.env.KIOKUKO_CI_DEFER_PREPARE === '1') {
+  console.log('Deferring package prepare build to the selected verifier clean build.')
+} else {
+  const runner=process.env.npm_execpath
+  if (!runner) throw new Error('Run prepare through npm or pnpm.')
+  const result=spawnSync(process.execPath,[runner,'run','build'],{stdio:'inherit'})
+  if (result.error) throw result.error
+  process.exitCode=result.status ?? 1
+}

package/scripts/setup-dsh.mjs

@@ -1,14 +1,19 @@
 import { parseArgs } from 'node:util'
-import { setupDsh } from '../dist/dsh/setup.js'
+import { removeDshSetup, setupDsh } from '../dist/dsh/setup.js'
 
 try {
   const { values } = parseArgs({ options: {
     cwd: { type: 'string' }, home: { type: 'string' },
     check: { type: 'boolean', default: false }, json: { type: 'boolean', default: false },
+    remove: { type: 'boolean', default: false },
   } })
-  const result = await setupDsh({ cwd: values.cwd, homeDirectory: values.home, check: values.check })
+  const result = await (values.remove ? removeDshSetup : setupDsh)({ cwd: values.cwd, homeDirectory: values.home, check: values.check })
   if (values.json) console.log(JSON.stringify(result, null, 2))
-  else {
+  else if (values.remove) {
+    console.log(values.check ? result.current ? 'Removal is current.' : 'Removal is needed; run again without --check.' : 'Removal complete.')
+    console.log(`Skills: ${result.skills.directory} (${result.skills.removed} ${values.check ? 'removable' : 'removed'}, ${result.skills.preserved} preserved)`)
+    console.log(`Project instructions: ${result.instructions.path} (${result.instructions.status})`)
+  } else {
     console.log(values.check ? result.current ? 'Setup is current.' : 'Setup needs updating; run again without --check.' : 'Setup complete. Reload existing sessions to refresh their instructions.')
     console.log(`Skills: ${result.skills.directory} (${result.skills.created} ${values.check ? 'missing' : 'created'}, ${result.skills.updated} ${values.check ? 'stale' : 'updated'}, ${result.skills.unchanged} unchanged)`)
     console.log(`Project instructions: ${result.instructions.path} (${result.instructions.status})`)