kiokuko-dsh 0.2.5 → 0.2.7

package/docs/verification.md

@@ -0,0 +1,112 @@
+# Repository verification
+
+Goal: CI executes the same repository-owned verification contract as local development.
+`npm run verify` runs the full applicable scope. `npm run verify -- --profile main`
+and other profiles are explicitly partial. `npm test` remains a fast/focused entry.
+
+Inspect `npm run verify:plan` before running. Each check declares its runner,
+dependencies, required capability and required result in `scripts/verification.json`.
+CI prepares environments, selects profiles and retains output. Missing required
+capabilities are `prerequisite-missing`; unexpected skips, empty Node suites and
+failed assertions are non-success. Platform exclusions are declared before execution
+and recorded with a reason. Exclusions never imply a result on that platform.
+
+Output defaults to a fresh OS temporary directory. Supply an empty directory
+outside the repository with `--output`. `plan.json`, per-command logs, official
+Node lifecycle reports, `progress.json`, `result.json` and the candidate archive
+are retained. Reports identify source content, runtime, profile, contract and archive.
+
+All package consumers run after a final clean build and pack, against the same
+archive and hash. Installed smoke/host assertions remain the existing assertions.
+The DSH core pack and Skill consumers use normal minimal installs, with no links
+to the development node_modules. Changes during verification are `stale`; saved
+results must be rechecked using `npm run verify -- --status <result.json>`.
+A profile passing alone never sets `completionReady`. A stale or failed full run
+must not be reported as full verification, and local results do not prove remote CI.
+
+## Common suites and retained assertions
+
+The inventory below is generated from the repository contract. A script check
+requires a fresh check-bound completion receipt after its existing assertions;
+arbitrary stdout or a successful no-op process is insufficient.
+
+| Common check | Profiles | Runner | Required result |
+| --- | --- | --- | --- |
+| verification-contract | main, semantic, lisp, browser, runtime | `node --test scripts/verification-contract.test.mjs` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| typecheck | main | `npm run typecheck` | exit 0 |
+| build | main, semantic, lisp, browser, runtime, code-provider, p0, packages-live | `npm run build` | exit 0 |
+| native-unit | main | `node scripts/run-ci-native.mjs unit` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| native-integration | main | `node scripts/run-ci-native.mjs integration` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| native-e2e | main | `node scripts/run-ci-native.mjs e2e` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| skill-efficiency | main | `npm run test:skill-efficiency` | explicit completion receipt |
+| coding-offline | main | `node --test tests/fixtures/skill-coding/offline.test.mjs` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| harness | main | `npm run test:harness` | explicit completion receipt |
+| retrieval | main | `npm run test:evaluation` | explicit completion receipt |
+| decision-evaluation | main | `npm run test:evaluation:decisions` | explicit completion receipt |
+| intent-evaluation | main | `npm run test:evaluation:request-intent` | explicit completion receipt |
+| answer-evaluation | main | `npm run test:evaluation:answer-review` | explicit completion receipt |
+| memory-reuse-evaluation | main | `npm run test:evaluation:memory-reuse -- --mode=all` | explicit completion receipt |
+| sampledb | main | `npm run test:sampledb` | explicit completion receipt |
+| publint | main | `npm run publint` | exit 0 |
+| prepare-reproducibility | main | `npm run verify:prepare` | explicit completion receipt |
+| native-search | lisp, runtime | `node scripts/run-tests.mjs tests/dsh/integration/native-search.test.ts` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| laya-worker | lisp | `npm run test:laya-worker` | exit 0 |
+| lisp-vendor | lisp | `npm run verify:lisp:vendor` | explicit completion receipt |
+| lisp-native | lisp | `npm run test:ci:lisp` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| owned-native | lisp | `node scripts/run-tests.mjs tests/dsh/integration/owned-execution.test.ts tests/dsh/integration/owned-native-lifecycle.test.ts` | complete official lifecycle; at least one passing leaf; no failures, cancellation, todo or undeclared skips |
+| modules | lisp | `npm run test:modules` | explicit completion receipt |
+| models-web | browser | `node scripts/verify-models-web.mjs` | explicit completion receipt |
+| coding-web | browser | `node scripts/verify-coding-workflow-web.mjs` | explicit completion receipt |
+| shortcuts-web | browser | `node scripts/verify-shortcuts-web.mjs` | explicit completion receipt |
+| lisp-approval-web | browser | `node scripts/verify-lisp-approval-web.mjs` | explicit completion receipt |
+| lisp-plan-web | browser | `node scripts/verify-lisp-plan-web.mjs` | explicit completion receipt |
+| pack-check | main, lisp | `node scripts/pack-check.mjs` | explicit completion receipt |
+| skill-delivery | main, lisp | `node scripts/run-skill-delivery.mjs` | explicit completion receipt |
+| consumer-npm | main, runtime | `node scripts/verify-agenticreplay-consumer.mjs` | explicit completion receipt |
+| consumer-pnpm | main, runtime | `node scripts/verify-agenticreplay-consumer.mjs --pnpm` | explicit completion receipt |
+| dsh-lifecycle | main, runtime | `node scripts/run-enno-dsh-e2e.mjs` | explicit completion receipt |
+| sqlite-vec | main, semantic | `npm run test:sqlite-vec` | explicit completion receipt |
+| code-provider | code-provider | `node scripts/run-ci-native.mjs code-provider` | Explicit selected native fixture; nonempty official lifecycle without skipped required cases. |
+| p0 | p0 | `node scripts/run-ci-native.mjs p0` | Explicit selected native fixture; nonempty official lifecycle without skipped required cases. |
+| packages-live | packages-live | `node scripts/run-ci-native.mjs packages-live` | Explicit selected native fixture; nonempty official lifecycle without skipped required cases. |
+
+## Consolidated duplicate invocations
+
+- `skill-prompts` is covered by `native-unit`: `tests/dsh/unit/skill-compiler.test.ts`, `tests/dsh/unit/skill-snapshot.test.ts`.
+- `index-reasoning` is covered by `native-integration`: `tests/dsh/integration/index-reasoning.test.ts`, `tests/dsh/integration/index-reasoning-native.test.ts`, `tests/dsh/integration/index-reasoning-evaluation.test.ts`.
+- `index-evaluation` is covered by `native-integration`: `tests/dsh/integration/index-reasoning-evaluation.test.ts`.
+
+Import-only convenience entrypoints remain usable explicitly. Recursive discovery
+excludes these aliases and executes each declared leaf exactly once:
+
+- `tests/dsh/integration/capability.test.ts`: `tests/dsh/integration/akinator-gate.test.ts`, `tests/dsh/integration/pre-step/gate.test.ts`, `tests/dsh/unit/capability-catalog.test.ts`.
+- `tests/dsh/integration/close-resume.test.ts`: `tests/dsh/integration/run-close.test.ts`, `tests/dsh/integration/run-resume.test.ts`, `tests/dsh/integration/run-resume/exact-route.test.ts`.
+- `tests/dsh/integration/enno-turn-stopping.test.ts`: `tests/dsh/integration/turn-stopping-gate.test.ts`, `tests/dsh/integration/enno-role-loop.test.ts`.
+- `tests/dsh/integration/provider.test.ts`: `tests/dsh/integration/skill-provider.test.ts`.
+
+## Explicit optional lanes
+
+These files are excluded before ordinary discovery and recorded as scope-excluded
+in the full plan. Selecting the named profile makes its fixture and assertions required.
+
+- `code-provider`: `tests/dsh/integration/lisp/code-intelligence-native.test.ts`. This optional V1 provider requires an explicit built provider fixture.
+- `p0`: `tests/dsh/integration/lisp/p0-seatbelt.test.ts`. This experimental macOS P0 candidate is an explicit probe, not production protection evidence.
+- `packages-live`: `tests/dsh/integration/lisp/packages-live.test.ts`. Live public package registries are an explicitly selected integration lane.
+
+## Removed no-op checks
+
+- `embedding`: The old --offline invocation read no model manifest; DSH ships no preset manifest. Explicit --model-dir checksum/inference remains available.
+
+The five browser consumers receive the same final tarball as CLI, npm and pnpm
+consumers. Their standalone npm commands remain available; formal verification
+executes the existing assertion scripts directly after its own clean build.
+
+The old CI YAML substring test is retired: the common runner probes required
+runtime capabilities and rejects missing prerequisites in the real execution path.
+The fixture-version, suite-discovery and alias/optional-lane contracts remain tested.
+
+`pre-step.test.ts` is also an import-only alias for `pre-step/gate.test.ts`.
+Native Lisp integration requires `protected-python3`: a real sandbox subprocess
+probe. An Apple launcher that only reports its version outside the sandbox does
+not satisfy this capability. Local/CI environment preparation must select a real
+installed Python interpreter; the repository never changes the global PATH.

package/migrations/037_native_worker_routing.sql

@@ -0,0 +1,8 @@
+CREATE TABLE dsh_native_worker_routes (
+  child_session_id TEXT PRIMARY KEY,
+  parent_session_id TEXT NOT NULL,
+  owner_json TEXT NOT NULL CHECK(json_valid(owner_json)),
+  state TEXT NOT NULL CHECK(state IN ('admitting', 'active', 'revoked')),
+  created_at TEXT NOT NULL
+);
+CREATE INDEX idx_dsh_native_worker_routes_parent ON dsh_native_worker_routes(parent_session_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -44,7 +44,8 @@
     "scripts/smoke-laya-coreml.mjs",
     "scripts/evaluate-answer-review.mjs",
     "scripts/answer-review-evaluation.mjs",
-    "scripts/answer-review-evaluation.d.mts"
+    "scripts/answer-review-evaluation.d.mts",
+    "scripts/verification-completion.mjs"
   ],
   "exports": {
     ".": {
@@ -245,7 +246,10 @@
     "test:models:web": "npm run build && node scripts/verify-models-web.mjs",
     "test:code-intelligence": "node scripts/run-code-intelligence.mjs",
     "test:code-intelligence:packed": "node scripts/run-code-intelligence.mjs --packed",
-    "test:code-intelligence:benchmark": "node scripts/benchmark-code-intelligence.mjs"
+    "test:code-intelligence:benchmark": "node scripts/benchmark-code-intelligence.mjs",
+    "verify": "node scripts/verify.mjs",
+    "verify:plan": "node scripts/verify.mjs --plan",
+    "test:verification": "node --test scripts/verification-contract.test.mjs"
   },
   "dependencies": {
     "@deepseek-ai/cosmokit": "1.8.5",

package/scripts/evaluate-answer-review.mjs

@@ -1,3 +1,4 @@
+import { completeVerification } from './verification-completion.mjs';
 import { parseArgs } from 'node:util'
 import { readFile, writeFile } from 'node:fs/promises'
 import { createHash } from 'node:crypto'
@@ -126,3 +127,5 @@ const json=JSON.stringify(report,null,2)+'\n'
 if(values.output)await writeFile(values.output,json)
 process.stdout.write(json)
 if(report.cases.some(row=>row.status!=='completed') || warmupCases.some(row => row.status !== 'completed'))process.exitCode=1
+
+completeVerification({});

package/scripts/verification-completion.mjs

@@ -0,0 +1,12 @@
+import { writeFileSync } from 'node:fs';
+export function completeVerification(evidence = {}) {
+  if (!process.env.KIOKUKO_VERIFY_COMPLETION_FILE || process.exitCode && process.exitCode !== 0) return;
+  const {KIOKUKO_VERIFY_CHECK_ID:id,KIOKUKO_VERIFY_NONCE:nonce}=process.env;
+  if (!id || !nonce) throw new Error('Missing verification completion identity');
+  writeFileSync(process.env.KIOKUKO_VERIFY_COMPLETION_FILE,JSON.stringify({schema:'verification-completion-v1',id,nonce,status:'passed',evidence}),{flag:'wx'});
+}
+export function validCompletion(value, id, nonce, required = {}) {
+  return !!(value?.schema === 'verification-completion-v1' && value.id === id && value.nonce === nonce && value.status === 'passed'
+    && value.evidence && typeof value.evidence === 'object' && !Array.isArray(value.evidence)
+    && Object.entries(required).every(([key,expected])=>value.evidence[key]===expected));
+}

package/scripts/verify-lisp-vendor.mjs

@@ -1,3 +1,4 @@
+import { completeVerification } from './verification-completion.mjs';
 import { readFile, readdir, writeFile } from 'node:fs/promises'
 import { createHash } from 'node:crypto'
 import { join, relative, resolve } from 'node:path'
@@ -28,3 +29,5 @@ else {
   if (changed.length) throw new Error(`Lisp vendor content differs from the reviewed manifest: ${JSON.stringify(changed)}`)
 }
 console.log(`Lisp vendor: ${Object.keys(files).length} files verified`)
+
+completeVerification({});

package/skills/coding-ideal-routine-skill/SKILL.md

@@ -63,3 +63,15 @@ DSH の実装タスクでは、初回の変更前に `coding_workflow status`
 - ユーザーには、変更内容、確認できた通常利用、実行した検証と結果、残る制約を簡潔に報告する。再現・実装・ローカル検証・公開／本番反映は別々の事実として扱う。許可のない公開やデプロイを完了条件に追加しない。
 
 この Skill は実行時の判断を支援する手順であり、ホストによる毎回の呼び出しや不具合の完全防止を保証する仕組みではない。
+
+## Repository verification entry
+
+When the target repository defines `npm run verify`, read `npm run verify:plan`
+(or `npm run verify -- --plan --profile <profile>`) and use that declared scope.
+Run the same profile locally and in CI; do not reconstruct independent checks
+from CI YAML. `npm test` and focused commands are partial evidence. The JSON
+result records each required check, prerequisite failure, platform exclusion,
+and source/artifact identity. Only a current full-scope `completionReady: true`
+result supports full verification. Recheck saved results with
+`npm run verify -- --status <result.json>` after related edits or artifact changes.
+Never derive skip permissions or expected failures from observed test output.

package/skills/one-shot-software-completion/SKILL.md

@@ -100,4 +100,17 @@ the recovery reference before changing strategy. Do not retry an unchanged
 failed operation or hide failures by weakening checks. Stop on completion or a
 specific blocker requiring unavailable access, evidence or user action.
 
+
+## Repository verification entry
+
+When the target repository defines `npm run verify`, read `npm run verify:plan`
+(or `npm run verify -- --plan --profile <profile>`) and use that declared scope.
+Run the same profile locally and in CI; do not reconstruct independent checks
+from CI YAML. `npm test` and focused commands are partial evidence. The JSON
+result records each required check, prerequisite failure, platform exclusion,
+and source/artifact identity. Only a current full-scope `completionReady: true`
+result supports full verification. Recheck saved results with
+`npm run verify -- --status <result.json>` after related edits or artifact changes.
+Never derive skip permissions or expected failures from observed test output.
+
 <!-- /kiokuko:runtime -->