# 0.5.0 / DSH 0.1.7-rc.2 candidate

> Historical candidate-freeze record. Later artifact, CI, macOS/Windows and human browser results are in the [final release acceptance](v0.5.0-release.md). Pending items below describe the earlier snapshot.

This is an unpublished source candidate based on `f70a5b802c7bdb9112ac1915a1e09786f3a788b1`. The initial worktree was clean. Only DSH `0.1.7-rc.2` and V4 input are supported. npm and Python product versions are both 0.5.0. The release review now prepares the committed candidate, CI and canonical artifact; publication is not complete until public readback. Daily runtime/Profile changes belong to the coordinated runtime task.

## Reproduce local checks

Use Node `22.19.0` or Node `24.8.0` for the configured CI matrix, and Python 3.11+. Local execution used Node 25.1.0, Python 3.12.2 and Cordis 4.0.4. CI configuration is not a CI result.

```sh
npm ci --ignore-scripts
npm ci --prefix tests/rc2-runtime --ignore-scripts
DSH_RUNTIME="$PWD/tests/rc2-runtime" PYTHONPATH=src python -m unittest discover -s tests -v
npm test
python scripts/build_native_rules.py --check
python scripts/build_fixture.py --check
node scripts/verify_session_contract.mjs --fixture --runtime tests/rc2-runtime --expected-dsh-version 0.1.7-rc.2 --required
node scripts/rc2-contract-tests.mjs tests/rc2-runtime
node scripts/rc2-services.mjs tests/rc2-runtime
python scripts/audit_public_tree.py --root .
git diff --check
```

`tests/rc2-runtime/package-lock.json` pins the isolated service/contract harness. It does not change a daily DSH installation. `build_rc2_fixture.mjs` regenerates the extended plaintext and compressed fixtures through the exact official codec/catalog. The verifier rejects absent runtimes, mixed DSH versions, absent fixtures and empty logs; it reports checked files, events and package code hashes. Never count an unavailable test as a pass.

## Acceptance matrix

The identifiers below correspond to the development plan. “Local” covers deterministic tests or synthetic service integration, never a real model or GUI. Native gaps are stated separately even where the local portion passes.

| ID | Actual evidence and boundary |
| --- | --- |
| A01 | Exact engine/peer assertions; all DSH direct peers are rc.2, Cordis is `~4.0.4`, Node is `^22.19.0 || >=24.0.0`. No older compatibility branch. |
| A02 | Official strict catalog restores nonempty simple and extended V4 fixtures, in plaintext and header-framed Zstandard; extended fixture includes physical source ranges. |
| A03 | Local rejection tests cover missing/old/future version, legacy producer/tool shape, conflicting tool identity, invalid sequences/references and unknown required events. Discovery never falls back from corrupt/future V4 selections. |
| A04 | Real rc.2 message helper creates immutable distinct notice identities. Real Session append → codec write → strict restore → reopened Session preserves the notice source. Actual Agent queue/model execution remains pending. |
| A05 | Explicit V4 `toolCallId`/source agreement and optional `isError` (default false) determine results; successful text cannot hide failure and error words cannot replace explicit success. Missing exit codes remain unknown. |
| A06 | Real Cordis command/tool registration, unload and reload pass. Official fixture and reopened Session cover developer addition/removal and header references. Automatic event emission after enabling in an already-running real Agent remains pending. |
| A07 | Official extended fixture replaces across user/assistant/tool/developer/system nodes; current evidence excludes shadowed messages, historical usage/execution counts remain. |
| A08 | Local sentinels cover system/developer/schedule/image/opaque/diff content exclusion; unknown required events fail. No attachment/spill fetch path is added. |
| A09 | Officially admitted nested-seed fixtures use the last tagged marker. Local tests exclude parent-prefix workload and reject a supplied cut that disagrees with that marker. Root forks remain root tasks; subagent headers retain parent family ownership. Catalog child counts and spawn attempts are separate. |
| A10 | Official PTC fixture plus local metrics cover parallel completion order, inner failure with outer success and unsettled starts. Outer/inner failures are separately exposed; every failed call result counts once. When both inner and outer calls fail, both outcomes are retained; no unique-cause deduction is made from ancestry or matching error text. |
| A11 | Final `AUTO_REVIEW_DENIED` is a permission block, not failed command verification. Explicit success after approval text remains successful. Raw outer call IDs and inner subCallIds correlate approval/results; repeated decisions do not duplicate permission counts. A denial without callId cannot be attached to a tool result. Reviewer failure without a dedicated code remains a general failure; no fabricated reviewer session duration. |
| A12 | Real query services cover detached live observation, cold interrupted-tail closure, cancellation and corruption taxonomy through a synthetic persistence seam. This is not production backend/native acceptance. |
| A13 | Local cancellation and lease tests cover clone failure, read cancellation and size rejection; every acquired observation releases once. Unload awaits owned queries and Worker termination. Real Cordis reload does not let an old disposer remove the new registration. |
| A14 | Local 0/2,000/2,001 selection and oversized snapshot checks pass. The 64 MiB check applies after host observation materialization and does not bound the host's initial single-file peak memory. |
| A15 | Nonempty prepare → batches → aggregate → finalize and explicit invalid-output fallback pass with constructed model outputs. Metrics mode bypasses semantic batches. Real model roundtrip remains pending. |
| A16 | Both manifests bind target DSH, V4 and analyzer semantics; old native manifests fail resume. Deterministic cache version is 3; Python semantic schema/cache is 1.1.0. |
| A17 | Existing traversal, symlink, hard-link, owner/mode, tampered-manifest, atomic replacement and cleanup checks retained. |
| A18 | Simple and official extended V4 corpora compared across 3 privacy modes × 2 languages in Node and Python. CLI crash tails remain partial; query's synthetic interrupted closers are a separate input. |
| A19 | Candidate tarball inspection and isolated package loading are recorded in the delivery evidence; source tests alone are not this gate. |
| A20 | Same tarball installed through the actual rc.2 plugin CLI in an isolated macOS profile; seven tools and real Agent deterministic command produce a nonempty report from synthetic seeds. Real-model, GUI and Windows-native acceptance remain pending. Local POSIX path tests and CI definitions do not establish those results. |
| A21 | **Pending:** bilingual nonempty HTML/JSON generation passes, but Browser Use refused the local file URL and explicitly prohibited alternate-browser workarounds. Chrome connectivity was checked without navigating the blocked file. No current render, interaction, screenshot or browser-console pass is claimed. |
| A22 | Tests use synthetic fixtures and isolated roots. Before/after source hashes and exact candidate identity are recorded with delivery evidence. No source rewriting, extra upload channel or credential access was introduced. |

## Remaining native steps

Use a fresh DSH_HOME and an exact rc.2 runtime, then install the same candidate tarball into a new profile. Do not reuse a daily profile or treat a source checkout as the package under test.

1. Start a session, complete a real model turn, then enable the Bundle. Verify seven tools and one command, automatic developer additions, disable/removal and re-enable without duplicate registration.
2. Run `/session-insights --deterministic --locale en`, then a nonempty semantic run. Confirm the notice is queued, executed, persisted and survives restart. Exercise one invalid batch repair followed by explicit fallback.
3. Cancel during listing, cold reading, Worker analysis and before semantic persistence; unload while work is pending and confirm no later artifact writes.
4. Repeat registration, deterministic analysis, cancellation, path and report checks on Windows. Record semantic/model coverage separately.
5. Bind every result to the candidate tarball SHA-256. If bytes change, repeat affected acceptance. Record real provider/model identity without recording credentials or private prompt content.

## Updating a separately installed CLI/Skill

The Bundle uses Node and does not install or update a Python Skill. From this reviewed source candidate, use `python scripts/bootstrap.py install --dsh-home <isolated-home>` to test the managed CLI/Skill update; it replaces only marked managed roots. Verify `tools/dsh-session-insights/venv/bin/python -m dsh_session_insights --version` (Windows: `Scripts/python.exe`) and the Skill marker. A later daily installation is a separate operator action. Older exported reports remain readable; start a new analysis run for V4.

## Review and candidate identity

The initial development tarball `c5905f3afb8fdef0feef4012743ce9370ae6cd67cb58e427c0d591ba47469000` is superseded and must not be installed as the release candidate. Its package/native/reader-review identities do not cover the repaired source.

Independent review found and closed three correctness families:

- F1: match the official V4 acceptance domain for omitted `isError`, extra source metadata and nested inherited markers, while preserving invalid-role/identity/reference rejection.
- F2: retain independent outer PTC failures. `tool_failures` measures failed call outcomes, with outer/inner details; it is not a count of unique causal incidents.
- F3: use raw PTC subCallIds for approval correlation. Rejected verification calls are permission blocks, not failed verification; missing identity and unstructured error text do not invent a link.

The repaired source passes 70 Node and 70 Python tests without skips. The exact official rc.2 catalog admits 19 fixture files with 289 events, including 16 family regression fixtures; the original five negative contract controls also pass. Node snapshot and Python snapshot/file paths share these regression expectations. The reviewer independently replayed the five original counterexamples in both analyzers and rechecked the official positive matrix. Analysis identity is `v4-rc2.2`, invalidating manifests/caches from the earlier candidate.

Canonical artifact, exact-commit CI and native results must be recorded separately after source freeze. The prior isolated macOS check proves only its original development bytes. This record does not claim a public release or completed real-model, Windows or GUI acceptance.

A12's synthetic backend checks do not cover every production backend conflict/not-found branch. A14 checks oversized input and selection boundaries, not a measured host peak-memory ceiling. A08 checks exclusion sentinels and no fetch behavior, not a live image/spill provider integration. These are evidence limits, not native passes.

For A21, open the delivered English and Chinese reports manually in an approved browser, inspect narrow/wide layouts, change filters, reset, export JSON/Markdown, and exercise copy/adoption controls; record console errors and screenshots against this tarball hash. Do not reuse historical screenshots. A04/A06/A15/A20's remaining real-model and platform steps are listed above.