# DSH Session Insights 0.6.0 (DSH 0.2.1-rc.2) candidate review

0.6.0 adapts Session Insights to DSH `0.2.1-rc.2` and moves the floor to `>=0.2.1-rc.2`; DSH `0.2.0-rc.2` and `0.2.1-rc.1` are refused. The host keeps session format 4 but adds required event vocabulary and new completion/delegation semantics, so a new analysis run is required after upgrading. Existing reports remain on disk. A separately installed Python CLI or Skill requires its own update.

This is a candidate record produced by the implementing session. It is not a publication, does not claim dual-platform native acceptance, and does not establish real-model or Desktop UI behavior. The follow-up native acceptance session owns the remaining gates.

## Implemented scope

- **SI021-01:** `job/registered`, `job/settled` and `working-directory/change` are admitted by the Node and Python validators and by the production parse entrypoints. Unknown required events are still refused; unknown ignorable events, including `plugin:` records, are safely skipped. Fixtures are written by the exact 0.2.1-rc.2 `Session` writer and restored by the official strict catalog; the recorded pre-fix failure was `unknown required V4 event`.
- **SI021-02:** background jobs are counted by registry lifecycle (registered/settled/completed/failed/killed/pending, inherited and inherited-pending, by-kind/by-cause, teardown, unreported producer outcome, unpaired settlements, turn-ends while an owned job was still running). Registry settlement is never reported as user-task completion or resource release. Delegation evidence is counted separately: `subagent`/`subagent_fork`/`workflow`/`spawn_teammate` dispatch results, runtime `subagent-settled` notices, `tool-jobs` completion notices, inbound/outbound relays, workflow run/agent records, and Team roster/task snapshots. Delivery, inbox acceptance and parent turn end are not completion.
- **SI021-03:** working-directory changes form a labelled trajectory; the immutable header cwd remains the origin project used for filtering and resume. Own vs inherited segments, cross-project activity, platform path forms, and duplicate/relative/invalid change anomalies are reported; raw paths stay out of redacted/metrics reports.
- **SI021-04:** typed `plugin:` records are retained as opaque type/count coverage only; mixed physical V4 range encoding, fork/seed inherited prefixes (including inherited open jobs), interrupted-tail recovery fixtures and unknown-required refusal are covered.
- **SI021-05:** `web_search` and `web_fetch` are recognised as recorded calls (one multi-query search is one call); legacy `web.*` search aliases and PTC outer/inner separation are preserved. `model/selection`, reasoning effort, scheduled vs performed `llm/retry` attempts with chain ids, and per-session token provenance (`input_tokens`/`total_tokens` derived sums, raw buckets recorded) are reported.
- **SI021-06:** npm/Python/Bundle/Skill identity is 0.6.0; engines, nested Bundle compatibility and DSH peers are `>=0.2.1-rc.2`; Cordis runtime identity is 4.0.5; the fixture runtime is pinned to exact 0.2.1-rc.2; real `dsh-app-boot` admission and version-vector tests pass.
- **SI021-07:** session-query lease/cancel/error handling, Worker concurrency/cancel/unload, and `--no-open` report-path behavior keep their existing isolation coverage, re-run against the 0.2.1-rc.2 fixture runtime.

## Historical source and contract evidence (`171f7cc`, macOS)

The matrix below records the first repair round, bound to `171f7cc0120a285c3710743a900093b90bb74985`. It ran on that repair working tree before its clean commit and package freeze. These counts are historical source evidence, not the current complete test totals or current CI/native qualification; exact-artifact receipts record those separately.

| Check | Result |
| --- | --- |
| `npm test` | pass (129 tests) |
| `PYTHONPATH=src DSH_RUNTIME=tests/dsh-runtime python3.12 -m unittest discover -s tests` | pass (114 tests) |
| `node scripts/dsh-contract-tests.mjs tests/dsh-runtime` | pass (62 official known events, 6 negative cases) |
| `node scripts/dsh-services.mjs tests/dsh-runtime` | pass (real Session/query/codec; lease, clone, cancel, corruption, reload) |
| `node scripts/verify_session_contract.mjs --fixture --runtime tests/dsh-runtime --expected-dsh-version 0.2.1-rc.2 --required` | pass (48 fixtures, 838 events) |
| `node scripts/dsh-repair-fixtures.mjs tests/dsh-runtime --check` | pass (no fixture drift) |
| `PYTHONPATH=src python3.12 scripts/build_native_rules.py --check` | pass |
| `python3.12 scripts/build_fixture.py --check` | pass |
| `PYTHONPATH=src python3.12 scripts/audit_public_tree.py --root .` | pass |
| `node scripts/verify_dsh_admission.mjs <host-0.2.1-rc.2>` | pass (real `dsh-app-boot`; floor admitted, 0.2.0-rc.2/0.2.1-rc.1 refused, invalid throws) |
| Node/Python parity (`test_native_parity.py`, `test_rc21_review.py`) | pass across 10 host fixtures × local/redacted/metrics × en/zh-CN, plus 13 review cwd vectors, paired/orphan × own/inherited settlement fields, privacy/render vectors and fork usage |

## Independent review and verification

A separate read-only verifier re-ran the deterministic matrix, fixture-provenance probes and adversarial cases against candidate commit `51e193f` (parent `b3b6fde`) and reported no blocking defect; it independently confirmed that committed `snapshot.json` files equal strict restoration of the committed `.jsonl` and `.zstd` bytes, that job kinds are host-real producers, and that redacted/metrics reports leak no plugin payload, tool content, job detail or raw cwd. Its two coverage notes (inherited-open jobs and positive cases for workflow/retry/completion-notice/subagent-descriptor paths) are now covered by committed fixtures.

A separate cold reader review of the same commit found one P1 and three P2 documentation issues (an overstated Chinese "independent review", acceptance text implying per-platform results that are still pending, a release-dated unpublished changelog entry, and a superseded same-name record) plus P3 wording/schema nits. All were corrected before the final candidate commit; that earlier candidate `47ba49b` differed from `51e193f` only in documentation, fixtures/tests for the coverage notes, and the report schema. Native/model/UI/exact-artifact gates remain pending.

A subsequent production-entrypoint review rejected `47ba49b` and its tarball after two counterexamples: inherited cwd `alpha → beta → alpha` reported `beta` at the cut, and malformed orphan settlements bypassed terminal-field validation. The repaired reader derives cut state from the last chronological inherited segment and validates every settlement before looking for its registration. Valid orphan settlements remain readable and counted. Shared table-driven vectors cover return visits, later own changes, roots/trailing separators, drive/UNC/case forms and all terminal fields in paired/orphan and own/inherited contexts. They also exposed and repaired Python's loss of inherited cwd/orphan anomaly counters and its UNC-share-root trajectory label divergence. Existing project-filter normalization is unchanged.

The same review found a privacy defect in raw job-kind aggregate keys and a missing `subagent_fork` contribution to the existing subagent usage counter. Host `JobRegisteredData.kind` is an open string, not an enum. The repair shapes job items and aggregate keys consistently, merges counts when redaction collapses labels, and preserves standard producer categories. Metrics pseudonymizes extension categories; redacted output sanitizes secret text and pseudonymizes path-like categories. Team phase/status, descriptor fields, reasoning effort, provider/model projections and opaque plugin types follow the same output boundary; unexpected nested descriptor values are omitted. Synthetic path/secret vectors exercise actual report and HTML/Markdown rendering in both locales, and the fork call now contributes to both usage and delegation counts. Raw private analysis state is separate from the public report.

In that `171f7cc` repair round, the Node/Python analyzer identity was `0.6.0-v4-dsh021rc2.3` (`analyzer_semantics: v4-dsh021rc2.3`) and Python deterministic cache version was 7. Old resume/cache results cannot stand in for the repaired analysis. The rejected tarball and all earlier native evidence remain historical; the new tarball requires fresh exact-artifact and native qualification.

Actual Windows CI subsequently exposed a shared UNC header/trajectory display problem: filesystem basename interpretation could fall back to the raw share anchor. Header/project display and trajectory labels now share a safe lexical basename projection; raw header cwd filtering is unchanged. The current analyzer identity is `0.6.0-v4-dsh021rc2.4` (`analyzer_semantics: v4-dsh021rc2.4`), with Python deterministic cache version 8. Coverage was extended to 23 vectors × 4 contexts × 3 privacy modes × 2 locales, including header and trajectory fields and full-report Node/Python parity. Commit `15db6ada83accc9e6b7000bc621d0345249adb77` corrected test/fixture I/O that had relied on the default encoding, with explicit UTF-8 and non-UTF-8 import regression coverage. Current CI and native subjects/results are supplied by independently attached exact-artifact receipts; this historical record does not establish their completion.

A pre-existing, non-blocking internal divergence is documented for the next owner: with Python `semantic_capture=False` (deterministic-only structure path), `semantic_shadowed_messages` stays 0 while the Node analyzer counts shadowed semantic nodes. It reproduces on the 0.5.2 baseline and does not affect native user-facing parity, which uses capture enabled; it is not introduced by this candidate.

## Compatibility, privacy and migration notes

- Input remains V4. Logs written by 0.2.0-rc.2 remain readable because their vocabulary is a subset; the host version itself is admitted by range, not by a static table. Logs containing events this reader does not know and that are not marked `ignorable` are refused rather than silently truncated.
- A job is a registry/producer record. `completed` does not prove user-task completion, delivered output, or resource release; `producerReported` does not certify cleanup. A registered job without a settlement is pending, including after its parent turn ends. A structurally valid settlement whose registration append was lost is counted as an integrity anomaly instead of making the whole session unreadable; malformed terminal fields are refused with or without a registration.
- Team phase/task snapshots and inbox relays are recorded state, not Lead task completion. `active` is a lifecycle phase, not progress.
- Working-directory labels are exposed; raw paths are not added to redacted/metrics reports. Filtering and resume continue to use the immutable header cwd, so an existing project filter does not silently change meaning after a `cd`.
- `plugin:` record payloads are never interpreted as intent, model context or completion evidence. Their type/count coverage is retained; migration may lose them without changing how the rest of the log is read.
- Token buckets are recorded per step; `total_tokens` is a derived consistent sum and is labelled accordingly. Reasoning is an output subset and is never added twice. No currency pricing is inferred.

## Pending gates (owned by the follow-up native acceptance session)

- macOS and Windows Web/Headless/Desktop native install, strict second-install no-op, reinstall, loaded-byte identity, tool/command mounting, populated report and cleanup.
- Real-model semantic workflow and real provider/usage attribution on live sessions; Web/Desktop report display and interaction.
- Exact-artifact acceptance of the single retained `.tgz` on both platforms; artifact escrow and receiver acknowledgment.
- Publication (npm/tag/GitHub Release), consumer migration, host-tooling pin updates and daily enablement are outside this candidate's scope.

`scripts/pack_agensi.py` and `marketplace/agensi/*` remain pinned to the published 0.5.2 listing by design; they are not relabelled for this unpublished candidate.

## 中文

0.6.0 适配 DSH `0.2.1-rc.2`，下限提升为 `>=0.2.1-rc.2`，拒绝 0.2.0-rc.2 与 0.2.1-rc.1。宿主保持会话格式 4，但新增必需事件与新完成/委派语义，升级后须新建分析运行；已有报告保留。独立安装的 Python CLI 或 Skill 需要单独更新。

本页是实现会话产出的候选记录，不是发布，也不声称双平台原生、真实模型或 Desktop UI 已验收；剩余 gate 由后续原生验收会话负责。

以下为 `171f7cc0120a285c3710743a900093b90bb74985` 第一轮修复的实现与源码检查历史：三个新必需事件在 Node/Python 校验器与生产入口准入（未知必需仍拒绝、未知 ignorable 安全跳过，fixture 由精确 0.2.1-rc.2 写入器生成）；job 生命周期与委派/Team/子代理语义分离计数，不把投递、Inbox 接收或父轮结束当完成；cwd 轨迹与 header 来源归属、隐私化输出；plugin 记录仅保留类型/数量；Search/Fetch、model/selection、retry 与 token 来源；版本/engines/Cordis/fixture/CI 身份一致。该轮源码与本机隔离检查（Node 129、Python 114、契约 62 事件/48 fixture 838 事件、服务、准入、规则/fixture/审计、Node/Python 一致性）通过。

后续生产入口复核先以两个反例拒绝了 `47ba49b` 及旧 tgz：继承 cwd 往返后 cut 状态错误，以及未配对 settlement 绕过终态字段校验。修复后按最后一个继承事件确定 cut，先校验 settlement 再查配对；合法 orphan 仍可读并计异常。表驱动覆盖 13 组 cwd 轨迹及路径向量、全部终态字段的配对/未配对与 own/inherited 组合，并修复 Python 继承异常计数丢失和 UNC share 根目录轨迹标签差异。既有项目过滤归一化不变。该轮 Node/Python 分析身份为 `0.6.0-v4-dsh021rc2.3`，Python 确定性缓存版本为 7；旧恢复结果、旧包及其原生证据不能替代新候选验收。

同轮还修复了 job kind 聚合键泄漏路径和 `subagent_fork` 用量漏计。宿主 kind 是开放字符串，修复保留正常 producer 类别，不拒绝扩展 kind；明细与聚合统一映射，脱敏碰撞时合并计数。metrics 对扩展类别生成稳定匿名键，redacted 清理凭据并匿名化路径类别；Team phase/status、descriptor、reasoning effort、provider/model 与 plugin type 采用同一输出边界，异常嵌套 descriptor 不进入报告。合成路径/凭据向量覆盖中英 JSON 与实际 HTML/Markdown 生成；fork 同时计入子代理用量和委派统计。私有分析状态与公开报告分开。

其后，实际 Windows CI 暴露了 UNC header/轨迹显示的共同问题：文件系统 basename 解释可能回退为原始 share anchor。header/project 显示与轨迹标签现已共用安全的词法 basename 投影，raw header cwd 的筛选口径不变。当前分析身份为 `0.6.0-v4-dsh021rc2.4`（`analyzer_semantics: v4-dsh021rc2.4`），Python 确定性缓存版本为 8；覆盖补齐为 23 向量 × 4 上下文 × 3 隐私模式 × 2 语言，包含 header、轨迹字段与整份报告的 Node/Python 对照。`15db6ada83accc9e6b7000bc621d0345249adb77` 修正了测试/fixture I/O 依赖默认编码的遗漏，显式采用 UTF-8，并增加非 UTF-8 默认编码下的导入回归。当前 CI 与原生验收的精确主体及结果由独立附带的制品回执给出，本历史记录不据此声称这些检查已完成。

待后续会话：macOS/Windows 的 Web/Headless/Desktop 原生安装与生命周期、真实模型/用量归属、Web/Desktop 报表交互、唯一 tgz 的精确制品双平台验收。发布、消费者迁移、宿主工具链 pin 更新与日常启用不在本候选范围。`pack_agensi.py` 与 `marketplace/agensi/*` 仍按已发布的 0.5.2 保留。