# 0.7.0 candidate acceptance record

Status as of 2026-11-03: **candidate preparation, not a release**. The scoped native Desktop GUI gate has passed on macOS and Windows. The maintainer has made a limited G1 risk decision; the updated packaged risk notice requires a replacement artifact and affected installation identity checks, and exact-commit CI remains pending.

## Identity

| Field | Value |
| --- | --- |
| Product version | 0.7.0 (npm, pyproject, Python `__version__`, `PRODUCT_VERSION` in `scripts/acceptance_identity.mjs`) |
| Baseline source | `main` at `2c66695517bef29e53ded9f72d686711cbab61a6` (2026-11-02 snapshot) |
| Last published release | `v0.6.1` → `d27d64a2e740b7b5d51217191c30f4dcd0e946e5` (2026-10-26) |
| Previous frozen artifact | `870389354d7ed55f68c79a59574edba93e69e091`; tarball `dsh-session-insights-0.7.0.tgz`, 226,799 bytes, 29 files, SHA-256 `c1be1ba6ee861646b9e83b518573ed0ca313608c6f541b2bd0af8df70569d63d`. Its receipts and those of the pre-repair artifact (`1fb0b0da…` / `a9c88ee3…`, 226,673 bytes) retain their original identities. G1 risk notice updated; replacement artifact and affected identity checks pending. |
| Reviewed tooling source | `1c85f3cf1b8dabd6644bef5ed4174170aeddd7b2`; earlier audit and acceptance-tool changes did not alter the frozen package inputs. The previous tarball retains its own `8703893…` source identity; the subsequent G1 notice changes packaged `SECURITY.md`. |
| Primary acceptance host | DSH `0.2.1-rc.5` (upstream commit `b830ec950faba0a46dda564be3e2d854afed94f1`) |
| Compatibility host | DSH `0.2.1-rc.2` (declared floor `>=0.2.1-rc.2`; rc.3/rc.4 are not maintained hosts) |
| Analyzer identity | `0.7.0-v4-dsh021rc2.5`; input identity and semantic schema (`1.2.0`) unchanged from 0.6.1 |

## Change coverage since v0.6.1

Every commit from `v0.6.1` through the reviewed tooling source `1c85f3c` is classified below; the 0.7.0 changelog carries the reader-visible subset. Later documentation updates record acceptance and the G1 decision; the updated `SECURITY.md` changes packaged documentation, not runtime behavior.

| Commit(s) | Change group | Public entry | Rationale |
| --- | --- | --- | --- |
| `b1a544d`, `cc3cda3` | Post-release records for 0.6.1: verified publication receipt and the native Bundle/Desktop GUI follow-up | No changelog entry | Documentation-only; they preserve the historical 0.6.1 identity and are not 0.7.0 capabilities |
| `35376eb`, `acdfd69`, `f77f1a9` (PR #2 merge) | Russian locale and keyed message catalogs | Added entry | First publication of `ru`; localized semantic guards; scope/manifest validation accepts `ru` |
| `63e0df8` | Acceptance cleanup truthfulness and diagnostics reliability; per-cell target runtime validation; duplicate suite reduction | Changed entries | Reader-visible only in tooling/CI behavior; summarized, not copied from the commit title |
| `2c66695` | CRLF-portable fault probes; PR-vs-main CI trigger dedupe; candidate packed from the actual PR head | Changed entries (merged with the tooling group) | Same reader-facing group |
| `f1c5696`, `8fd96ce` | rc.5 primary host, runtime and host trees, CI identity, analyzer version, Russian candidate verification and package version binding | Added/Changed entries | Updates the host and validation contract |
| `1fb0b0d`, `f09badb`, `51ca496` | Reader-review corrections and candidate/native records, including the earlier and repaired artifact identities | No separate changelog entry | Records evidence and corrects documentation; earlier receipts retain their identities |
| `8703893` | Audit input binding and graph validation, and packaged Skill identity/migration correction; private acceptance-tool finalizers were repaired in the same batch | Security and Changed entries | The audit and tool behavior are summarized; the Skill follows the documented migration contract |
| `3dad341`, `a2e82a4` | Audit capture and verification hardening, including scanning a private snapshot of the bound manifest and lock; private approval and live-tool lifecycle repairs accompanied the first commit | Security and Changed entries | Supports the documented fail-closed audit and receipt behavior; does not accept the dependency risk |
| `1c85f3c` | Host-verifier option normalization, portable audit fault controls and task cache ignore | Changed entries | Acceptance-tool and test corrections; no package input changes |

## Upstream rc.3 → rc.5 impact classification

| Upstream change | Evidence | Impact |
| --- | --- | --- |
| rc.4: ACP diagnostics no longer leak into stdout | rc.4 release notes; published-package comparison below | **No plugin change** — host transport layer; plugin consumes `commands`/`tools`/`sessionQuery`, not ACP transport |
| rc.5: thinking-content display improvements | rc.5 release notes | **No plugin change** — host UI layer |
| Reasoning body `text` → display text / `rawText` migration | Upstream migration guide: "if your plugin doesn't use this slot — nothing"; plugin uses no `conversation.chat.reasoning.body` slot | **No plugin change**; display text is never treated as session evidence by this plugin |
| Session/V4 catalog, `session-query`, `commands`, `tools`, `dsh-llm`, approval, cancel/dispose surfaces | Local comparison of the two installed runtime closures (34 `@deepseek-ai/*` packages, rc.3 vs rc.5): all package code byte-identical, differences limited to `package.json` version metadata | **No plugin change**; contract suites re-run against rc.5 |
| `0.2.2-alpha.2` (API/Node-threshold changes on the default line) | Out of scope for this release | **Not adapted**; range admission does not claim testing |

The GitHub API compare for `rc.3...rc.5` returned exactly 300 changed files, which may be truncated, so upstream-wide review is **not** claimed. The review basis is the actual published packages this plugin depends on.

## Dependency risk (limited decision recorded)

- rc.5 did not fix the upstream pin: six official packages still pin `zod@4.4.3` (GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404, patched 4.6.6). The rc.5 contract-runtime closure and this project's rc.5-refreshed peer lock both resolve `zod@4.4.3`; the full rc.5 host tree resolves its top-level `zod` to 4.6.7 but keeps exact-pinned nested 4.4.3 copies.
- The 0.6.1 exception expired by its own terms (product version and dependency-cohort change) and is not carried forward. On 2026-11-03 the maintainer made a new, limited decision accepting the known upstream risk for 0.7.0 and the exact reviewed rc.2/rc.5 dependency and host-queue cohort, including the two reviewed graph variants. It does not assert that the finding is fixed, unreachable or clean. The corresponding policy is implemented at `config/dependency-audit-exceptions.json`; local source checks of the policy and fresh audit are recorded below, while exact-commit CI remains pending.
- `scripts/audit_node_deps.mjs` now has three honest outcomes: `clean` (zero exit + valid non-empty inventory), `accepted_known_risk` (exact cohort-bound policy naming this one advisory), everything else fails (`failed` / `unauthorized_findings`). Network failures, invalid JSON, missing steps, cancellation and new high/critical findings cannot pass; regression tests cover each state.
- Observed on the refreshed root lock (peers at rc.5, 2026-11-02 scans): production and full scans report the single direct Zod advisory with 23–24 affected package entries depending on the resolving npm version (one resolution adds `@deepseek-ai/dsh-typert-protocol`, whose `zod@^4.4.3` declaration locks the still-vulnerable 4.4.3) — one advisory propagated through dependencies, not 23 or 24 independent vulnerabilities. The audit graph validator now accepts satisfied range locks while keeping the exact advisory, package, path and set-digest constraints. At that time the findings were `unauthorized_findings` and failed the dependency-security gate. In fresh 2026-11-03 local scans, npm itself exited 1 for both production and full scopes, each reporting 23 entries under the one advisory; policy-aware assessment classified both as `accepted_known_risk`. An independently checked 24-entry real report fixture was also accepted. Missing policy, a third graph, lock drift, a different advisory, critical severity, empty inventory and cancellation were rejected. These local checks do not establish exact-commit CI. The decision is event-bound with no calendar expiry or automatic monitoring: version, bound dependency/host identity or queue changes, a changed advisory or an unreviewed graph, and a clean patched closure require reassessment; new findings and errors remain fail-closed.
- The 2026-11-02 Python audit (`pip-audit` over the declared set) reported no known vulnerabilities.

## Verification performed (source level, 2026-11-02 macOS)

| Check | Result |
| --- | --- |
| `npm test` with `DSH_RUNTIME=tests/dsh-runtime-rc5` | 234/234 pass |
| `python -m unittest discover -s tests` on rc.5 runtime | 190/190 pass |
| Same suites on rc.2 runtime (`tests/dsh-runtime`) | JS contract/services pass; Python 190/190 pass |
| `verify_session_contract --fixture` (rc.5, `--required`) | pass; fixture bytes restored by the official rc.5 strict catalog |
| `dsh-repair-fixtures tests/dsh-runtime-rc5 --check` | no drift |
| `dsh-contract-tests` / `dsh-services` on rc.5 and rc.2 runtimes | pass; plugin resolves `@deepseek-ai/dsh-llm 0.2.1-rc.5` from the target tree |
| `verify_dsh_admission tests/dsh-host-rc5 0.2.1-rc.5` | pass via the official `dsh-app-boot` consumer |
| `build_native_rules --check`, `build_fixture --check`, `audit_public_tree` | pass |

## Previous frozen artifact (C1; replacement pending)

| Field | Value |
| --- | --- |
| Filename | `dsh-session-insights-0.7.0.tgz` |
| SHA-256 | `c1be1ba6ee861646b9e83b518573ed0ca313608c6f541b2bd0af8df70569d63d` |
| Size / files | 226,799 bytes / 29 files |
| Packed from | clean exact commit `870389354d7ed55f68c79a59574edba93e69e091` (gitHead embedded and read back) |

### Pre-repair artifact (historical, superseded — do not consume)

| Field | Value |
| --- | --- |
| SHA-256 | `a9c88ee30f02a70b33a9a4c72880d763fc2eca2118575ba6a8ce15b8bec10196` |
| Size / files | 226,673 bytes / 29 files |
| Packed from | `1fb0b0dafaff192b9bad4f2c40dc375051275451` |

Kept on file with its original receipts under this identity; superseded by the repair round. The Windows batch binds the previous `c1be1ba6…` bytes above. The updated G1 risk notice is packaged, so a replacement artifact must be frozen and its affected manifest and installation identity checks completed. Existing receipts retain their original artifact bindings. Runtime, plugin, model and GUI inputs are unchanged by this notice; reuse remains limited to evidence whose relevant input bytes are confirmed unchanged in the replacement.

## macOS native acceptance (2026-11-02, host rc.5)

This initial pass used the pre-repair artifact `a9c88ee3…`; its receipts and raw logs retain that identity. After the review-driven repair changed packaged bytes (`SKILL.md`, `SECURITY.md` and the package.json `gitHead`), install-byte-bound gates were re-executed against the new frozen artifact and recorded under "Repair round re-verification" below; which earlier evidence is reused, and why, is stated there.

| Gate | Result |
| --- | --- |
| `verify_candidate` on the installed package | pass — en/zh-CN/**ru** each produce a complete semantic report from the installed bytes (synthetic semantic outputs, no model) |
| Portable zero-model host gate (`verify_host_acceptance`, rc.5 runtime+host) | pass — 21/21 gates in `native-acceptance/v2` annex (install/reload bytes, load-and-register of 7 tools + command, project isolation, deterministic report, cancel→recover→rerun, dispose) |
| Real Web profile | pass — 19 gates (official CLI install, real persistence, cold read, agent command, project isolation, bilingual report, cancel quiescence, cleanup preview + typed human command, uninstall, dispose) |
| Real Headless profile | pass — 19 gates, same set |
| Desktop backend via the application's own Electron graph | pass — 20 gates; disposable Desktop baseline via exported `initProfile`, install/no-op/reinstall, official carrier CLI; the known benign host-side telemetry ValidationError (non-target entries) is recorded in the raw log, as in the previous host generation |
| Real `ApprovalService` cleanup controls (`approval-native`) | pass — `allowed-once` deletes exactly the target run; `rejected`/`cancelled`/`unavailable` preserve it with explicit errors; sibling run retained in all four cases; request context bound to caller agent/callId/combined signal |
| Real-model Russian chain (budgeted live driver) | pass — prepare → real model batch → aggregate (one validator-driven repair) → finalize `complete`; Cyrillic output asserted in the localized contract and the stored model text; en negative control (invalid output → one repair → explicit fallback) and a bounded zh-CN batch control both pass with real model requests; budget 7/10 used, zero new logins, credentials referenced in place only |
| Report UI loopback preview (`dsi-browser-ui/v1`) | pass — ru/en/zh filters change counts and reset restores (ru: 3→0→3; en 3→0; zh 3→0), full three-locale rendering incl. analyzer label; ru long realistic text has no horizontal overflow at 1280/390; screenshots and receipt retained |

### Retained limits (macOS, this pass)

- On-screen real-GUI slash dispatch inside the daily Desktop application was **not** performed in this pass; the desktop gate above covers the application-owned backend graph in a disposable profile. The GUI follow-up stays a separate record, as in the previous release cycle.
- The ru long-unbroken-synthetic-word case overflows horizontally (documented `advisory` in the UI receipt) — same advisory class as the inherited ~538px note; realistic Russian text does not overflow.
- At that pass, Windows items and the inherited cross-user ACL / full-profile missing-approval / whole-host resource limits remained separate. Later Windows results and the retained limitations are recorded below.

## Pending gates

- Freeze the replacement artifact with the updated G1 risk notice and verify its affected manifest and installation identities. A committed-source temporary preflight is not the final canonical freeze.
- Exact-commit CI for the final source, including tests, the dependency-security job and the DSH contract matrix.

## Repair round (2026-11-02 review)

Independent review findings RV-01…RV-06 were repaired in one batch; counterexamples and the re-verification matrix are retained locally. Packaging-relevant change: `src/dsh_session_insights/skill/SKILL.md` now carries the 0.7.0 identity and the resume-consistent migration text, so the then-new canonical artifact `c1be1ba6…` superseded `a9c88ee3…` (the old artifact and its receipts remain on file unchanged, bound to the old identity).

## Repair round re-verification (new artifact `c1be1ba6…`, 2026-11-02)

The repaired artifact differs from `a9c88ee3…` only in `SKILL.md` (0.7.0 identity and resume-consistent migration text), `SECURITY.md` (scan-count wording) and the package.json `gitHead`; plugin runtime bytes are identical.

| Gate (install-byte-bound) | Result on the new artifact |
| --- | --- |
| `verify_candidate` | pass — en/zh-CN/ru complete from installed bytes |
| Portable zero-model host gate | pass — 21/21, `native-acceptance/v2` annex valid |
| Web / Headless profiles | pass — 19 gates each |
| Desktop backend (repaired toolkit end-to-end on the real host) | pass — 20 gates, receipt via the owning finalizer |
| `approval-native` | pass — four outcomes, cleanup `{passed, []}` |
| live-semantic preflight (zero model) | pass — `model_requests: 0`, cleanup passed |

Evidence reuse decision: the real-model Russian chain and the three-locale report-UI receipt recorded for `a9c88ee3…` remain valid for this candidate because the inputs that produced them — plugin runtime, message catalogs and dashboard bytes — are byte-identical in both artifacts; the receipts keep their original artifact binding and are not relabelled. Gates that consume installed bytes were re-run above. At this point in the historical record, both GUI gates and the Windows batch were pending; their later results follow.

## Current source and native results (2026-11-03)

The audit now scans a private snapshot of the bound manifest and lock, checks the snapshot bytes after scanning, and rejects missing or failed captures and source inputs that differ at summary. Independent real-npm counterexamples no longer produced false passing results, and the failure controls passed. The 2026-11-02 production and full scans reported the known unauthorized finding; correcting the audit did not itself accept the risk. The later 2026-11-03 decision and local policy-aware scan results are scoped as described above.

At the earlier tooling stage, macOS and Windows source checks each passed 70/70 audit tests and 250/250 JavaScript tests. The Windows checks ran on `a2e82a4` with the prepared verifier and test corrections; their tested bytes match those committed in `1c85f3c`. For the subsequent G1 source changes, local macOS checks passed 85/85 audit tests and 265/265 JavaScript tests on the rc.5 runtime. Windows has not been claimed to have tested the new G1 source, and these checks do not establish exact-commit CI. Those tooling changes did not alter the packaged runtime; the previous frozen tarball retains its `8703893…` identity. The later packaged G1 notice requires the replacement and identity checks described above.

| Scoped gate | Result |
| --- | --- |
| Windows native backend | The revised portable gate passed all 17 required checks (21 total); Web and Headless each passed 18 required checks (19 total), Desktop backend passed 19 required checks (20 total), and the four approval outcomes passed. The first portable attempt failed and remains a separate historical result. |
| Windows Python | One approved UAC run passed file and directory symlink preflight, 4 focused tests and the 191-test suite with no skips. Two earlier standard-user suites failed; their symlink and access errors remain recorded. This result does not establish standard-user suite success or cross-user ACL coverage. |
| Windows real model | A normal-user run used 6/6 requests and no new login. The Russian semantic chain reached `complete`; one glance text contained four Han characters, so the output is not characterized as wholly Russian. The English negative control reached `fallback`; a later correction distinguishes that report status from the passing control verdict. |
| macOS Desktop GUI | In an isolated official app, autocomplete was observed and one deterministic Russian command was submitted. The official reader matched `command/run` to a successful `command/done`; a nonempty Russian report was created, the app quit normally and the daily window was restored. The result toast was not observed. The GUI receipt SHA-256 is `1bfebe515472a6d4dd2546e6a528dcf2a54e3a1b32fe9fece15fd8f7d1de965d`. |
| Windows Desktop GUI | In an isolated official rc.5 app, autocomplete was observed and one deterministic Russian command was submitted. The official strict reader matched `command/run` to a successful `command/done`; the new GUI session had no model or stream events. The report contained the target fixture and two project-empty sessions, excluded the unrelated fixture, and recorded one `outcome_unknown` and one `not_started`. The app exited through its menu, the QA processes stopped, the isolated patch was restored and all seven baseline daily processes remained present. The de-identified GUI receipt is 2,255 bytes with SHA-256 `f36b768513ffcf6bba46cd26b3ec4a85196472ce4f214d12023f4b0e71f26521`; original GUI, session and report evidence remains on Windows. |

The Windows GUI HTML and JSON were checked as nonempty, with Russian locale and Cyrillic content in the HTML; this does not claim a Windows browser rendering or three-language visual check. No independent network capture was performed in that GUI scene. Earlier Windows GUI attempts did not dispatch the command: startup first failed, a later signed-out welcome had no observed skip, and a subsequent folder-selection modal blocked the test and required stopping five identified QA processes. Those outcomes remain historical evidence; the later successful GUI receipt does not rewrite them.

The inherited limits remain open: Windows cross-user ACL coverage, the full-profile missing-approval-service branch, whole-host resource measurement, the approximately 538px layout advisory and overflow for an extreme unbroken Russian word. The three-language HTTP report UI and macOS real-model results retain their original `a9c88ee3…` binding under the byte-identical runtime reuse decision above. The replacement artifact and affected installation identity checks and exact-commit CI remain required before publication; no tag, package publication, GitHub Release or daily deployment has been performed for this candidate.