# v0.2.0 Bundle release acceptance record

Status: released as `v0.2.0` from commit `7e9f1e3e50cdf464de59edf3a81cebc7f06c2ed8` on 2026-08-22. Its runtime remains unchanged from acceptance basis `11d6fe43a87398a2403f6533b4c06d2d89ad95a3`, which passed focused Windows revalidation; the later release commit contains registry-facing README and release-document changes. The exact npm artifact, remote tag, GitHub Release assets, and release-commit CI were independently read back as recorded below.

## Scope

- Native DSH Bundle with `/session-insights` and six model-facing workflow tools.
- Trusted `sessionQuery` ingestion over a versioned JSONL stdin bridge.
- Existing deterministic analyzer, semantic validation/fallback pipeline, file-log CLI, and Skill compatibility.
- `zh-CN` and `en` report locale plus language-specific semantic prompt contracts.

## Current evidence

| Gate | Evidence status |
|---|---|
| Node plugin surface | Pass locally: 11 registration/parser/envelope/command-path/resume/cancellation/fallback tests, including explicit Windows project-path rejection |
| Python regression | Pass locally: 36 tests on Python 3.12, including aggregate-contract enum parity and English semantic-finalization coverage |
| Source-adapter parity | Pass with synthetic data: file-log and `sessionQuery` snapshots match core totals |
| Privacy transport | Pass by construction and tests: raw snapshots cross stdin; no raw transcript copy is written by the bridge |
| Bilingual contract | Pass across separate scopes: macOS browser readback rendered a complete English report with zero CJK outside scripts, while focused Windows real-model runs completed both `en` and `zh-CN` semantic workflows with locale-correct facets and `fallback_reason=null` |
| npm package audit | Pass on the final local release candidate: 17 intended files, no bytecode, no install/build lifecycle scripts, and two independent packs were byte-identical |
| macOS native DSH | Pass: isolated DSH `0.1.1-rc.1` local-link install, composed-config readback, real Web-profile startup, plus third-round independent alias-path and semantic-rendering revalidation |
| Windows native DSH | Pass on `11d6fe4` for local-link Bundle loading, composed config, Web startup, six-tool lifecycle, resume, cancellation, repeated runs, alias-plus-space paths, and native project filtering. Deterministic slash dispatch and rendered English DOM remain unverified natively on Windows |
| Remote CI | Pass on release commit `7e9f1e3`: main run `32544825580` and tag run `32545526300` each completed all nine Ubuntu/macOS/Windows jobs across Python 3.11/3.12/3.13 |
| Real-model semantic round trip | Pass on focused Windows revalidation of `11d6fe4`: default `en` and `zh-CN` workflows read the disclosed enums, produced valid aggregates, and finalized with `semantic_analysis.status=complete` and `fallback_reason=null`; the Chinese run used bounded repairs that were accepted by the validator |
| npm, tag, GitHub Release | npm, annotated tag, and GitHub Release published and independently read back against the accepted artifact and release commit |

The first sandboxed Web startup failed at `listen EPERM` on `127.0.0.1`. Repeating the same isolated profile startup in system context succeeded and printed a live local URL; the failure is classified as a command-sandbox socket restriction, not a Bundle load failure.

The first independent macOS DSH review found unsafe ordered substring replacement in the English Dashboard, incomplete resume/cancellation/repair-to-fallback coverage, and an unsupported follow-up `ContextForm`. The second review confirmed those repairs, then reproduced a false run-root rejection when a canonicalized `/private/var` root was compared with a not-yet-created `/var` child, and found three framework-owned Chinese strings in a semantic English report. The candidate now canonicalizes through the deepest existing ancestor and localizes those semantic-finalization strings. A third independent macOS review closed both findings: two semantic prepares and two deterministic commands succeeded under a `/var`-aliased DSH home, a complete English semantic report rendered with zero CJK characters outside scripts, all 10 Node and 35 Python tests passed, and the audited npm payload contained the intended 17 files. No remaining macOS release blocker was found.

Independent Windows acceptance first bound base commit `ada5f10`, passed the native Bundle lifecycle, and exposed validator-only aggregate enums that caused the real-model English run to fall back. Commit `1fe5bc4` disclosed those enums, added contract-parity coverage, and made POSIX-rooted Windows project filters fail with an actionable native-path error. Focused revalidation on `11d6fe4` closed both findings: native project filtering behaved as documented, and real-model `en` plus `zh-CN` workflows completed without fallback. The Windows run did not natively invoke deterministic slash dispatch or browser DOM localization; macOS browser evidence and Node integration coverage remain the evidence for those surfaces.

## Exact package identity

- Source basis: the release commit containing this record, derived from `ffc155a0c9296dea492fe7996179263d731eefac` with only final registry-facing README and package-excluded release-document changes.
- Artifact: `dsh-session-insights-0.2.0.tgz`, 87,409 packed bytes and 333,927 unpacked bytes across 17 files.
- SHA-256: `3bb0dd2a64eece762b0eccfca51f6317fe294cece215971211a3bbce84122515`.
- npm SHA-1: `a8e588e0240ad27782dadcfdb21e2dc117cd7c3e`.
- npm integrity: `sha512-BmcDE0quU+5osyrIimK55xlnTlSYFdEjopnvplMOEKootklKv74iw5Hfar0Ur1L5kBmnZX5yd5KR0lbll2Ys+Q==`.
- Every packed file matched the corresponding tracked source file byte for byte. Package version metadata, Python package version, and analyzer version all resolved to `0.2.0`; no bytecode or install/build lifecycle script was present.
- Two independent `npm pack` executions produced byte-identical tarballs. Runtime source was byte-identical to the Windows-revalidated `11d6fe4` basis; the later differences were registry-facing package README reconciliation and package-excluded release documentation.

The final release commit changed only the two registry-facing READMEs plus package-excluded release documentation. A clean-tree pack reproduced the same 17 files and SHA-256 digest with byte-for-byte source identity. The npm registry tarball was then downloaded and compared byte for byte with that accepted local tarball. Any later change to a package-bearing file would require a new package version rather than changing the immutable `0.2.0` artifact.

## Publication readback

- npm published `dsh-session-insights@0.2.0` at `2026-08-22T02:08:02Z`. Registry metadata reproduced npm SHA-1 `a8e588e0240ad27782dadcfdb21e2dc117cd7c3e` and integrity `sha512-BmcDE0quU+5osyrIimK55xlnTlSYFdEjopnvplMOEKootklKv74iw5Hfar0Ur1L5kBmnZX5yd5KR0lbll2Ys+Q==`; the downloaded tarball was byte-identical to the accepted local artifact.
- The annotated remote tag object is `62ebaf58465047c72bef3bf1dcdb168a8b912d3b` and peels to exact release commit `7e9f1e3e50cdf464de59edf3a81cebc7f06c2ed8`.
- [GitHub Release `v0.2.0`](https://github.com/GreenLv/dsh-session-insights/releases/tag/v0.2.0) was published at `2026-08-22T02:12:31Z` as a non-draft, non-prerelease release. All five downloaded assets passed `SHA256SUMS.txt`; the npm asset was also byte-identical to the registry and local tarballs.
- Release assets: npm tarball `3bb0dd2a64eece762b0eccfca51f6317fe294cece215971211a3bbce84122515`; Skill zip `7fe0ef62839c2b6bb751dbdbe281447515876a188dd914260a95fa07ed57989b`; Python wheel `29ce14244729287810866bf65558e7ceaecdf51831f34e74d6c8a06caa2f1a67`; Python sdist `224777902b189c7b0b866dc4bed653412fb6d05f97ca2e39ced99716f8bf73b5`; checksum manifest `325c1f49b530604f17f561d5bed6729a3649e170318f630ef44a44134832ccad`.

## Remaining acceptance boundaries

1. Deterministic slash dispatch, rendered English DOM, plugin removal, and concurrent-home behavior remain explicit unverified native Windows boundaries.
2. Marketplace, article, and outreach status are distribution concerns tracked in [`docs/distribution.md`](../distribution.md), not product-acceptance evidence or `v0.2.0` release blockers.