# Stage 7: GitHub Release Candidate and Public Release

Stage 7 prepares, verifies, and publishes a public release. The maintainer
explicitly authorized the repository creation and publication actions after
the local candidate passed review. The `awesome-dsh-plugin` submission remains
the separate Stage 8 workflow.

## DSH contract baseline

The local verification target is DSH `0.1.0-rc.8` with the inspected Cordis,
Host/Client, Profile, and Bundle contracts. The candidate remains version
qualified; this document does not claim compatibility with later DSH versions.

The offline check creates a temporary `$DSH_HOME`, installs the fresh local
tarball with `dsh plugin --profile web add <tarball> --offline`, and runs the
read-only Profile smoke check. It never uses the user's Profile or real
`DSH_HOME`, and it does not record the temporary path.

## Public release surface

- `package.json` is public (`private: false`), MIT licensed, and points at the
  public GitHub repository.
- `package-lock.json` remains available for npm-based contributors, while the
  canonical DSH release path is pinned by `pnpm-lock.yaml` and
  `pnpm-workspace.yaml`.
- `dsh.bundle.patch`, the Web `dsh.client` declaration, `./client`, and the
  strict Host manifest remain aligned with the DSH `0.1.0-rc.8` contract.
- `.github/workflows/ci.yml` runs a frozen pnpm installation, Bundle build,
  tests, public-safe/history scans, and tarball verification on Node 22 and 24.
- `scripts/pack-dsh.mjs` creates a fresh ignored `artifacts/*.tgz` candidate;
  `scripts/verify-release-candidate.mjs` checks its manifest, file list, and
  private/development-only exclusions.
- `scripts/verify-dsh-offline.mjs` verifies local tarball installation in a
  disposable DSH Web Profile with direct `shell: false` process calls.

## Local gates

Run these commands from the repository root:

```sh
pnpm install --frozen-lockfile
pnpm run build:dsh
pnpm run check
pnpm run pack:dsh
pnpm run verify:release-candidate
node /path/to/preflight-dsh-extension.mjs .
node scripts/verify-dsh-offline.mjs \
  --dsh "${DSH_BIN}" \
  --tarball "${PWD}/artifacts/dsh-control-plane-0.1.0.tgz"
git diff --check
```

The offline Profile check requires a local DSH binary and a warm package cache;
CI validates the public package surface but does not claim to provide DSH.
The exact local DSH version, offline result, and any unrelated preflight warning
must be recorded in the ignored Stage 7 Review Pack, not in a public fixture.

## DeepSeek Pro review

After the checks, create `.reviews/stage-7/REVIEW-PACK.md` with relative file
names, sanitized diff facts, package/tarball summaries, and runtime evidence.
Use the local isolated DSH DeepSeek Pro Profile for advisory review. The API
Key may be supplied through the approved local credential or process-environment
boundary; its value, source file contents, raw prompt, and raw response must
never enter the repository, Review Pack, shell transcript, or final report.

The parent Agent must compare the review result with the actual diff and all
local gates. A model PASS is not a publication authorization.

## Exit criteria

- Public README, License, CI, lockfile, Bundle build, security scans, and
  tarball checks pass together.
- The fresh tarball installs into a disposable DSH Profile in offline mode and
  the target Loader row is present.
- The tarball contains only the intended public Bundle surface; no credentials,
  private paths, local configuration, Review Pack, tests, source-only scripts,
  or real runtime data are shipped.
- The sanitized DeepSeek Pro review is PASS or all findings are resolved and
  re-reviewed.
- Local Git history and the final diff are reviewed and committed.
- The `awesome-dsh-plugin` submission remains outside Stage 7 and must not be
  described as merged or accepted until the upstream project confirms it.

## Status

Stage 7 is complete. Local runtime evidence, sanitized DeepSeek Pro result,
parent diff review, the public repository, the `main` branch, the `v0.1.0` Tag,
and the public Release tarball are recorded and verified. Stage 8 is the next
execution stage and remains unmerged until the upstream `awesome-dsh-plugin`
project accepts the submission.