# Core dependency provenance

The standalone DSH adapter consumes the host-neutral Python distribution `thaliris==0.4.2` from the Thaliris Core repository at current main commit [`751ccea498ad89c6c77c622fb4efaee9be469326`](https://github.com/Iris0fTheValley/Thaliris/tree/751ccea498ad89c6c77c622fb4efaee9be469326). The DSH native API baseline is source revision [`639ed015397290b3745d163aafe02ffee4aa3f84`](https://github.com/deepseek-ai/deepseek-harness/tree/639ed015397290b3745d163aafe02ffee4aa3f84). The adapter keeps the authority and task ledger in Core; this repository ships no Core or Codex adapter source.

For the extracted-repository validation, a fresh `thaliris-0.4.2-py3-none-any.whl` was built from current Core main, inspected, and installed into a task-owned Python 3.11 environment. Its payload contains only the `thaliris` package (`__init__`, `authority`, `cli`, `core`, `markdown`, and `models`) plus distribution metadata; it contains no Codex-specific modules. The tested wheel SHA-256 was `d315401b2b8a85e013c49a2de8e682643b4f9ddc760d1ee48cd0ea1a39b987c1`.

Bridge and native composition checks used the matching upstream `src` tree at commit `e7ede5e657e580fd90c1514d912672facb3a36c7`: 13 bridge tests passed, as did all native scenarios. The current main commit `751ccea498ad89c6c77c622fb4efaee9be469326` adds only project README updates after that source revision. The packed activation smoke uses the fresh wheel built from current main.

The original source repository's live Web integration was verified separately against Core source revision `256f760`, including a real active task, a fifth child, denial of native root tools to that child, and an explicit `DONE` close. That observation is separate from the extracted-repository native and packed-install checks; a Desktop binary was not launched.