# Release evidence

[README](../README.md) | [简体中文 README](../README.zh.md)

This document records the acceptance evidence for the source state published as `dsh-live-loop` 1.0.0. Generated DSH Profiles, browser data, app evidence, caches, and credentials are intentionally not committed. The repository retains one reviewed UI screenshot and this reproducible results ledger.

## Environment

| Item | Value |
| --- | --- |
| Verification date | 2026-08-21 (Asia/Shanghai) |
| Host | Windows 10.0.19045 x64 |
| Node.js | v24.14.1 |
| npm | 11.11.0 |
| DeepSeek Harness | exact `0.1.0-rc.7` dependency graph |
| Browser | installed Microsoft Edge / Chromium runtime |
| Package | `dsh-live-loop@1.0.0` |

## Automated release gate

### Clean dependency restore

```text
npm ci --legacy-peer-deps
```

Result: **PASS**

- 223 packages restored from the committed lockfile
- 224 packages audited
- 0 known vulnerabilities reported by npm
- no rc.8 package occurs in `package-lock.json`

The explicit legacy-peer mode is required because published DSH rc.7 packages contain caret peer suggestions that current npm otherwise attempts to satisfy with rc.8, producing `ERESOLVE`. It does not loosen the plugin's exact DSH peer declarations.

### Complete source and browser suite

```text
npm run test:all
```

Result: **PASS**

- TypeScript `tsc --noEmit`: exit 0
- Unit and contract tests: **14 files, 110 tests passed**
- Real browser and framework integration: **3 files, 11 tests passed**
- Covered real Vite React, Vite Vue, Next.js, generic app lifecycle, Console errors, HTTP failures, white screen, bounded loading timeout, stable-ref interactions, redirect denial, Reference / Current / Diff, and cleanup
- Full story: real DSH subprocess → first verification failure → fixture code fix → browser re-verification → durable evidence → complete cleanup

### Build

```text
npm run build
```

Result: **PASS**

The build emitted the ESM Host/Core entries, the DSH lazy-loader-compatible CJS Client entry, source maps, and type declarations under `lib/`. The CJS client format is deliberate because the verified rc.7 Client Module Loader consumes that wrapper.

### Package gate

```text
npm pack --json
```

Result: **PASS**

The normal `prepack` hook reran `test:all` and `build` before creating the archive. Package inspection confirmed that the archive contains only the declared runtime, patch, license, bilingual documentation, reviewed UI image, architecture/security/compatibility documents, and release metadata—no tests, caches, Profiles, browser state, or local credentials.

## Clean DSH Profile acceptance

The packed plugin was installed into a newly created DSH Home/Profile using the exact rc.7 package graph, rather than being loaded from this working tree.

| Check | Observed result |
| --- | --- |
| `dsh plugin --profile <clean-profile> add <tarball>` | package installed |
| `dsh --profile <clean-profile> --dump-config` | `live-loop` Bundle member present |
| DSH Web HTTP startup | successful |
| Lazy Client Module | revision `15adb7d23c6c` returned HTTP 200 |
| Native DSH UI | Live Preview conversation view visible |
| Target detection | 42 directories scanned, 14 manifests inspected, 13 targets returned, not truncated |
| Managed application | Vite fixture discovered, started, health-checked, and owned |
| Browser interaction | generation-scoped refs refreshed; fill/press interaction observed |
| Page | main response 200, title `Live Loop fixture` |
| Console | 0 unignored errors |
| Network | 0 critical failures |
| Verification | `VERIFIED` |
| Verification ID | `b47119bb-06d9-4d87-bd6b-a427ccbd1801` |
| Evidence attachment | persisted DSH image reference; attachment failure is a blocking verdict condition |
| Stop/disposal | server lease, page, BrowserContext, and owned process tree closed; no residual server |

The verified interaction produced the observed page text `Hello, Final Release!`. The report and PNG were traceable through the same `previewSessionId` / `verificationId` pair during the clean-Profile run.

## Reviewed UI evidence

![Native dsh-live-loop Live Preview in DSH Web](./assets/dsh-live-loop-preview.png)

Screenshot facts:

- source: the exact clean-profile DSH Web acceptance run;
- dimensions: 1440 × 1000;
- SHA-256: `F157BCE7B2FEE624DF0C2338F34BD547D38E17FE8C37A6B12A0B9CF8D3FA72DC`;
- visible Host state: `RUNNING`, `READY`, `VERIFIED`;
- visible report: HTTP 200, Console 0, Network 0;
- reviewed for credentials before publication.

## Reproduce from a checkout

```bash
npm ci --legacy-peer-deps
npm run test:all
npm run build
npm pack --json
dsh plugin --profile web add ./dsh-live-loop-1.0.0.tgz
dsh --profile web --dump-config
dsh --profile web web
```

Run the DSH Web command inside a real frontend workspace, open a conversation, select **Live Preview**, then Detect → Start → interact → Verify → Stop.

## Verified external constraints

- The plugin supports the exact DSH `0.1.0-rc.7` seam; this evidence does not claim compatibility with later release candidates.
- A compatible installed Chromium runtime is required. Missing browser infrastructure produces `UNVERIFIED` rather than a pass.
- Target CSP, `X-Frame-Options`, and remote-host/local-browser topology can prevent direct embedding; the UI reports that condition and falls back to screenshot/external-open behavior.
- Agent workflow guidance uses public prompt/tool descriptions and is soft guidance, not an unbypassable Agent-loop policy.