# Open-source readiness

Status: **the public baseline is beta.3; beta.4 and beta.5 were published on npm for DSH 0.2.0-rc.2. Beta.6 is the current release candidate awaiting final publication/readback. The DSH community listing remains pending.** The private development Git history must never be published.

## Release boundary

The product source, tests, user documentation, public design decisions, de-identified release evidence, and community files are publishable. Historical agent handoffs, raw Session material, local profile homes, milestone tarballs, private acceptance logs, absolute user paths, and internal coordination documents are not.

The current private Git history contains a real Session log and many internal absolute-path references. Removing the current file alone would not remove it from history. Rewriting the private history is unnecessary and risks damaging evidence. The supported path is:

1. run all checks in the private source repository;
2. create a new allowlisted directory with `pnpm release:export -- /absolute/path/to/new-directory`;
3. scan that exported directory and inspect `PUBLIC_EXPORT_MANIFEST.json`;
4. initialize new Git history only in the exported directory;
5. for updates, clone the existing public remote and commit only the allowlisted snapshot on its public main history; never merge or push private development ancestry;
6. build the selected preview tarball once, publish those exact bytes through npm and GitHub Releases, and verify installation in fresh Web and headless Profiles.

Never attach the existing private remote or push the existing private history to the public repository.

## First public distribution

The public beta is published as the unscoped npm package `dsh-experience-map`, with the exact packed tarball also attached to its matching GitHub Release. Do not advertise `github:alcheme-labs/dsh-experience-map` as the easy install path: a git dependency fetches TypeScript source without `lib/`, and pnpm 10 requires the user to allow a package `prepare` script before it can execute. The npm package and Release tarball both ship the already verified runtime and need no installation-time build permission.

Publication follow-up status:

1. [x] add the repository topics `dsh-plugin`, `deepseek-harness`, `agent-memory`, `experience-replay`, and `local-first`;
2. [x] verify the uploaded Release tarball and npm package in fresh Web, headless, and management Profiles;
3. [ ] publish the prepared draft once in the official `Show Your Plugins!` Discussions category;
4. [ ] confirm the repository appears on the `dsh-plugin` topic page and that the Discussion link opens for a signed-out reader;
5. [x] publish one identical `0.1.0-beta.3` artifact to GitHub and npm, then verify Registry readback and supported dist-tags.

The community post must remain visibly labelled unofficial and include the project URL, a concise explanation, the DSH integration path, a representative interface screenshot, and qualified rather than promised benefit measurements.

## Gates

| Gate | Required result | Current result |
| --- | --- | --- |
| Sensitive-history audit | No direct publication of private history | Passed by clean-export boundary; direct publication prohibited |
| Public snapshot allowlist | Raw Sessions, credentials, databases, local homes, internal evidence, and absolute user paths excluded | Automated by export and release checks |
| Secret scan | No unresolved finding in the exported snapshot | Recorded in `evidence/release/security-audit.json` |
| Production dependency audit | No high-severity advisory in default installed dependencies | Transformers.js removed from automatic installation; audit result recorded |
| Optional semantic runtime | Explicit installation and risk disclosure | Optional peer; disabled by default |
| Package contents | Only built runtime, bilingual README, license, security policy, notices, and patch | Automated dry-run inspection |
| Functional verification | Typecheck, unit/integration tests, build, docs tests, package check | Recorded in `evidence/release/package-validation.json` |
| Product evidence | Exact task, treatment, measurements, raw-log privacy boundary, and non-claims | `docs/release/BENEFIT_EVIDENCE.md` |
| Community health | Contribution, conduct, support, security, changelog, CI, issue and PR templates | Present in clean snapshot |
| External publication | Public Git remote, npm Registry, and GitHub Release readback | Public repository plus matching npm and GitHub `v0.1.0-beta.3` artifacts read back; community listing pending |

## Published artifact immutability

The `v0.1.0-beta.1` tag and Release assets remain immutable. After that Release was published, the English README maintainer display was corrected from the Chinese legal entity name to `Alcheme Labs`; Chinese and legal attribution remain `杭州星原驱动科技有限公司`.

`0.1.0-beta.2` introduced the public unscoped npm identity, but fresh DSH installation found that its `preinstall` Node guard was rejected by the Profile's strict build-script policy. It remains immutable and is not the supported installation target.

`0.1.0-beta.3` removes every install lifecycle script and enforces the Node 22.19+/24+ requirement when the Host or management CLI module is actually loaded. Its tarball is built once, published unchanged to npm, and attached to the matching GitHub Release. Both channels are checked against the packed artifact before installation guidance is updated.

## Current compatibility and behavior

`0.1.0-beta.4` adapts to DSH `0.2.0-rc.2`; `beta.5` switches to notification-only learning and additive sidecar v7 migration; `beta.6` fixes management label/count wrapping and updates installation guidance. The full removed/changed/preserved behavior is recorded in [CHANGELOG.md](../../CHANGELOG.md). DSH `0.1.5-rc.2` continues to use immutable beta.3; `latest` is not moved by a beta.6 release. Previously saved canonical Experiences remain available. Historical release measurements are retained as dated evidence, not claimed rerun for beta.6.

## Dependency decision

MiniSearch is the only required production dependency and is installed normally; its MIT notice ships in `THIRD_PARTY_NOTICES.md`. DeepSeek Harness and React remain host peers.

Transformers.js remains supported as an optional local text-embedding runtime, but it is no longer auto-installed. Its current upstream dependency graph contains native-package advisories. The default package therefore remains lexical and conservative unless an operator deliberately supplies the peer runtime and a digest-pinned local model after reviewing the advisories. This preserves the local semantic adapter without silently exposing every installation to a vulnerable native stack.

## Rollback

A defective npm version must be deprecated, a corrected version released, and installation guidance updated. Never reuse or move an immutable version tag. Schema v8 is pre-release and rejects older databases; a compatibility change needs its own migration and rollback evidence.

## Continuing non-goals

- No published tag or Release asset is moved, replaced, or reused.
- No existing private Git history is rewritten or pushed.
- Do not point supported npm installation guidance at an artifact that has not passed a fresh DSH Profile installation.
- No raw Session or model body is made public to strengthen a benchmark claim.
- No automatic Experience execution is enabled.
- No general token-saving percentage is claimed from a one-family pilot.