# v0.1 validation record

Validation date: 2026-08-27

## Upstream baseline

- `mcp-cassette` commit `9e48be26cbf1f7fca5edde142673a9b102a25e86`
- Clean upstream result: 30 test files and 449 tests passed
- DeepSeek Harness commit `b150a551b8d465e31e418e1b2eaf5e79bbb7d28e`
- DSH compatibility baseline: `0.1.1-rc.2`

The detailed code and integration-seam findings are in
[upstream-audit.md](upstream-audit.md) and
[dsh-integration-options.md](dsh-integration-options.md).

## Automated acceptance

The repository and a separately copied clean checkout both passed:

```text
npm ci                         passed in the clean checkout
npm run lint                   passed
npm run typecheck              passed
npm test                       32 files, 463 tests passed
npm run build                  passed; Host and Web client bundles built
npm run test:e2e               1 file, 2 tests passed
npm run audit:pack             75 entries, passed
npm audit --audit-level=high   0 vulnerabilities
npm pack --dry-run             passed
```

All test homes, npm caches, npm userconfig paths, cassette roots, fixture
servers, ports, and DSH profiles were placed below temporary directories.
Network-facing test servers bound to loopback. No npm publication and no real
user configuration change was performed; source publication is tracked
separately from package release.

The focused e2e test starts a real stdio fixture, records a secret-bearing tool
call, closes the live server, replays the same call twice with no server command,
and asserts byte-equivalent deterministic results. A separate miss supplies a
tripwire server command and proves that fail-closed replay returns JSON-RPC
`-32601` without launching the tripwire.

## DSH package and browser acceptance

A local `dsh-echo-0.1.0.tgz` was installed into a new isolated DSH Web
profile using DSH `0.1.1-rc.2`. The composed profile contained the package-root
Loader row and initially empty bindings, so installation alone changed no MCP
endpoint. DSH Web then started on loopback and loaded the package's client
module without a shell rebuild. After the final DSH Echo rename, a second
isolated install/start/remove pass served `/plugins/dsh-echo/client.js`, whose
bundle declared Loader id `dsh-echo`, label `Echo / 录制回放`, and API prefix
`/dsh-echo/api`.

The first real browser pass exposed two integration defects that unit tests had
not found: the Loader row used a subpath name that DSH could not map to
`dsh.client`, and the client manifest injected a UI package with no client
loader row. The final bundle uses the exact package-root row and only the two
resolvable client dependencies; a regression test pins both constraints.

For the populated-page pass, the isolated profile used a synthetic redacted
Cassette and isolated Session event. The actual `Echo / 录制回放` tab displayed:

- Session id, Cassette id, replay mode, stdio transport, format v2, and redaction state
- `tools/list` and `echo` interactions with arguments, result, duration, and hit status
- a fail-closed Session miss and structured `/text` argument diff
- a second UI redaction of the Authorization field
- breaking drift for both a newly required parameter and a removed tool
- the compact Session/Trajectory annotation

The Web process was stopped and the plugin was removed. A final composed-config
dump contained no `dsh-echo` layer, and the isolated profile contained no
dependency, bundle entry, or installed package link for it.