# Model Jury preflight

Verified on 2026-08-31 against `deepseek-ai/deepseek-harness` commit `0a53fb55bea101816fa226bb964ae2bed71c343b` (`0.1.2-alpha.2`). The source checkout remained unmodified.

## Public APIs

- `ctx.commands.register()` accepts a lowercase slash-command definition and an abortable handler. Command results are rendered by the UI without entering model history.
- `ctx.llm.stream()` accepts a hand-built provider-neutral request with `provider`, `model`, messages, optional output controls, and an `AbortSignal`. `BlockAssembler` is the public stream assembly helper. `ctx.llm.listProviders()` exposes the active route set.
- `ctx.subagents.start(provider, request)` starts a named one-shot provider and returns a disposable run. The first-party `@deepseek-ai/dsh-subagent-codex` package registers a Codex provider backed by the official `codex app-server --stdio` protocol.
- The Codex provider exposes provider name, model, environment overlay, permission mode, and process shutdown grace as public configuration. It preserves native Codex configuration and authentication.
- `@deepseek-ai/dsh-llm-pi-ai` supports named custom routes using `openai-completions` or `openai-responses`, a configurable base URL, credential reference, and model list. This is sufficient for GLM without a Model Jury-owned adapter.
- `@deepseek-ai/dsh-llm-deepseek` owns the first-party `deepseek-official` route and accepts configurable model IDs at call time.

## Native Codex authentication proof

The preflight launched a real child through `ctx.subagents.start('codex', ...)` with the first-party DSH Codex provider and the official package-local app-server. The process environment was launched with `OPENAI_API_KEY` unset. The child returned exactly `CODEX_SUBSCRIPTION_OK` and settled with `stopReason: completed`.

The preflight did not write or replace `~/.codex/config.toml`, did not set `OPENAI_API_KEY`, and did not configure an OpenAI API fallback. Native Codex account state remained authoritative.

The final built `CodexSeat` was then checked independently through the bundle's
`model-jury-codex` provider with `OPENAI_API_KEY` explicitly removed. Its real
app-server child returned `ok: true` with the detail `native Codex authentication
completed a real app-server child`.

## Bundle validation

The final package was packed with `npm pack`, installed through `dsh plugin` into
a fresh isolated Web profile, found in the composed configuration, and booted by
the pinned DSH Web host. `/jury doctor` returned READY through the real Web
command surface. Full real GPT + GLM + DeepSeek runs completed Blind Round 1,
anonymous Round 2, Round 3 revision, and deterministic aggregation.

## Risks and deviations

- The public Codex provider has no strict read-only permission mode. Its safest exposed mode is `never`, which disables approval prompts but leaves the sandbox to native Codex configuration. Model Jury prompts prohibit tools, project modifications, installs, commits, pushes, deployments, and network mutations. This is prompt enforcement rather than a hard capability boundary.
- The Codex provider does not accept an output schema. The seat requests JSON and performs one bounded repair call when validation fails.
- GLM and DeepSeek credentials were discovered in the user's existing API file and injected only into the isolated DSH launch process. Both real provider probes and full Model Jury calls passed. No credential value was copied into this package, its docs, tests, configuration, logs, or artifacts.
- Model Jury artifacts are intentionally written beneath `.dsh-model-jury/`; ordinary project files are not changed by runs.
- Round 2 and Round 3 include all three anonymous labels, including the reviewing seat's own position, because the required `P1|P2|P3|hybrid|undecided` vote schema has no `own` value. The original answer is also supplied separately, so this duplicates content but preserves stable aggregation without explicitly exposing the provider mapping.