# work-charter-dsh verification

## Published successor verification (2026-09-27)

- Product commit: `1d9d5cc26f3cb934028ffc6257385dbe82db1cd8`, message `feat: release native Team Work Charter v0.2.0-alpha.1`, 36 intended paths, clean tree after commit. Cumulative attempt record is `.verification/successor-0.2.0-alpha.1/release-20260927/commit-completion.json`; prior review/failure/repair evidence remains below.
- Main integration was fast-forward and push was non-force. Remote main and the peeled new annotated tag both equal that commit; tag object is `17e4bd9f4c76d8a6244176c10bbc6ec9e8a050cc`. No old tag or release was changed.
- Release `397642170` at [v0.2.0-alpha.1](https://github.com/junwei529/work-charter-dsh/releases/tag/v0.2.0-alpha.1): post-publication API confirms `draft=false`, `prerelease=true`, publication time `2026-09-27T12:32:42Z`. Creation/publication used `latest=false`. The by-tag REST endpoint returned 404 while the release was a draft; the authenticated release-list and download routes exposed the correct draft. This was a lookup difference, not evidence of a missing release, and no duplicate was created.
- Four remote assets were downloaded into the new `release-20260927/downloaded` directory and byte-compared with their local counterparts; `remote-assets.json` records PASS. Tarball: 103,216 bytes / SHA-256 `f2b602d0ad5ed87d183f25c106ee72b11a10188f1cd45e39ccb3584caf3bf913`; `.sha256` sidecar: 101 bytes / SHA-256 `9647538e16372849f1ad10371ac748b7ef778b72b4e09f99d5ee43c244e5acf2`; `.sha512` sidecar: 165 bytes / SHA-256 `b85821e933827dce88331aef5b586c461112743339446a6ae0a7b2984380f89f`; provenance: 9,412 bytes / SHA-256 `6d99b87380dcddb41a9701aa39dae562c41caf3399e0ede5966bb4f300b7adef`. GitHub's final asset digests match all four.
- The provenance placeholder was replaced with the actual reviewed product commit before upload. No published tarball was rebuilt or overwritten. The initial task-local CLI Web process was confirmed absent after interruption; bounded official profile probes disposed their contexts. Real browser UI, live-model efficacy and two-producer reproducibility remain unverified; publication does not change those limits.

## Successor GitHub release qualification (2026-09-27)

- Approved publication continuation and exact targets are recorded in STATUS. Baseline remains `c71d0a9cbc399c61470159c0f595de5e7ed079c0`; previous findings and failed evidence remain below.
- Independent consumer: `.verification/successor-0.2.0-alpha.1/release-20260927/consumer`. Official npm installation of pinned DSH `0.1.7-rc.2`, the already approved runtime dependencies and the local WCDP tarball reached terminal exit `0` (session `66482`, 553 packages); lifecycle scripts were disabled and the task-local content store was reused. Its separate lock SHA-256 is `7c5b41f924accf9bc835c082e4b5752c57a78c6eea0bbd944ef5d35820e1bf44`. `clean-result.json` checks all 38 direct package resolutions stay within this consumer's own node_modules, all inspected DSH package manifests are `0.1.7-rc.2`, and no SCDP exists in that lock. Store reuse is not reuse of the parent's installed graph.
- Exact consumer checks: native Host `runtime/e145be7f-3b92-4ae1-a4ef-f80bc2a3fe64/result.json` and Client `client/f6f8de35-172a-469f-b0b4-8227634dd8af/result.json`, under the consumer's `.verification/successor-0.2.0-alpha.1`, both exit `0`. These reuse the reviewed qualifier with import paths redirected to the installed package; native first-call/restart/UNKNOWN/Phased coverage and jsdom/fixture-RPC limits are unchanged.
- Official CLI: `@deepseek-ai/dsh@0.1.7-rc.2` registry integrity `sha512-SQFhriLvza8GnFApnC5/32AgpcyKxrWnYXhvwDOLJdgWpkCX2EexyR9c8kCkMITJXnFLEN3Qb2CEh0W36vkLyw==`, reports the expected version. `dsh plugin` successfully installs the final tarball into new `wcdp-release-final` under an isolated task DSH_HOME, with scripts disabled. Its manifest composes base, Web and WCDP bundles. No version exemption is used.
- Final profile proof: `consumer/profile-wcdp-release-final-result.json`, official `runProfile`, terminal exit `0`; actual WCDP health is `ok`, contract/schema `2`, upstream `0.9.1`, Team unavailable as expected for base/Web Direct. The unauthenticated HTTP request returns `401`, authenticated request returns `200` with the 34,617-byte Web document; the profile is disposed after the check. This is actual profile/Host startup, not merely a configuration dump, but does not exercise the UI in a browser or a live model.
- Browser limitation: Codex in-app browser navigation to the local server returned `ERR_BLOCKED_BY_CLIENT`. No browser UI PASS is claimed and no browser security setting was weakened. Full browser UI and natural-language efficacy remain unverified and are disclosed in the release notes.
- Preserved qualification failures: the initial registry probe used unscoped `dsh` and found no matching package, then official source identified the correct scoped CLI. Fixture corrections resolved shortened pnpm directory names (versions now read from manifests), Windows ESM URL conversion, an un-awaited health Promise and HTTP redirect-cookie handling. Unauthenticated `401` was expected protection, not a product defect. The first raw CLI launch printed its task-only authentication URL; it was not published in artifacts, and subsequent captures redact tokens. The initial server was interrupted; successful bounded profile probes dispose their contexts.
- Final archive: `.verification/successor-0.2.0-alpha.1/release-20260927/assets/work-charter-dsh-0.2.0-alpha.1.tgz`, 46 files / 103,216 bytes / SHA-256 `f2b602d0ad5ed87d183f25c106ee72b11a10188f1cd45e39ccb3584caf3bf913`. A file-by-file comparison with the previously reviewed `b7d1bc6b...` tarball shows only `README.md` and `README.zh-CN.md` changed; every implementation/schema/Skill/default/license byte is identical. Pack audit passes, so unchanged production bytes retain their 59-test and independent-review evidence. The final archive additionally passed the actual fresh-profile install/health check above.
- Release assets: tarball, `.sha256`, `.sha512` and unsigned `provenance.json`; the latter records package file hashes, exact compatibility, source lock, scope and limitations. The exact commit field is filled mechanically only after the reviewed commit exists. Release notes are `.verification/successor-0.2.0-alpha.1/release-20260927/release-notes.md`. No two-producer reproducibility, signatures or attestation are claimed.
- Documentation impact: bilingual README UPDATED for install procedure and evidence limits; SPEC CHECKED with publication-authority pointer; STATUS/VERIFICATION UPDATED. Production source/tests/package dependency graph CHECKED_NO_CHANGE since the converged review; all new production files and lock remain in the intended commit. Generated lib, task profiles/stores and qualification outputs remain ignored local evidence.
- Commit/release gate: the same independent Reviewer inspected the release-facing delta, evidence and helper scripts, and independently checked the real tarball, both checksum sidecars and provenance file hashes. It found no new P1/P2 or commit/Pre-release blocker; cumulative findings remain closed. Its `git diff --check` exited `0`. The primary dispositions the bounded result as release-ready with declared limits. The actual commit SHA must still replace the provenance placeholder, tag identity must match, and uploaded assets must be verified; publication is not yet reported successful. This paragraph and STATUS mechanically record that formed review result.

## Successor convergence checkpoint (2026-09-27)

- Same-R round 2 closed WCDP-R1 through R5 and maintained RM-R1 through RM-R3 closure. It confirmed the three supplemental manifests and previous tarball hash, inspected actual repaired source/tests/new Client qualifier and native result records, and ran read-only diff checking. It did not rerun the author's producer/runtime checks.
- New WCDP-R6/P2 was independently reproduced in memory: after accepted P results for subjects A/B, correcting A after a new E result leaves Map insertion order unchanged, so `findLast` selects old B and rejects an otherwise valid close. The author now deletes the existing route/subject key before setting its latest notice, preserving chronological order. The regression explicitly exercises A/B, E correction, renewed A acceptance and successful close while retaining the stale-acceptance rejection.
- Native session `78933` reached terminal exit `0`: focused policy tests, build, configured typecheck, full lint, all 59 tests and pack audit pass. Current package: `.verification/successor-0.2.0-alpha.1/package/3448f875-9049-4093-bb41-e8df8d0d1f37/work-charter-dsh-0.2.0-alpha.1.tgz`, 46 files, SHA-256 `b7d1bc6b27222710a4eedb1fdb32dcddf2351a102ab48243e89584be22a86466`. Current lock remains `8077259a3702aff7065c14196b630392121432db7f3fa1ce1ad8ecf7843704d8`.
- Native Host qualification on the changed build then exited `0`: `.verification/successor-0.2.0-alpha.1/runtime/79c2ccc2-a99a-4d8c-a463-11168ed24971/result.json`, same declared Direct/Team/restart/UNKNOWN/Phased coverage. The R6 production delta is Host policy only; unchanged Client evidence remains `client/6205c2ef-1056-40bf-ac90-fb7a0c9062ba/result.json` with the jsdom/fixture-RPC limitations below.
- Same-R round 3 independently confirmed R6 closure with a read-only in-memory probe: stale Phase acceptance still rejects close after E2, while renewed acceptance of corrected A closes successfully despite prior subject B. It checked the expanded regression, current result record, tarball SHA-256 and clean diff formatting. It reported no new blocking finding. Cumulative WCDP-R1–R6 and RM-R1–RM-R3 are closed. It did not rerun the full author verification chain; prior coverage limits remain.
- Primary closeout disposition: the authorized local successor implementation and bounded verification are complete, with all material review findings closed. Final edits to STATUS/VERIFICATION mechanically record this formed result and do not alter reviewed product bytes or the qualified tarball. No Git commit, publication, user-profile installation, old-store mutation or broader approval is inferred. Full real-browser/profile/independent installation and natural-language efficacy remain unverified rather than implicit claims.

## Successor repaired checkpoint (2026-09-27)

This is the current evidence checkpoint; earlier runs below retain their original scope and failures.

- Supplemental authority: the user answered **批准这 3 个依赖** to the exact Gateway/Client Connection/Client Store `0.1.7-rc.2` proposal. The same project-local official-registry pnpm add then reached exit `0` (6.4 seconds), with scripts disabled and five graph packages added (three requested packages and their dependencies). No alternate transport or approval bypass was used. Lock SHA-256 is now `8077259a3702aff7065c14196b630392121432db7f3fa1ce1ad8ecf7843704d8`.
- Independent complete-implementation review round 1 inspected the actual tracked/untracked diff, installed public native contracts and current result. It reported WCDP-R1 P1 (persisted child falls back if Team unavailable), WCDP-R2 P1 (queued disposition accepted before delivery), WCDP-R3 P1 (old O acceptance covers corrected E result), WCDP-R4 P1 (supersession clears UNKNOWN/writer), WCDP-R5 P2 (O cannot ask R to review its own direction/Mandate). Four in-memory probes reproduced R1–R4; R5 was a static route finding. Prior RM-R1/R2/R3 remained closed. Reviewer ran no writes/install/build tests; diff check passed.
- Original-author repairs: find persisted child bindings before consulting missing native membership; distinguish material queued from delivered and preserve native id during explicit reconciliation; freeze P-to-O execution result ids in `dependsOn` and demand current O acceptance; require settled handoffs plus released writer before supersession; add original-author/product-bound `review-request` including O's own product while retaining O→E/P-review bypass rejection. Host provisioning also respects material queued stops. YAML file reads are bounded to regular files and 64 KiB before parsing.
- Producer/verification chain native session `97494` was drained to terminal exit `0`: build, configured strict Host/Client/test typecheck, **full lint**, **8 test files / 59 tests**, native runtime, Client qualifier and package audit/pack all passed. Configured typecheck retains upstream `skipLibCheck`; full dependency declaration closure with `skipLibCheck:false` is not claimed. The previous missing ClientRemote error is resolved without relaxing lint or substituting its type.
- Exact current Host run: `.verification/successor-0.2.0-alpha.1/runtime/cdace61c-23a0-49c7-a0fd-480d553403f7/result.json`. It preserves prior Direct/Team/restart/UNKNOWN/legacy-rejection checks and adds O-own-product result→R request→R review→O acceptance before the complete native E/R/P/O cycle. Missing-Team, queued-disposition, stale-phase and supersession counterexamples are covered by regression tests. No key, network model request or paid call is used.
- Exact current Client run: `.verification/successor-0.2.0-alpha.1/client/6205c2ef-1056-40bf-ac90-fb7a0c9062ba/result.json`, plus `rendered.html`. Built lazy-CJS factory runs on actual DSH SlotRegistry and Cordis, React DOM renders global/Session actions and read-only overlay, base owner/other contribution identity remains, and unload/reload leaves zero remote mounts. The environment is **jsdom with a fixture read-only RPC and base seat declarations**, not real Chromium, full DSH UI/profile or Gateway network integration. Two earlier fixture errors (StoredEntry inject location and filter-input classification) remain under their distinct failure roots.
- Exact current package: `.verification/successor-0.2.0-alpha.1/package/ec6aaf38-3f0f-47b9-9143-6ef2ff8838a6/work-charter-dsh-0.2.0-alpha.1.tgz`, 46 files, SHA-256 `5797ec98be67777a9c716a3520b983b30d162c3c1ee933d8e871befb91ef9205`. Adjacent `result.json` records each packaged file hash, approved resolved graph and singleton identities. Extracted imports use the same approved parent graph; no independent clean installation, two-producer reproducibility, user installation or publication is claimed.
- Review disposition: all five implementation findings have author-side repairs, **pending same-R closure**. They are not yet reported as independently closed or as user acceptance. Full real-browser/profile installation and natural-language efficacy remain outside this checkpoint's demonstrated coverage.

## Successor integrated checkpoint (2026-09-27)

- Installation: approved initial graph installed via existing pnpm `11.7.0`, official npm registry, task-local `.verification/successor-0.2.0-alpha.1/store`, `--ignore-scripts`; native execution session `71430` reached terminal exit `0`. pnpm 11 overrides moved from ignored manifest configuration into `pnpm-workspace.yaml`. Initial non-TTY reinstall failure was not a product defect; old profiles and artifacts were untouched.
- Producer: `npm run build` exits `0`; configured Host/Client/test TypeScript checks exit `0` with strict/noImplicitAny. Typert uses the selected public generator and protocol declarations, not an upstream checkout. Recursive portable parameter values use a locally owned type so the public codec can generate them without narrowing valid unused-role configuration.
- Unit/artifact checks: `vitest run` exits `0`, 8 files / 54 tests. Coverage includes 23 model-core tests, YAML whole-file/precedence and inert-data restrictions, contract/run state, CAS/foreign/forged actors, R/P separation, writer release, correction routes, consumption history, uncertainty, Phased ordering, context bounds, read-only Remote and lazy Client factory dependencies. This is not a full browser qualification.
- Dependency/artifact audit: exact installed declared versions checked; shared Cordis/Zod/React resolve to one identity across inspected DSH dependency origins; current source/build/lock have no SCDP runtime. Lock SHA-256 `7661d7a4649d402ac2aec5399c0a08c93bfe49f269066388414b2a5fc07675cf`. `scripts/successor-audit.mjs` checks Host/Client exports, schema closure, default asset inclusion and map path/source-content leakage.
- Native seam-only probe: `.verification/successor-0.2.0-alpha.1/model-route/654df9b5-e6c2-415c-9e63-fcd9195cfa6e/result.json`, PASS. It established public request replacement on first Team call and cold resume before WCDP integration. Earlier fixture failures (mock effort metadata, double schema application, Lead call counting, unloaded child lookup and disposal API) remain in separate failure files; they are not product conclusions.
- Integrated built Host: latest result `.verification/successor-0.2.0-alpha.1/runtime/1f7b9ccd-14b8-4f3a-91f2-e4402d707add/result.json`, terminal exit `0`, PASS. Fresh native Cordis/Session JSONL/Storage JSON/AgentLoop/Team composition verifies Direct without Team, role provisioning through registered WCDP tool, frozen provider/model/effort/maxTokens on initial and resumed calls despite a changed Lead default, exact four read-only Remote methods, and snapshot/effective-model reconstruction from child Session events. A schema-1 fixture is rejected with byte-identical store afterward.
- Native failure/recovery test: inject loss of a successful native send reply; WCDP preserves prepared→unknown, pauses, survives runtime restart and rejects resume/repeated send. Exact retained native receipt permits explicit owner reconciliation; history remains prepared→unknown→accepted and state stays paused. This tests stopped continuation and record semantics, not independent truth verification of an arbitrary caller-provided reconciliation reference.
- Native Phased fixture in the same result records E→P result, R→E technical review, P→E disposition, P→O phase result, O→P disposition, then O close; O→E bypass is rejected. Uses live native actors and keyless scripted models. Host-invoked policy decisions are fixture data; this does not prove natural-language models choose the correct decisions, user authority, hard isolation, or general efficacy.
- Earlier integrated run failed because an optional Team was accessed with injected-property syntax from the WCDP context. It was repaired to use the public optional lookup. Fixture assertions were also corrected from nonexistent `status` to public `isError`; original failure is retained. Later PASS is distinct evidence, not erasure of that failure.
- Package: `.verification/successor-0.2.0-alpha.1/package/4b81f78a-26ba-49fd-916d-4aca598fe60f/work-charter-dsh-0.2.0-alpha.1.tgz`, 46 files, SHA-256 `357586ba23cd0152722ebb763afbb0c6c563e71d7715acf6e3dbde29e1ac1e70`. Its adjacent `result.json` lists every packaged file hash. Extracted Host and public schema imports pass using the approved parent dependency graph; this is not a separately installed consumer/profile. Earlier `pnpm pack --ignore-scripts` was rejected as an unsupported pack flag; the corrected command uses pnpm's configuration argument to disable scripts.
- Remaining gate: full lint exposes unresolved `ClientRemote` via upstream api-remotes declarations. Three required public development type/runtime packages (Gateway, Client Connection, Client Store, all selected DSH version) were proposed. Restricted network attempt session `42555` was cancelled and reached exit `1`; automatic approval review rejected escalation because these additions were outside the exact prior approval. User input is pending. No rule was disabled, no substitute declarations were introduced, and no supplemental installation succeeded. Client coexistence/native-browser verification, full lint and integrated independent review are not yet complete.

Historical sections below are immutable prior checkpoints. Statements there such as “not installed” or “proposal only” describe those earlier checkpoints and do not supersede this integrated checkpoint.

## Successor dependency acquisition proposal (approved)

The user explicitly approved this bounded proposal on 2026-09-27. This is installation authority, not an installation result. Source: official `https://registry.npmjs.org` artifacts; DSH source target remains commit `477b4f420553e8a52c2fbccc464d7561b239c443`.

- Update the existing WCDP development graph's DSH packages to `0.1.7-rc.2`; add its public Agent Team, Team tools, AgentLoop, LLM, Session persistence/projection/query, and in-process continuable-subagent packages needed for exact runtime qualification. All DSH family packages in this graph must resolve to that same version. Remove SCDP from the successor graph.
- Propose shared Cordis `4.0.4` and Schemastery `3.18.4`, matching the pinned DSH manifests' minimum compatible vendor versions. Preserve existing React `18.3.1`, Zod `4.4.3`, TypeScript `6.0.3`, Vitest `4.1.8`, and other existing build/test tool versions unless an actual conflict requires another user decision. Promote existing transitive `js-yaml@4.3.2` to a direct dependency for strict YAML input parsing; no new custom YAML parser.
- Scope: this repository's package/lock/development installation and a new `.verification/successor-0.2.0-alpha.1/` consumer/profile/store only. Use the already installed package manager, task-local cache/store, registry integrity checking and disabled dependency lifecycle scripts. Do not acquire toolchain/global packages, use private registries, alter Codex/DSH user configuration or old profiles/stores, or run paid/live LLM calls.
- Verification: inspect the resolved lock/integrity and DSH/vendor identities, reject mixed DSH generations, run producer build/type/lint/domain checks before isolated consumer/native runtime/restart checks. An unsupported package or required lifecycle script stops that affected acquisition; it does not authorize a substituted version or broader install.
- Recovery: retain the old qualified artifacts and profiles. Failed new installations remain isolated evidence; return to the retained old profile if needed. Do not delete or rewrite old stores, automatically migrate data, reset source changes, or treat a failed install as permission to rerun scarce validation.

Read-only probes on 2026-09-27 confirmed npm manifests for Agent, Agent Team, UI Renderer, Storage Domain and Typert Generator at `0.1.7-rc.2`. Agent Team integrity is `sha512-N3/M+Wc1p50jKNF4fxJIP4m3iL4T4MiZelpIneVwwxVxoCTPlzdz0E5tKyN+p5x318aOxsibsa98D4N13Q4uoA==`. These probes establish availability of those artifacts only, not complete dependency installation or runtime adoption.

This file owns verification methods, evidence identities, results, and limitations. Documentation, static checks, local-artifact runtime evidence, and model self-report are distinct evidence classes. None of them alone establishes semantic efficacy or release acceptance.

## Successor design evidence (2026-09-27)

The following bullets preserve the initial source/contract assessment and design-review checkpoint. The subsequent implementation checkpoint is recorded separately below. Neither checkpoint is successor runtime qualification, migration or release evidence; the later **Evidence identities** and **Qualification results** sections remain tied to the old release.

- Local subject: clean `codex/wcdp-v0.1.0-alpha.1-release@c71d0a9cbc399c61470159c0f595de5e7ed079c0` at entry; `git rev-parse`, `status --short --branch`, and `worktree list --porcelain` all exited 0 using exact command-local `safe.directory`.
- Installed source: `C:/Users/Administrator/.codex/skills/work-charter/.work-charter-install.json` identifies version `0.9.1`, package SHA-256 `07a4c7579c985d8580387e1cbc48f315289975b6e62369b316c5fdf3fcfb2ec0`, tree `39659168b5fb20899335dd0923c87b65d5a95e36`. SHA-256 reads of SKILL, both assets, both references, and agents/openai.yaml match all six receipt entries. The receipt's aggregate package hash was recorded, not independently reconstructed.
- Examined installed content: complete SKILL and Charter/model-default assets; coordination/recovery sections for selection, stable-node migration, progression, identity, authority, model schema/source resolution, review and result routing; shared Phased responsibilities and operating entry. This is relevant-content inspection, not a claim of a freshly loaded model instruction chain or exhaustive semantic equivalence.
- Local implementation inspection: `src/types.ts` still exports SCDP types and binds Work Charter `0.3.0`; `src/index.ts` unconditionally requires `sessionCoordinator`; `src/coordinator.ts` consumes membership and accept/get/process record operations; `src/policy.ts` and types retain the old protection/role/state shapes. Existing README, SPEC and STATUS define the exact legacy graph.
- Official published target observed: [DSH dsh-v0.1.7-rc.2](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.7-rc.2), commit `477b4f420553e8a52c2fbccc464d7561b239c443`, published 2026-09-24; proposed qualification target only.
- Decisive official sources examined during this conversation: [tagged Team contract](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.7-rc.2/docs/subsystems/agent-team.md), [tagged package operation/limits](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.7-rc.2/packages/experimental/agent-team/README.md), and [tagged mailbox source](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.7-rc.2/packages/experimental/agent-team/src/mailbox.ts). They establish root-bound flat Team identity, Lead-only spawning, same-Team peer messaging, native durable queue/recovery, target inbox/history de-duplication, and random-id admission. Native delivery proof does not distinguish WCDP semantic acceptance or inspection.
- The [old alpha.1 Team README](https://github.com/deepseek-ai/deepseek-harness/blob/cd5ef8148158c3a752a658978873241fdf8e2bbc/packages/experimental/agent-team/README.md) already described durable Team messages and recovery, then excluded from official releases. The design must not characterize all coordination as newly added or claim that DSH formerly lacked any persistent messaging.
- Additional immutable-commit and tag reads of Team `package.json`, `src/types.ts` and `src/index.ts` through web returned cache misses; a direct read-only `curl.exe` for the immutable package manifest exited 1 with connection failure. No downloaded files, credentials, dependency acquisition, retries with escalation, or upstream writes resulted. Exact public package exports, installability, optional service lifecycle, model-selection parameters and current Client integration still require qualification. Source-access failure is not a product defect or permission to use internals.
- After the user selected SC-01 option A, a command-local read-only network escalation succeeded against the same immutable commit. All five `curl.exe --fail --silent --show-error --max-time 20` reads exited 0, with no local output files or installation: Team `package.json`, `src/types.ts`, `src/index.ts`, `src/roster.ts`, and `docs/subsystems/subagent.md`. Full admitted command returns were retained in the current tool session; relevant extracts were examined, not the entire source corpus. The earlier failed reads remain historical failed attempts.
- New source findings: the [exact Team manifest](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/packages/experimental/agent-team/package.json) declares public root, `./types`, `./client` and invariant exports. [Types](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/packages/experimental/agent-team/src/types.ts#L165) exposes no model/effort field on `SpawnTeammateRequest`; [roster](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/packages/experimental/agent-team/src/roster.ts#L281) passes only prompt/parent as its continuation request. The [subagent contract](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/docs/subsystems/subagent.md) distinguishes transport provider from Agent model route and documents other model-option paths. These facts narrow the role-model compatibility gap; they do not establish that Team can honor full per-role selection. Public exports are source-confirmed, while registry installability, runtime behavior, optional lifecycle and Client seams remain unqualified.
- SC-01 approval recording and this source-gap clarification follow the reviewed design's existing fail-closed model-mapping condition. They do not change production code, adopt SC-02/SC-03, or extend the earlier review's independently inspected source coverage.
- No new runtime, model, browser, install, package, storage-migration or efficacy test has run. Historical tests were not rerun for this documentation-only proposal.
- Design self-check: `git diff --check` exited 0; the only changed paths are SPEC, STATUS and VERIFICATION. A bounded search of README/README.zh-CN, AGENTS, docs, scripts and tests found no consumer of the renamed STATUS headings; the new successor links target the same SPEC heading. Existing README and AGENTS remain correct for the unchanged current product; their successor edits are explicitly sequenced after product decisions. Git's LF-to-CRLF advisories are informational, not semantic failures.
- Independent design review: cold read-only subagent `successor_design_review`, configured `openai/gpt-6-astra` with `reasoning_effort: medium` from the selected personal schema-v2 `roles.reviewer` object (no arrangement override; no legacy lookup), reviewed the three-file unstaged design against baseline `c71d0a9cbc399c61470159c0f595de5e7ed079c0`. Native dispatch accepted the requested model/effort; no separate runtime identity attestation was collected. It inspected the actual diff, project instructions/README, installed Skill's relevant semantics, and material old types/policy/coordinator paths; result: no blocking findings, no P1/P2. It ran read-only diff checking and reported no writes. It did not repeat official-source retrieval, receipt hashing, or a complete implementation audit. The primary dispositions this as sufficient review of the proposal with those limits, not independent user acceptance, implementation qualification, or permission to adopt pending choices. Subsequent STATUS/VERIFICATION edits mechanically record that formed result and the next decision; they do not change the reviewed design.

### Model-selection implementation checkpoint (2026-09-27)

- Approved user decisions: SC-01 A, SC-02 exact successor identities, and SC-03 fresh profile/store; the user's final confirmation authorizes source implementation without reopening those choices. Dependency acquisition remains separately pending under the proposal above.
- Added `src/role-models.ts` and `tests/unit/role-models.spec.ts`; amended current-product AGENTS guidance and successor SPEC/STATUS. Existing Host/types/package/lock/profile remain legacy pending integration. The core accepts already parsed configuration data; no YAML parser or filesystem-selection integration is claimed complete.
- Focused test: `node node_modules/vitest/vitest.mjs run tests/unit/role-models.spec.ts` exited `0`, 1 file / 19 tests. Coverage includes frozen/confirmed priority, complete replacement, selected-source-before-package lookup, validation of unused entries, v1 ambiguity including present/missing and parameter differences, v1 Team/Phased compatibility, legacy exact-level selection, primary-only host fallback, responsibility eligibility, and supported DSH parameter mapping/rejection.
- `node node_modules/typescript/bin/tsc -p tsconfig.test.json --noEmit --incremental false --composite false --pretty false` exited `0`; `node node_modules/eslint/bin/eslint.js src/role-models.ts tests/unit/role-models.spec.ts` exited `0` after removing one deprecated Zod call and annotating one test callback's return type. These use the existing development dependencies, not the successor DSH graph. No release build or native successor tests ran.
- Further exact source reads exited `0`: [core public events](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/docs/subsystems/core.md#agentrequest--waterfall), especially lines 947-968; [continuation creation/resume](https://github.com/deepseek-ai/deepseek-harness/blob/477b4f420553e8a52c2fbccc464d7561b239c443/packages/subagent/subagent/src/continuation.ts#L104); and roster lines 92-115 / 129-158 / 246-322. `agent/request` is a public configuration replacement before prompt admission; provisioning membership is discoverable before the first request. Creation descriptors and roster display retain inherited Agent options, so they cannot attest the effective per-call route. The WCDP request-hook candidate still needs actual runtime and restart tests.
- Discovery failures retained: a recursive GitHub repository-tree response exceeded capture capacity despite curl exit `0`; its truncated JSON was not parsed or treated as full repository coverage. Subsequent lookups used known exact source paths. Two exploratory file reads used nonexistent local filenames (`policy.test.ts`, `eslint.config.mjs`); actual files were discovered as `policy.spec.ts` and `eslint.config.js`. These are lookup/output-capture failures, not product defects or successful verification.
- Independent implementation review round 1: the same `successor_design_review` read the full four-document tracked diff, both new source/test files, the installed model-selection chapter, and necessary unchanged legacy consumers. It reported one P2, `RM-R1`, at the scalar-only parameter schema: a legal array/nested setting on an unused role invalidated the whole source. No P1; diff check exited `0`; no reviewer writes, installation or generating tests. Native source/runtime and receipt identities were not independently requalified.
- `RM-R1` repair: accept inert JSON arrays/maps in configuration structure, then reject unsupported parameters only for the selected native delivery; recursively compare nested keys and array order and recursively freeze detached selection data. Two added tests cover unrelated-role settings and nested equality/freeze with post-selection input mutation; nested credential rejection is also covered. Repeated focused tests now pass at 1 file / 21 tests, no-emit tsc and focused eslint exit `0`. Same-reviewer re-review is pending. This scoped work does not complete the successor's policy/storage, Host/Team integration, YAML loader, optional service lifecycle, Client, package/profile, runtime/restart or full-delivery review.
- Independent round 2 confirmed `RM-R1` repaired and identified two new P2 findings: `RM-R2`, Zod removes own `__proto__` before post-parse validation; `RM-R3`, `localeCompare` can compare distinct Unicode keys as equal, making object insertion order spuriously affect v1 ambiguity. Reviewer independently confirmed both counterexamples with read-only probes, exit `0`; no P1 or writes. Primary repair checks raw parameters before transformation and uses exact UTF-16 string order for canonicalization. Two regression tests cover prohibited keys at both depths and canonically equivalent but distinct Unicode keys. Final focused tests pass at 1 file / 23 tests; no-emit tsc and focused eslint exit `0`. Same-reviewer final re-review is pending.
- Independent round 3 (final for this slice): the same R inspected both repairs, relevant existing/new tests and cumulative documentation, closed `RM-R1`, `RM-R2`, and `RM-R3`, and found no unresolved P1/P2 or new blocking finding. Its read-only diff check exited `0`; it reported no writes/install/generating checks and correctly treated the primary's 23 tests/type/lint results as reported verification rather than its own execution. The primary accepts this bounded checkpoint for continuation; this is not independent user acceptance or full successor qualification. Subsequent STATUS/VERIFICATION edits record this formed result only. Source/tests remained frozen throughout each review window. Dependency-installation permission remains unanswered; no acquisition occurred.

## Evidence identities

- Repository publication source: public `main@f734c2a6e2b8bb8e57475365d6d165f1d4f41d5c`; release-qualification commit `dae0362b15dc62278f16754ec6fc7ac3c5a92aa9`; and bundle-correction/release commit `09e52fd9860c6d3c8813f71f16c004f2a392c0a3` on `codex/wcdp-v0.1.0-alpha.1-release`. Annotated tag object `d5a7bd6baf17848c6d1fed31a5b019333c32eed3` for `v0.1.0-alpha.1` peels to the release commit.
- `WC-UPSTREAM`: installed Codex Skill receipt revalidated on 2026-08-29 as `junwei529/work-charter` `0.3.0`; package SHA-256 `7b67ea1f7073fa66ac91c36f3e39c735b54c04174e2fa3672068f8fa8948a5b2`; normalized package tree `0ac3cbb0f1fa8fa51d8f832c8127eabc9863ec9e`; installed `SKILL.md` SHA-256 `c750d51940456b110bc7ed4b7d490690f42ca8ee9b555c23c8fe3d4d056b4dba`.
- DSH source/build producer: task-owned clean detached checkout `.verification/dsh-v0.1.2-alpha.1`, official tag `dsh-v0.1.2-alpha.1`, commit `cd5ef8148158c3a752a658978873241fdf8e2bbc`.
- DSH local artifact set: 241 tarballs plus publish order under `.verification/artifacts/dsh-v0.1.2-alpha.1`; the complete 242-row fixed manifest SHA-256 is `b8aa5da1d0fec2abd7bf581819d7638de6e859adfd60c530a466b1c7ff90b1c6`. The root `@deepseek-ai/dsh@0.1.2-alpha.1` tarball is 15,267 bytes with SHA-256 `95d12c190d169c99db15d8958b034004489b6b43a0cb50879f885102bb18ed32`.
- scdp accepted source: private `session-coordinator-dsh@0.1.1-alpha.1`, public contract `3`, logical schema `2`, clean isolated worktree `.verification/scdp-dsh-v0.1.2-alpha.1`, branch `codex/dsh-v0.1.2-alpha.1-compat`, commit `8bed40f3e18b106c69e3dadbef6f029092e73424`, and public GitHub Pre-release tag `v0.1.1-alpha.1`.
- scdp public artifact: `.verification/release-inputs/session-coordinator-dsh-v0.1.1-alpha.1-published/session-coordinator-dsh-0.1.1-alpha.1.tgz`, 31 entries, 97,138 bytes, SHA-256 `9575d1edf782f16b2d87b49bc27e290ecf841fa607a7d4a4468a41de2389b269`, SHA-512 `2cffe633734aea39989dd28d70e811536dd54aace5038b87ece3416013809fabf1394e053559e2f6c9b61c67f35ecd22a10972621cb3bdf79b097dd0bc2df2df`. Compared with the older local WCDP input, its package path set and every runtime JS, declaration, source map, and package-manifest byte are identical; only `CHANGELOG.md`, `README.md`, `SECURITY.md`, and `THIRD_PARTY_NOTICES.md` changed.
- `WC-DSH-PRE-REVIEW-L4`: the earlier private `work-charter-dsh@0.1.0-alpha.1` L4 artifact `.verification/artifacts/work-charter-dsh-0.1.0-alpha.1.tgz`, 34 entries, 103,088 bytes, npm SHA-1 `2dbfc44ec756f65120ccec096d3b01507b778a63`, SHA-256 `8879ecc345b279dfa7354208c5b40884896af733e1e9170ef6143765089240a9`, is retained as historical evidence and is not the release subject. The pre-L4-correction failed artifact is retained under `.verification/artifacts/history/pre-l4-route-fix-d981cba5/` with its original SHA-256.
- `WC-DSH-POST-REVIEW1`: intermediate 36-entry package `.verification/artifacts/release-prep-v0.1.0-alpha.1-post-review1/work-charter-dsh-0.1.0-alpha.1.tgz`, 104,754 bytes, npm SHA-1 `437f0d2121d50c1b5788b2bdc48d4d8407ddd026`, SHA-256 `617736b18ee4bd05117e67aca613093036f322de6063fc8a8e817e5ce91bfd28`, is retained as historical evidence and is not the release subject.
- `WC-DSH-RELEASE-CANDIDATE`: exact private release and runtime subject `work-charter-dsh@0.1.0-alpha.1` at `.verification/release-readiness/final/work-charter-dsh-0.1.0-alpha.1.tgz`, 39 entries, 98,593 bytes, npm SHA-1 `74a13559a6acf689d941584d144ab966668a43a6`, npm integrity `sha512-bINQgX5EKd0eawmY/lhLJXbcQD1ygxUJTtae40D+OJlvYifS0krDUguddEkLgE3rh5WR9DXxjinuuCuQB8Mupw==`, SHA-256 `40b2b176ad44a5ab888f36c555ad26ac23fe87aac7ed228a75717db2ac6f711b`. Its unsigned 431,377-byte provenance SHA-256 is `1f9a1123588abefedc188b053884e55ad19327a66cb6e69ad3dbbb2580e8f720`; the final directory contains exactly that tarball, SHA-256 and SHA-512 sidecars, and provenance. The provenance binds 26 release-source rows, 39 package rows, the complete 242-row DSH manifest, the public scdp asset, exact pnpm shim, generated lock, and two frozen/offline producers.
- Public GitHub Pre-release: Release `379262153`, tag/title `v0.1.0-alpha.1` / `work-charter-dsh v0.1.0-alpha.1`, `draft=false`, `prerelease=true`, published at `2026-08-30T11:33:34Z`. GitHub exposes exactly the accepted tarball, SHA-256 sidecar, SHA-512 sidecar, and unsigned provenance asset; all four are uploaded, and the tarball GitHub SHA-256 digest is `40b2b176ad44a5ab888f36c555ad26ac23fe87aac7ed228a75717db2ac6f711b`. The tarball's `package/README.md` is the 52-line packaging-time snapshot and retains the then-current statements that publication and the tag/Release had not occurred; the post-release repository README is not part of, and does not replace, the checksum-qualified published bytes.
- Final clean consumer: `.verification/clean-consumer-release-v0.1.0-alpha.1-r2`; its 347,320-byte lockfile SHA-256 is `eb3e092249d87374c1237b088bd2a880d2a9fcb2455ee95582fc88fb53ffd19e`. The retained setup generator is `.verification/release-readiness/setup-clean-consumer-v0.1.0-alpha.1.mjs`, 6,186 bytes, SHA-256 `1e228d168344420b91fc40ec49141dfb08316cf6e8eeae2f89b505a2c1ba8f11`.
- DSH CLI/profile activation: task-local home `.verification/dsh-profile-install-v0.1.0-alpha.1-r1`; exact profile manifest `profiles/wcdp-activation-r1/package.json`, 571 bytes, SHA-256 `5f0bce93facca22aefe1a869e40202d3268661c8a1314652efcfd014be8f8aef`, records `@deepseek-ai/dsh-base` then `work-charter-dsh`. The composed config contains `session-coordinator-dsh` before `work-charter-dsh`. Actual profile boot result `.verification/dsh-profile-probe-v0.1.0-alpha.1/result-activation-r1.json`, 641 bytes, SHA-256 `a6a6321a2953cc2f94d6e1c349ebfd41febf3268121bebfa6961a094e9b29c6c`, reports scdp contract `3` / schema `2` and WCDP contract `1` / schema `1` ready.
- L4 fixture: `scripts/qualify-l4-runtime.mjs`, SHA-256 `9d95dc673fa8b1e9cf254fb062ec69a58a1a1f4ce4ee01e17d5fc9cd857b93ba`. It resolves every product/runtime import from the exact clean consumer and writes only under its isolated task-local profile.
- Final L4 run: `6e136d76-f1da-4ba4-88fe-24c182180278`; result `.verification/clean-consumer-release-v0.1.0-alpha.1-r2/profile-runtime/l4/6e136d76-f1da-4ba4-88fe-24c182180278/result.json`, 1,175 bytes, SHA-256 `13695ed7b54fbeac6d6af0c7e28e1d98bb43c4bcf7466493cb9c2bf9ba2c3d43`; Charter storage SHA-256 `3544b595dccd69baaa10862d8791e7ec7c97696c0e50fa6ca5d356952685ef6c`; scdp storage SHA-256 `24edfaf48f2096014821d2637aff4be88be0a71678a74f4e9a6ba788f8eec54e`.
- Persisted L4 cross-check: scdp storage contains exactly six `acknowledged` deliveries and no diagnostic fallback records. The phase Result Notice uses `work-charter-dsh/phase-result-notice/v1`, is caused by the accepted execution disposition record, and the returning `phase-disposition/v1` record is caused by that phase notice. Session logs contain 2 Orchestrator, 3 Planner, and 2 Executor model replies. Work Charter storage contains both notice ids with exact accepted dispositions returned by the Planner and Orchestrator respectively.
- Toolchain: Node `v24.16.0`; exact task-local pnpm `11.7.0`; producer shim `.verification/corepack/v1/pnpm/11.7.0/bin/pnpm.cjs` SHA-256 `67b035e322203961795e8e34ca63a08c37a4386eda94107fb3d28f3246d882ad`; consumer native executable SHA-256 `625c0ea2ef7dfd25e1042b19f92da6fd8f0a5b37f08abe4d8ff18977011ae019`; TypeScript `6.0.3`; tsdown `0.22.2`; Vitest `4.1.8`; ESLint `10.8.1`; Chromium `149.0.7827.55`.
- Assessor: no controlled comparison or independent semantic assessor has run.

The exact alpha.1 DSH packages and `session-coordinator-dsh@0.1.1-alpha.1` return npm Registry `404`. The accepted installation route below is therefore a task-local graph of the final WCDP tarball, the public scdp GitHub asset, and tarballs produced from the exact DSH checkout. A separate exact DSH CLI run installs the two GitHub-style tarballs into one profile and boots the resulting bundle. Neither result establishes normal registry-backed installation; together they establish local GitHub Pre-release qualification for this exact four-asset WCDP output.

## Qualification results

| Layer | Result | Evidence boundary |
|---|---|---|
| Exact DSH producer | **PASS** | Frozen exact-tag installation, official build, and `release:pack` completed without tracked-source drift. The official build record covered 218 files at SHA-256 `d8ad3d3c39cfd2ef637d5fa978f1782da5bd61f1bf07784044c72d9996c2bcbf`; 241 package archives were emitted. This qualifies the local producer only. |
| scdp candidate producer | **PASS** | Its final qualification passed build, strict typecheck, lint, and 8 files / 93 tests. The public 31-entry artifact above is the exact WCDP dependency input. |
| Work Charter producer | **PASS** | Host ESM, Typert/Remote declarations, strict Host/Client/test typechecks, lazy-CJS Client, lint, and full test suite passed at 6 files / 33 tests. `WC-DSH-RELEASE-CANDIDATE` is the exact producer, clean-consumer, base-runtime, browser, and L4 subject. |
| Release reproducibility | **PASS** | Two isolated producers used the same normalized source snapshot, source-bound generated lock, exact DSH/scdp inputs, attempt-local prepared store, and pnpm `11.7.0`; both installs were frozen/offline and their tarballs and package manifests were identical. `release:audit` independently passes over 26 source maps and the retained final evidence. |
| DSH bundle/profile activation | **PASS** | Exact DSH `dsh plugin` with pnpm `11.7.0` installs the published scdp tarball as a plain profile dependency and the final WCDP tarball as a bundle layer. The profile manifest records WCDP, the composed config orders scdp before WCDP, and a real custom-profile boot returns both Host health contracts before requesting normal exit. |
| Clean installed identity | **PASS** | The fresh consumer has 81 local artifact dependencies: 79 distinct `@deepseek-ai/dsh-*` packages, scdp, and Work Charter. Every DSH package is `0.1.2-alpha.1`; Cordis `4.0.1`, React `18.3.1`, scdp `0.1.1-alpha.1`, and Work Charter `0.1.0-alpha.1` each resolve to one installed path. |
| Clean package/type consumer | **PASS** | Strict NodeNext no-emit typecheck with `skipLibCheck: false` resolves public Host, Client, Remote, and type exports from packed artifacts. The Work Charter Remote declaration has exactly four read-only operations: health, Charter get/list, and per-Session list; no mutation alias is exposed. |
| Real Loader and Host policy | **PASS** | Actual Cordis Loader mounts both packages, reports Work Charter health contract `1` / storage schema `1` / scdp contract `3`, creates a Workstream Charter over three real DSH Sessions, and registers the DSH Skill plus five model tools. Model-tool actor identity comes from the executing DSH Agent, while browser Remotes are read-only. Runtime evidence covers unauthorized-role, stale-revision, and post-close disposition rejection; unit coverage additionally proves open-decision rejection, current-member validation, unique checkpoint-per-route submission, serialized route disposition, correction-aware accepted close, and latest-execution gating for Standard phase advancement. |
| scdp coordination | **PASS** | Result Notice and causally linked disposition are accepted through the public scdp service, both deliveries reach `delivered`, membership survives restart, replay is idempotent, and a conflicting immutable record is rejected. Unit coverage separately preserves `UNKNOWN` for ambiguous storage/delivery recovery. |
| Persistence/restart/recovery | **PASS** | JSON storage persists and reopens a closed accepted Charter; Workstream membership and Session-to-Charter mapping survive application restart. Loader remove/reload withdraws and restores the Host, Typert, Client, Skill, and tool contributions without rewriting ready storage. Final-artifact run `a6fe68de-71a7-41d9-b74c-61fd2801719c` exercised atomic accepted-close writer release and produced Charter SHA-256 `5f10baeabd11110b2bd3912c50287e84417ed3e541366c98cb22f04dbabf9b06` and coordination SHA-256 `ee73becc0bca8b3f311faabd758443f43c42316544dbcf2a0d48039216dda3c8`. |
| Logged model context | **PASS** | A keyless scripted LLM exercises the real DSH Agent loop. The DSH Session log contains active and paused Work Charter runtime snapshots plus the inactive clear marker; a restarted Agent recovers exactly that history and emits no redundant closed-state snapshot. |
| Standard O/P/E L4 | **PASS** | The final run created one active `standard-ope` Charter and three distinct real DSH O/P/E AgentLoops. O→P Mandate, P→E Definition, E→P execution Result Notice, P→E execution disposition, P→O phase Result Notice, and O→P phase disposition all used the Work Charter/scdp path, reached durable `acknowledged` state, and were consumed by the target role model. The Host requires accepted execution assessment before P→O and preserves both causal record links. No raw-scdp fallback ran or counted. |
| Browser Client | **PASS** | Real headless Chromium resolves both published lazy-CJS Client bundles and both generated Remotes. `WC 1`, the global action, per-Session action, and Host-authoritative read-only overlay render; Work Charter dispose/reload preserves scdp, root/sidebar owners, and six native ownership sentinels, leaves zero in-flight requests, and reports no console/page error. Unit coverage proves the Work Charter Remote surface has no mutation endpoint and that an exact Workstream Charter focus cannot fall back to an unrelated global Charter. Final-artifact screenshot: `.verification/clean-consumer-release-v0.1.0-alpha.1-r2/output/playwright/work-charter-dsh-coexistence.png`, 44,547 bytes, SHA-256 `5f9b5c6d18ac57e481ab6939694fe8c1c24ddf4866a2c2131674d09ceec7ed4d`. |
| Source/checkout integrity | **PASS** | Exact DSH and accepted scdp checkouts remain clean; root diff checks pass apart from Git's informational LF-to-CRLF checkout advisories. The intended root bundle-correction subject is exactly eight paths; ignored verification inputs, producers, consumers, caches, and outputs are not part of it. |
| Controlled comparison | **NOT RUN** | No predeclared upstream-baseline/candidate cases have been executed with equivalent non-product context. |
| Independent semantic assessment | **NOT RUN** | Role separation in the deterministic runtime fixture tests Host acceptance rules; it is not an independent judgment of Work Charter quality or efficacy. |

## Reproducible local checks

The source-contract check remains:

```powershell
npm.cmd run verify:dsh-source -- .verification\dsh-v0.1.2-alpha.1 .verification\scdp-dsh-v0.1.2-alpha.1
```

The Work Charter producer checks are:

```powershell
npm.cmd run build
npm.cmd run typecheck
npm.cmd run lint
npm.cmd test
npm.cmd run release:reproduce
npm.cmd run release:audit
```

The isolated scdp producer used its `build`, `typecheck`, `lint`, `test`, reproduce, audit, and source-verifier routes from `.verification\scdp-dsh-v0.1.2-alpha.1`. WCDP does not rewrite that repository's tracked historical lock; its own provenance binds the exact public scdp tarball and uses a generated relative-path lock as producer evidence.

The retained DSH CLI/profile activation used the exact built DSH launcher, final scdp/WCDP tarballs, pnpm `11.7.0`, and an ignored one-shot health probe:

```powershell
$taskPnpm = (Resolve-Path .verification\runtime-tools\pnpm-11.7.0).Path
$env:Path = "$taskPnpm;$env:Path"
$env:DSH_HOME = (Resolve-Path .verification\dsh-profile-install-v0.1.0-alpha.1-r1).Path
$env:DSH_TELEMETRY_DISABLED = '1'
$dshBin = (Resolve-Path .verification\dsh-v0.1.2-alpha.1\apps\cli\lib\bin.js).Path
node $dshBin plugin --profile wcdp-activation-r1 add `
  (Resolve-Path .verification\release-inputs\session-coordinator-dsh-v0.1.1-alpha.1-published\session-coordinator-dsh-0.1.1-alpha.1.tgz).Path `
  (Resolve-Path .verification\release-readiness\final\work-charter-dsh-0.1.0-alpha.1.tgz).Path `
  --offline --ignore-scripts --store-dir (Resolve-Path .verification\pnpm-store).Path
node $dshBin --profile wcdp-activation-r1 --dump-default-config
$env:WCDP_PROFILE_PROBE_RESULT = (Resolve-Path .verification\dsh-profile-probe-v0.1.0-alpha.1).Path + '\result-activation-r1.json'
node $dshBin --profile wcdp-activation-r1 --patch .verification\dsh-profile-probe-v0.1.0-alpha.1\probe.patch.yml
```

The manifest and config dump establish DSH's bundle activation decision and row order; the final probe process establishes that an actual composed profile reached both mounted Host health contracts. The ignored probe path is exact-host evidence, not a distributed package file.

The final clean-consumer checks used `.verification/clean-consumer-release-v0.1.0-alpha.1-r2`. To reproduce them, select a fresh task-owned suffix (for example `r3`), then run:

```powershell
node .verification\release-readiness\setup-clean-consumer-v0.1.0-alpha.1.mjs .verification\clean-consumer-release-v0.1.0-alpha.1-r3
Push-Location .verification\clean-consumer-release-v0.1.0-alpha.1-r3
try {
node ..\corepack\v1\pnpm\11.7.0\bin\pnpm.cjs install --offline --frozen-lockfile --ignore-scripts --no-runtime --trust-lockfile --store-dir ..\pnpm-store
node package-identity.mjs
npm.cmd run typecheck
node runtime-qualification.mjs
npm.cmd run build:browser
node browser\browser-smoke.mjs
} finally {
  Pop-Location
}
```

`runtime-qualification.mjs` allocates a fresh run directory by default so repeated executions do not reuse a prior Charter or storage subject. `browser-smoke.mjs` likewise uses an isolated profile and stores screenshots only under `output/playwright/`.

The dedicated L4 check is run from the repository root against that exact clean consumer:

```powershell
node scripts\qualify-l4-runtime.mjs .verification\clean-consumer-release-v0.1.0-alpha.1-r2
```

The final candidate exits `0` with structured result `PASS / L4_STANDARD_OPE`. The fixture writes its exact JSON result beneath `profile-runtime/l4/<run-id>/result.json`. PASS requires all six Standard role messages to use the Work Charter/scdp path, reach durable `acknowledged` state, and be consumed by the target AgentLoop; the raw scdp diagnostic fallback is available only for a rejected phase route, is reported separately, and never counts as PASS.

## Corrections discovered by qualification

- The Work Charter Typert generator originally mirrored too little of the public scdp declaration surface. It now mirrors only scdp's public `index`, `types`, and `storage` declarations and maps the public package root; no implementation internal is imported.
- The packed Work Charter Client declaration originally exposed a DSH-augmented `PropsRuntime` alias whose augmentation imports were removed by declaration emission. A truly clean consumer resolved that alias to `never`. Public component prop aliases now use the explicit structural props actually consumed by the components.
- The alpha.1 scdp candidate uses the split Session Controller, Client Store, and UI Renderer public faces, normalizes Windows CRLF-sensitive fixture assertions, and updates the browser/Loader composition fixtures. Public contract `3`, logical schema `2`, Host semantics, storage identity, and published service shape remain unchanged.
- The browser qualification fixture initially registered an undeclared child Slot and then served unauthenticated `/api` requests through the SPA fallback. The fixture now declares the parent-child Slot relation and supplies the browser-auth credential seam, authenticated launch URL, and authorized index flow. These were fixture defects, not accepted product failures.
- After the DSH checkout gained its exact installed graph, the source verifier's recursive directory read descended into package-local `node_modules` and stopped making bounded progress. Its package index now walks source directories explicitly and skips `node_modules`; the corrected check completes with the same source-contract result.
- The first L4 fixture preflight selected the newer Work Charter runtime-context snapshot instead of the triggering user/relay message, and a later diagnostic fallback used nonexistent scdp kind `result` instead of public kind `outcome`. Both were fixture defects corrected before the pre-correction product run; neither was treated as the final L4 result. That corrected run then isolated the Host policy failure subsequently fixed below.
- The isolated product failure was a real Standard hierarchy gap: Result Notice submission admitted only the Executor writer. The correction adds only the assigned Planner→Orchestrator phase route after an accepted Executor result, binds it to the accepted execution disposition, and emits distinct phase notice/disposition schemas. Two intermediate packed probes exposed the missing forward and return schemas before the final exact artifact passed the full chain.
- Native review found three fail-closed gaps before release: a consumed one-shot evidence record could be rewritten while reusing its consumed timestamp, accepted close could be attempted directly from `draft`, and pending one-shot evidence could carry `consumedAt`. The Host now preserves the entire consumed evidence record, requires `active` state for accepted close, rejects pending evidence with consumption metadata, and covers all three paths in the 17-test suite before exact-candidate runtime, browser, and L4 requalification.
- The next completed native review found that paused-state validation prevented durable revoked/unknown authority, active writer release could strand a Charter without a reassignable writer, and a per-Session action could select an unrelated global Charter instead of its applicable Workstream Charter. Paused Charters now preserve non-approved authority while resume stays fail-closed; active Charters retain their writer until accepted close atomically releases it; and the Session action carries the exact applicable Charter id into overlay selection. The 21-test suite covers the three corrections.
- The first base-runtime run against the post-review2 package stopped because its copied fixture still performed the obsolete active writer-release step. The fresh consumer fixture was corrected to exercise atomic accepted close, and only the subsequent PASS run `06022436-c996-4d7a-a043-2f42a6fa33b8` is accepted evidence; no product change was made for that fixture-contract drift.
- The third completed native review found that browser Remote mutation calls accepted a caller-supplied actor Session id and that a pending disposition could mutate a closed Charter. The browser Remote is now strictly read-only; Host/model tools retain mutation and model tools derive actor identity from the executing DSH Agent. Closed Charters reject disposition before target resolution or scdp writes. The 23-test suite locks both corrections.
- The first post-review3 clean-consumer type and base-runtime checks stopped because copied fixtures still required the removed mutation Remote aliases. The fixtures were narrowed to the exact four-method read-only contract; only the subsequent typecheck and run `c78ca3d1-3a3c-4fc6-8eb8-878c558800f9` are accepted evidence. No product change was made for that fixture-contract drift.
- The fourth completed native review found that an active Charter could dispatch a new Result Notice while a material decision remained open. Submission now fails with `OPEN_DECISION` before route resolution or scdp writes; the DSH Skill, model-tool description, and product contract state the same boundary. The 24-test suite proves zero transport writes and no Charter revision change on rejection.
- A code-only post-review4 pack was superseded before that correction's closeout so the model-visible Skill/tool wording could carry the same open-decision boundary. The resulting post-review4-final package and run `2e27d8e1-4165-45cc-87ab-238e116d02f6` are retained as historical evidence and are not the current release subject.
- The fifth completed native review found that a Planner or Executor detached from the Workstream after activation retained transition authority. Every Workstream-target transition now reopens current scdp membership for the actor before policy mutation, and lookup failure fails closed; two regression tests cover detached Planner/Executor attempts and unavailable membership state. The 26-test suite and exact `post-review5-final` producer, clean consumer, base runtime, browser, and L4 reruns all pass.
- The sixth completed native review found no author-fixable issue and independently passed typecheck, lint, 26 tests, pack dry-run, source-contract verification, and diff checks. A subsequent staged-diff check exposed eight new files with a blank line after their valid EOF; those non-semantic whitespace defects were removed before the next review.
- The seventh completed native review found two P1 acceptance-chain gaps: a `correction-required` Result Notice did not block accepted close, and a new notice id could duplicate the same checkpoint while an older accepted execution result could still authorize Standard phase advancement. The Host now serializes each semantic route, permits only one notice per route/checkpoint, requires the latest result on every used route for accepted close, and requires the latest Executor result for Standard phase advancement. A later accepted distinct checkpoint can supersede an earlier non-accepted result without erasing history. Four focused regression paths raised the suite to 28 tests, and the exact `post-review7-final` producer, clean consumer, base runtime, browser, and L4 reruns pass.
- Release preparation first attempted an empty task-local pnpm metadata cache, then an authorized task-local metadata fetch; the latter reached the unpublished DSH package boundary and returned Registry `404`. Neither attempt produced accepted evidence. The final route deterministically normalizes the already verified installed virtual-store lock, replaces only the public scdp tarball integrity, validates all 78 DSH overrides, prepares an attempt-local store from the prequalified store, and runs both producers frozen/offline. A test-fixture newline error, one SHA-512 validator bug, and lint-only callback style findings were corrected before the final PASS.
- Release-qualification native review found that final-evidence locking originally began only after both producers finished and that STATUS prospectively declared an uncreated commit complete. The same fail-closed lock now encloses the complete reproduction and final-verification window, `release:audit` encloses its complete current-build/final-evidence inspection, concurrency tests exercise both reproduction and inspection exclusion, and STATUS uses Git-bound pending/completed language.
- Publication preflight found that the packed candidate declared only `dsh.client`; DSH therefore installed it as a plain dependency and never activated a profile layer. The correction adds the exact `dsh.bundle.patch` declaration and packaged `cordis.patch.yml`, audits their bytes and ordering, and documents the two-tarball profile route.
- The first profile health probe used headless `--help`, whose app exited before the later overlay probe mounted. That attempt established only composed order and help, not Host health. A fresh custom base-backed profile then mounted scdp, WCDP, and a one-shot probe; only its dual-health `PASS` is accepted activation evidence.
- The clean-consumer setup generator rejected the changed WCDP SHA-256 before creating `r2`. Its checksum lock was updated to the new final artifact, after which a fresh frozen/offline consumer, base runtime, browser, and L4 run all passed. The rejection is a fixture identity guard, not a product failure.

## Limitations and open evidence

- The local artifact graph is not evidence that a user can install the package from npm. The DSH/scdp alpha packages are unpublished and both candidates remain `private`.
- WCDP now has a completed local two-producer result on a generated source-bound lock with relative artifact paths. Its provenance is intentionally unsigned and local; it is not an identity signature, public attestation service result, npm publication proof, or compatibility claim beyond the exact bound graph.
- Repository documentation can correct current release status after publication, but it cannot retroactively update the README embedded in the checksum-qualified GitHub asset. The recorded checksum—not the asset name or URL alone—identifies the accepted bytes, and that packaging-time document snapshot must remain distinct from later source-document commits.
- The browser test uses real DSH SlotRegistry, Remotes, Loader, React, and Chromium, but the goal/plan/workflow/approval/Conversation/Trajectory fixtures are ownership sentinels. It proves non-replacement and additive composition, not the complete native semantics of those six features.
- The DSH package `@deepseek-ai/dsh-client-ui-primitives` declares a missing `lib/index.js.map`; Vite reports the missing map while transformation and all relevant tests pass. This is retained as an upstream packaging warning and was not repaired in the clean DSH checkout.
- Initial restricted-network installs emitted pnpm version-metadata/supply-chain fetch warnings. The task-local graph and final evidence commands completed; `@tsdown/css@0.22.2` was added only to the ignored browser-evidence consumer after the authorized network retry, not to either product package.
- MIT is selected for `work-charter-dsh`, with the full grant included in the root and packed artifact. The Client source map identifies only Zod `4.4.3` under `node_modules`; its installed MIT text and copyright are included in `THIRD_PARTY_NOTICES.md`. At release-qualification evidence capture there was no WCDP push, tag, GitHub Release, npm publication, global installation, or global configuration change; those effects require their recorded gates.
- Compatibility with later DSH versions, Node 22, other storage providers, multi-process/cross-host coordination, full native-feature browser flows, causal efficacy, trigger quality, token savings, and production support remains `UNKNOWN`.
- The keyless L4 role adapters prove real DSH AgentLoop invocation, role-specific context, Host route/sequence enforcement, message visibility, causal records, and durable transport. They do not prove natural-language model quality, broad Work Charter efficacy, or independent semantic judgment.

## Evaluation isolation rules

- External governance may govern development but must not be injected into baseline/candidate model context.
- Upstream baseline and candidate require separate immutable identities even when they express similar text.
- Candidate self-report cannot establish activation, compliance, efficacy, compatibility, or acceptance.
- A failed transport, unavailable dependency, or invalid fixture yields the corresponding infrastructure result and leaves unobserved product behavior `UNKNOWN`.
- Repeating or replacing a bounded evaluation attempt requires its governing authority; a rename or new Session does not erase consumption.

## Evidence rules

- Record exact source, build artifact, installed copy, DSH ref, scdp version, configuration, command, result, and assessor.
- Record Node, pnpm, TypeScript, bundler, Host module format, Client factory format, and peer resolution used by evidence.
- Separate source/static checks from local-artifact runtime behavior, transcript evidence, controlled evaluation, and release proof.
- Preserve `UNKNOWN` for missing, stale, interrupted, sandbox-blocked, leaked, or identity-ambiguous evidence.
- Do not claim cross-Harness parity, causal efficacy, token savings, broad trigger accuracy, public installability, or release readiness without dedicated accepted evidence.