# DSH STORE #1185: exact packaging and guarded review

User request on 2026-10-04: "那你修复和推送一下, 解决问题". The earlier
2.0.2 repair did not complete STORE admission. Both storefronts had already read
`ed702438121718f99595fdb5527537c919560d0e` and still blocked files, network and
commands. Issue text is a historical notification, not the current Catalog state.

## Reproduced packaging defect

STORE fixed-source policy Commit
`eab44d15c250644a6db2e1ae8b4fa43e972097a2` treats negative `files` selectors as
unsupported. Version 2.0.2 declared `!skills/**/__pycache__/**`, `.pyc` and `.pyo`
exclusions. Its scanner therefore fell back to the entire checkout: 240 files,
109 scannable sources, including development tests that introduced credential
and dynamic-module signals.

Version 2.0.3 generates an exact positive list from the frozen resource lock.
Synchronization refreshes it; Bundle and archive gates reject drift. All 140
research resources remain byte-equivalent after LF normalization. The distributable
surface is 147 files, with 59 scannable sources. Checkout-only source, fixture and
development files are no longer accidentally classified as installed runtime.
The archive gate also checks exact membership and each locked resource hash.

Tests cover the old ambiguous manifest, resource-list refresh in an isolated
preview, paths escaping the resource root, glob injection and generated bytecode.
They also require executable helpers and Lean templates to remain visible.

## Remaining capabilities require a different admission decision

The corrected package still contains real file, network and command capabilities.
STORE also requires review for scientific/template artifacts outside its automatic
extension whitelist. The local replay retains that failure and incomplete-scan
status; it does not label unknown capabilities as absent.

| Distributed surface | Trigger and authority | Review boundary |
| --- | --- | --- |
| `index.mjs` | Host loads the entry and reads four packaged skills | Public injected Skills service; no startup subprocess, network or project write |
| Python research helpers | Caller explicitly selects a workflow and project | Read/write project and evidence paths; review resulting changes |
| Blueprint viewer | User opens the viewer | Browser reads same-origin `blueprint.json` |
| `sync_remotes.py` | Explicitly requested Git synchronization | Git may contact caller-configured remotes and use existing Git credentials |
| Lean/Lake helpers | Explicit formal-verification request | External compiler and logs/cache; selected environment may fetch dependencies |
| Templates, Lean sources and hash manifests | Selected research/verification workflow | Present in the archive; not hidden or executed during Bundle loading |

The complete capability class must be reviewed conservatively as elevated.
The entry has no npm runtime dependencies or install lifecycle scripts. No
credential collection is performed by the Bundle entry; external Git/tools may
use their own existing credentials. That boundary does not certify an independent
security audit of every helper.

## Release and evidence gates

The 2.0.3 candidate must pass repository/Bundle checks, native Windows root
tests, archive member/hash checks, and disposable Linux Profile acceptance for
`0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2` and `0.2.1-alpha.1`. Each release
checks headless/web install and startup, the actual official Skills registry,
malformed-package controls, uninstall and exact configuration/manifest/lock rollback.
CI publishes a distinct sanitized artifact per release.

Publication follows candidate CI before main. Exact package hashes, tested inputs,
final Commit, CI and storefront readbacks are retained in the external delivery
record. This document describes the gates, not a pre-issued PASS receipt.

## Prepared STORE request

Request review of the fixed 2.0.3 source and retained capabilities for the existing
`user-reviewed` Catalog route, including per-install/update local risk review.
Keep runtime acceptance partial and independent security review unknown. Review
all distributed helper and scientific/template artifacts explicitly. The proposed
Catalog name is `数学研究技能包（Math Research DSH）`, since its primary purpose
is research guidance rather than a general backup tool.

The requested decision belongs to STORE maintainers. Neither this repository's
tests nor author declarations grant an approved listing. A Catalog proposal is
review material until independently accepted; #1185 must remain unresolved while
the public record is blocked. No real user Profile, credentials, running DSH or
research canonical state is changed by this repair.