Implementation and verification status
August 22, 2026 · View on GitHub
This file records concrete local evidence against SPEC.md. It is not a replacement for the normative specification.
Milestones
| Milestone | State | Evidence |
|---|---|---|
| 0 — bootstrap/provenance | Implemented; Windows verified | Pinned workspace/lockfile, CI matrix, safe env, corpus/schema; install, build, tests, provenance and secret checks pass locally |
| 1 — MCP experiment | Implemented | Hosted/self-hosted DSH MCP profiles use @deepseek-ai/dsh-mcp-client and mcp__honcho__*; 12/12 content-free deterministic cases pass |
| 2 — service/fake | Implemented | ctx.honcho, stable types/errors, host identity resolution, deterministic IDs, SDK-free fake and unit tests |
| 3 — SDK/outbox | Implemented | Exact SDK v3 fake-HTTP test; restart, ambiguous success, partial delivery, concurrency/order, retry/circuit, shutdown, dead-letter and HMR fence tests |
| 4 — capture | Implemented | Real pinned DSH AgentLoop tests prove one normalized root exchange, multi-turn/session correlation, child/error/injected exclusion, and asynchronous fail-open behavior |
| 5 — recall | Implemented | Real pinned DSH test proves first-step plugin provenance, untrusted formatting, no recapture, child exclusion, and outage completion |
| 6 — tools/RLM | Implemented | Exactly-five schema/admin-absence tests; DSH policy/result telemetry test for the nested dsh_tools.call shape; empty kernel environment assertion and RLM config example |
| 7 — release hardening | Implemented and hosted-live verified | Named-export bundle, native examples, five inspected tarballs, isolated install/import, security/operator docs, hosted evaluation/aggregate, verified fenced cleanup, Windows/Ubuntu CI and opt-in macOS job |
| 8 — artifact contracts/store | Implemented; Windows verified | @deepseek-honcho/dsh-artifact-memory; streamed 1 MiB chunks; deterministic IDs; project-keyed objects/cards; atomic publication; containment/link/mutation rejection; quotas, concurrency, restart, integrity cache/always, corruption/missing, and all freshness states |
| 9 — sanitized indexing | Implemented; Windows verified | Allowlisted assistant-attributed experiment cards; zero bytes/path/raw-query/SHA egress tests; actual SDK durable-outbox admission; deterministic delivery/revision; outage, pending reconciliation, ambiguous admission, restart, and HMR generation fencing |
| 10 — tools/search/RLM bridge | Implemented; Windows verified | Disabled bundle retains five tools; enabled bundle exposes seven; exact/lexical plus semantic search; wrong-project filter and remote fail-open; DSH policy/telemetry; lifecycle exclusion; real pinned Jupyter kernel record/restart/search/resolve/hash/freshness/bounded-slice acceptance test |
| 11 — evaluation/release hardening | Implemented locally; external CI/live gates noted below | 11-case artifact corpus, measured content-free report, six tarball inspection and isolated import, v0.2 configuration/examples, artifact security/egress/retention docs, provenance and approved RLM compatibility evidence |
Definition of Done audit
Locally proven: exact provenance/license notices; isolated native bundle install/import; default-off capture/recall; restart/deduplication; deterministic workspace/project/peer/correction/freshness corpus; no destructive model tools; DSH-only RLM tool dispatch contract; local format/lint/typecheck/unit/integration/e2e-skip/package/provenance/secret verification; egress/outbox/retention/non-sandbox documentation; Apache-2.0 selection; and an evidence-based README.
The 2026-08-21 hosted synthetic evaluation and cleanup are recorded in docs/live-evaluation-2026-08-21.md. The content-free aggregate proves every case observed passing, zero leakage, 100% protected-case coverage, normal completion and token bounds, clean timeout/fail-open behavior, improvement from a zero required-hit disabled baseline to a 100% best live attempt, operator-approved retention, and verified deletion. Its promotionClaimed value is therefore true.
One release operation remains before a first package release:
- run the opt-in macOS release-intent job before the first release;
Windows and Ubuntu CI passed on merged PR #3. The repository operator approved the hosted synthetic-evaluation policy, including Honcho's stated API-log and rolling encrypted-backup retention of up to 90 days. No release or publication has been attempted.
evaluation-results/latest.json keeps promotionClaimed: false because it is deterministic-local evidence only. The hosted multi-attempt aggregate is the sole artifact allowed to claim promotion after verified cleanup. Automatic recall remains opt-in; passing the evidence gate does not silently change configuration defaults.
Artifact-extension Definition of Done audit
Locally proven: exact/canonical IDs; streamed oversized ingest without whole-file buffering; Windows/POSIX component containment; session-exports authorization; symlink/junction/hard-link/non-regular/mutation rejection; project physical isolation; atomic cards/objects; quotas and concurrent writers; crash temporary recovery; cached/always SHA-256; missing/corrupt fail-closed; fresh/stale/unverifiable/not-checked states; sanitized assistant cards; actual SDK outbox reuse; outage/reconciliation/ambiguous/HMR behavior; exact and lexical local search; semantic merge and deterministic deduplication; remote fail-open and wrong-project filtering; disabled five-tool compatibility; enabled seven-tool composition; unknown argument rejection; absence of destructive/arbitrary/admin tools; lifecycle-capture exclusion; and isolated artifact-package tarball import.
The real opt-in bridge test runs against DSH 99f6f02fecdb7dff40c3fbc9470f5907c29f74ca and RLM 79b6b28e16c7305e8e791f2d8c9d2935e75ade60. A pinned Python kernel wrote 17,825,793 deterministic bytes beneath its DSH-derived session exports/, invoked only dsh_tools.call("memory_artifact_record", ...), and produced one local object/card plus one sanitized assistant projection. The kernel reported HONCHO_API_KEY absent. After disposing that host/kernel and starting a distinct session, the test found the card locally by query fingerprint and remotely as a semantic card, resolved through dsh_tools.call("memory_artifact_resolve", ...), reported fresh, matched the exact SHA-256, and printed only a 32-byte deliberate slice. The projection assertions found no artifact filename, bytes, raw query, SHA-256, source path, or credential marker.
The first real run failed before artifact dispatch with cannot get property "tools" without inject. The retained failing evidence justified the user-approved minimal RLM change: its two optional tool-adapter dispatch sites now use Cordis ctx.get('tools') and return a stable unavailable-adapter error if absent. The RLM provider regression and the unchanged artifact bridge test both pass. No DSH source change was needed.
The deterministic artifact report currently records 11/11 cases, task-success/exact-correctness/stale-warning rates of 1.0, zero leakage/isolation failures, zero integrity false-successes, 1,461 projection bytes, zero artifact bytes/source paths/raw queries sent to Honcho, and an estimated 366-token projection overhead. evaluation-results/artifact-latest.json records current-machine local/hybrid search latency and always-hash resolve latency at 1 KiB, 1 MiB, and 17,825,793 bytes. Those local wall-clock measurements are environmental, not service SLOs; rerun pnpm evaluate:artifacts to refresh them.
The deterministic report intentionally keeps promotionClaimed: false: the current command does not contact live Honcho or execute the repository's remote Windows/Ubuntu/macOS CI. Live artifact semantic processing remains opt-in, isolated, synthetic, non-destructive, and must not reuse the prior personal-free evaluation workspace without a new approved run fence. No package has been published.
Compatibility result
No DSH patch was needed. At DeepSeek Harness 99f6f02fecdb7dff40c3fbc9470f5907c29f74ca, the public Cordis Service API, committed session/event, durable root/child session header, agent/pre-step waterfall, plugin message provenance, MCP client, and ToolRuntime policy/telemetry seams were sufficient. RLM required only the approved optional-service lookup described above; its MIT boundary remains separate and no RLM code is copied into the Apache-2.0 packages.