work-charter-dsh verification

This file owns verification methods, evidence identities, results, and limitations. Documentation, static checks, local-artifact runtime evidence, and model self-report are distinct evidence classes. None of them alone establishes semantic efficacy or release acceptance.

Evidence identities

• Repository publication source: public main@f734c2a6e2b8bb8e57475365d6d165f1d4f41d5c; release-qualification commit dae0362b15dc62278f16754ec6fc7ac3c5a92aa9; and bundle-correction/release commit 09e52fd9860c6d3c8813f71f16c004f2a392c0a3 on codex/wcdp-v0.1.0-alpha.1-release. Annotated tag object d5a7bd6baf17848c6d1fed31a5b019333c32eed3 for v0.1.0-alpha.1 peels to the release commit.
• WC-UPSTREAM: installed Codex Skill receipt revalidated on 2026-08-29 as junwei529/work-charter 0.3.0; package SHA-256 7b67ea1f7073fa66ac91c36f3e39c735b54c04174e2fa3672068f8fa8948a5b2; normalized package tree 0ac3cbb0f1fa8fa51d8f832c8127eabc9863ec9e; installed SKILL.md SHA-256 c750d51940456b110bc7ed4b7d490690f42ca8ee9b555c23c8fe3d4d056b4dba.
• DSH source/build producer: task-owned clean detached checkout .verification/dsh-v0.1.2-alpha.1, official tag dsh-v0.1.2-alpha.1, commit cd5ef8148158c3a752a658978873241fdf8e2bbc.
• DSH local artifact set: 241 tarballs plus publish order under .verification/artifacts/dsh-v0.1.2-alpha.1; the complete 242-row fixed manifest SHA-256 is b8aa5da1d0fec2abd7bf581819d7638de6e859adfd60c530a466b1c7ff90b1c6. The root @deepseek-ai/dsh@0.1.2-alpha.1 tarball is 15,267 bytes with SHA-256 95d12c190d169c99db15d8958b034004489b6b43a0cb50879f885102bb18ed32.
• scdp accepted source: private session-coordinator-dsh@0.1.1-alpha.1, public contract 3, logical schema 2, clean isolated worktree .verification/scdp-dsh-v0.1.2-alpha.1, branch codex/dsh-v0.1.2-alpha.1-compat, commit 8bed40f3e18b106c69e3dadbef6f029092e73424, and public GitHub Pre-release tag v0.1.1-alpha.1.
• scdp public artifact: .verification/release-inputs/session-coordinator-dsh-v0.1.1-alpha.1-published/session-coordinator-dsh-0.1.1-alpha.1.tgz, 31 entries, 97,138 bytes, SHA-256 9575d1edf782f16b2d87b49bc27e290ecf841fa607a7d4a4468a41de2389b269, SHA-512 2cffe633734aea39989dd28d70e811536dd54aace5038b87ece3416013809fabf1394e053559e2f6c9b61c67f35ecd22a10972621cb3bdf79b097dd0bc2df2df. Compared with the older local WCDP input, its package path set and every runtime JS, declaration, source map, and package-manifest byte are identical; only CHANGELOG.md, README.md, SECURITY.md, and THIRD_PARTY_NOTICES.md changed.
• WC-DSH-PRE-REVIEW-L4: the earlier private work-charter-dsh@0.1.0-alpha.1 L4 artifact .verification/artifacts/work-charter-dsh-0.1.0-alpha.1.tgz, 34 entries, 103,088 bytes, npm SHA-1 2dbfc44ec756f65120ccec096d3b01507b778a63, SHA-256 8879ecc345b279dfa7354208c5b40884896af733e1e9170ef6143765089240a9, is retained as historical evidence and is not the release subject. The pre-L4-correction failed artifact is retained under .verification/artifacts/history/pre-l4-route-fix-d981cba5/ with its original SHA-256.
• WC-DSH-POST-REVIEW1: intermediate 36-entry package .verification/artifacts/release-prep-v0.1.0-alpha.1-post-review1/work-charter-dsh-0.1.0-alpha.1.tgz, 104,754 bytes, npm SHA-1 437f0d2121d50c1b5788b2bdc48d4d8407ddd026, SHA-256 617736b18ee4bd05117e67aca613093036f322de6063fc8a8e817e5ce91bfd28, is retained as historical evidence and is not the release subject.
• WC-DSH-RELEASE-CANDIDATE: exact private release and runtime subject work-charter-dsh@0.1.0-alpha.1 at .verification/release-readiness/final/work-charter-dsh-0.1.0-alpha.1.tgz, 39 entries, 98,593 bytes, npm SHA-1 74a13559a6acf689d941584d144ab966668a43a6, npm integrity sha512-bINQgX5EKd0eawmY/lhLJXbcQD1ygxUJTtae40D+OJlvYifS0krDUguddEkLgE3rh5WR9DXxjinuuCuQB8Mupw==, SHA-256 40b2b176ad44a5ab888f36c555ad26ac23fe87aac7ed228a75717db2ac6f711b. Its unsigned 431,377-byte provenance SHA-256 is 1f9a1123588abefedc188b053884e55ad19327a66cb6e69ad3dbbb2580e8f720; the final directory contains exactly that tarball, SHA-256 and SHA-512 sidecars, and provenance. The provenance binds 26 release-source rows, 39 package rows, the complete 242-row DSH manifest, the public scdp asset, exact pnpm shim, generated lock, and two frozen/offline producers.
• Public GitHub Pre-release: Release 379262153, tag/title v0.1.0-alpha.1 / work-charter-dsh v0.1.0-alpha.1, draft=false, prerelease=true, published at 2026-08-30T11:33:34Z. GitHub exposes exactly the accepted tarball, SHA-256 sidecar, SHA-512 sidecar, and unsigned provenance asset; all four are uploaded, and the tarball GitHub SHA-256 digest is 40b2b176ad44a5ab888f36c555ad26ac23fe87aac7ed228a75717db2ac6f711b. The tarball's package/README.md is the 52-line packaging-time snapshot and retains the then-current statements that publication and the tag/Release had not occurred; the post-release repository README is not part of, and does not replace, the checksum-qualified published bytes.
• Final clean consumer: .verification/clean-consumer-release-v0.1.0-alpha.1-r2; its 347,320-byte lockfile SHA-256 is eb3e092249d87374c1237b088bd2a880d2a9fcb2455ee95582fc88fb53ffd19e. The retained setup generator is .verification/release-readiness/setup-clean-consumer-v0.1.0-alpha.1.mjs, 6,186 bytes, SHA-256 1e228d168344420b91fc40ec49141dfb08316cf6e8eeae2f89b505a2c1ba8f11.
• DSH CLI/profile activation: task-local home .verification/dsh-profile-install-v0.1.0-alpha.1-r1; exact profile manifest profiles/wcdp-activation-r1/package.json, 571 bytes, SHA-256 5f0bce93facca22aefe1a869e40202d3268661c8a1314652efcfd014be8f8aef, records @deepseek-ai/dsh-base then work-charter-dsh. The composed config contains session-coordinator-dsh before work-charter-dsh. Actual profile boot result .verification/dsh-profile-probe-v0.1.0-alpha.1/result-activation-r1.json, 641 bytes, SHA-256 a6a6321a2953cc2f94d6e1c349ebfd41febf3268121bebfa6961a094e9b29c6c, reports scdp contract 3 / schema 2 and WCDP contract 1 / schema 1 ready.
• L4 fixture: scripts/qualify-l4-runtime.mjs, SHA-256 9d95dc673fa8b1e9cf254fb062ec69a58a1a1f4ce4ee01e17d5fc9cd857b93ba. It resolves every product/runtime import from the exact clean consumer and writes only under its isolated task-local profile.
• Final L4 run: 6e136d76-f1da-4ba4-88fe-24c182180278; result .verification/clean-consumer-release-v0.1.0-alpha.1-r2/profile-runtime/l4/6e136d76-f1da-4ba4-88fe-24c182180278/result.json, 1,175 bytes, SHA-256 13695ed7b54fbeac6d6af0c7e28e1d98bb43c4bcf7466493cb9c2bf9ba2c3d43; Charter storage SHA-256 3544b595dccd69baaa10862d8791e7ec7c97696c0e50fa6ca5d356952685ef6c; scdp storage SHA-256 24edfaf48f2096014821d2637aff4be88be0a71678a74f4e9a6ba788f8eec54e.
• Persisted L4 cross-check: scdp storage contains exactly six acknowledged deliveries and no diagnostic fallback records. The phase Result Notice uses work-charter-dsh/phase-result-notice/v1, is caused by the accepted execution disposition record, and the returning phase-disposition/v1 record is caused by that phase notice. Session logs contain 2 Orchestrator, 3 Planner, and 2 Executor model replies. Work Charter storage contains both notice ids with exact accepted dispositions returned by the Planner and Orchestrator respectively.
• Toolchain: Node v24.16.0; exact task-local pnpm 11.7.0; producer shim .verification/corepack/v1/pnpm/11.7.0/bin/pnpm.cjs SHA-256 67b035e322203961795e8e34ca63a08c37a4386eda94107fb3d28f3246d882ad; consumer native executable SHA-256 625c0ea2ef7dfd25e1042b19f92da6fd8f0a5b37f08abe4d8ff18977011ae019; TypeScript 6.0.3; tsdown 0.22.2; Vitest 4.1.8; ESLint 10.8.1; Chromium 149.0.7827.55.
• Assessor: no controlled comparison or independent semantic assessor has run.

The exact alpha.1 DSH packages and session-coordinator-dsh@0.1.1-alpha.1 return npm Registry 404. The accepted installation route below is therefore a task-local graph of the final WCDP tarball, the public scdp GitHub asset, and tarballs produced from the exact DSH checkout. A separate exact DSH CLI run installs the two GitHub-style tarballs into one profile and boots the resulting bundle. Neither result establishes normal registry-backed installation; together they establish local GitHub Pre-release qualification for this exact four-asset WCDP output.

Qualification results

Layer	Result	Evidence boundary
Exact DSH producer	PASS	Frozen exact-tag installation, official build, and release:pack completed without tracked-source drift. The official build record covered 218 files at SHA-256 d8ad3d3c39cfd2ef637d5fa978f1782da5bd61f1bf07784044c72d9996c2bcbf; 241 package archives were emitted. This qualifies the local producer only.
scdp candidate producer	PASS	Its final qualification passed build, strict typecheck, lint, and 8 files / 93 tests. The public 31-entry artifact above is the exact WCDP dependency input.
Work Charter producer	PASS	Host ESM, Typert/Remote declarations, strict Host/Client/test typechecks, lazy-CJS Client, lint, and full test suite passed at 6 files / 33 tests. WC-DSH-RELEASE-CANDIDATE is the exact producer, clean-consumer, base-runtime, browser, and L4 subject.
Release reproducibility	PASS	Two isolated producers used the same normalized source snapshot, source-bound generated lock, exact DSH/scdp inputs, attempt-local prepared store, and pnpm 11.7.0; both installs were frozen/offline and their tarballs and package manifests were identical. release:audit independently passes over 26 source maps and the retained final evidence.
DSH bundle/profile activation	PASS	Exact DSH dsh plugin with pnpm 11.7.0 installs the published scdp tarball as a plain profile dependency and the final WCDP tarball as a bundle layer. The profile manifest records WCDP, the composed config orders scdp before WCDP, and a real custom-profile boot returns both Host health contracts before requesting normal exit.
Clean installed identity	PASS	The fresh consumer has 81 local artifact dependencies: 79 distinct @deepseek-ai/dsh-* packages, scdp, and Work Charter. Every DSH package is 0.1.2-alpha.1; Cordis 4.0.1, React 18.3.1, scdp 0.1.1-alpha.1, and Work Charter 0.1.0-alpha.1 each resolve to one installed path.
Clean package/type consumer	PASS	Strict NodeNext no-emit typecheck with skipLibCheck: false resolves public Host, Client, Remote, and type exports from packed artifacts. The Work Charter Remote declaration has exactly four read-only operations: health, Charter get/list, and per-Session list; no mutation alias is exposed.
Real Loader and Host policy	PASS	Actual Cordis Loader mounts both packages, reports Work Charter health contract 1 / storage schema 1 / scdp contract 3, creates a Workstream Charter over three real DSH Sessions, and registers the DSH Skill plus five model tools. Model-tool actor identity comes from the executing DSH Agent, while browser Remotes are read-only. Runtime evidence covers unauthorized-role, stale-revision, and post-close disposition rejection; unit coverage additionally proves open-decision rejection, current-member validation, unique checkpoint-per-route submission, serialized route disposition, correction-aware accepted close, and latest-execution gating for Standard phase advancement.
scdp coordination	PASS	Result Notice and causally linked disposition are accepted through the public scdp service, both deliveries reach delivered, membership survives restart, replay is idempotent, and a conflicting immutable record is rejected. Unit coverage separately preserves UNKNOWN for ambiguous storage/delivery recovery.
Persistence/restart/recovery	PASS	JSON storage persists and reopens a closed accepted Charter; Workstream membership and Session-to-Charter mapping survive application restart. Loader remove/reload withdraws and restores the Host, Typert, Client, Skill, and tool contributions without rewriting ready storage. Final-artifact run a6fe68de-71a7-41d9-b74c-61fd2801719c exercised atomic accepted-close writer release and produced Charter SHA-256 5f10baeabd11110b2bd3912c50287e84417ed3e541366c98cb22f04dbabf9b06 and coordination SHA-256 ee73becc0bca8b3f311faabd758443f43c42316544dbcf2a0d48039216dda3c8.
Logged model context	PASS	A keyless scripted LLM exercises the real DSH Agent loop. The DSH Session log contains active and paused Work Charter runtime snapshots plus the inactive clear marker; a restarted Agent recovers exactly that history and emits no redundant closed-state snapshot.
Standard O/P/E L4	PASS	The final run created one active standard-ope Charter and three distinct real DSH O/P/E AgentLoops. O→P Mandate, P→E Definition, E→P execution Result Notice, P→E execution disposition, P→O phase Result Notice, and O→P phase disposition all used the Work Charter/scdp path, reached durable acknowledged state, and were consumed by the target role model. The Host requires accepted execution assessment before P→O and preserves both causal record links. No raw-scdp fallback ran or counted.
Browser Client	PASS	Real headless Chromium resolves both published lazy-CJS Client bundles and both generated Remotes. WC 1, the global action, per-Session action, and Host-authoritative read-only overlay render; Work Charter dispose/reload preserves scdp, root/sidebar owners, and six native ownership sentinels, leaves zero in-flight requests, and reports no console/page error. Unit coverage proves the Work Charter Remote surface has no mutation endpoint and that an exact Workstream Charter focus cannot fall back to an unrelated global Charter. Final-artifact screenshot: .verification/clean-consumer-release-v0.1.0-alpha.1-r2/output/playwright/work-charter-dsh-coexistence.png, 44,547 bytes, SHA-256 5f9b5c6d18ac57e481ab6939694fe8c1c24ddf4866a2c2131674d09ceec7ed4d.
Source/checkout integrity	PASS	Exact DSH and accepted scdp checkouts remain clean; root diff checks pass apart from Git's informational LF-to-CRLF checkout advisories. The intended root bundle-correction subject is exactly eight paths; ignored verification inputs, producers, consumers, caches, and outputs are not part of it.
Controlled comparison	NOT RUN	No predeclared upstream-baseline/candidate cases have been executed with equivalent non-product context.
Independent semantic assessment	NOT RUN	Role separation in the deterministic runtime fixture tests Host acceptance rules; it is not an independent judgment of Work Charter quality or efficacy.

Reproducible local checks

The source-contract check remains:

npm.cmd run verify:dsh-source -- .verification\dsh-v0.1.2-alpha.1 .verification\scdp-dsh-v0.1.2-alpha.1

The Work Charter producer checks are:

npm.cmd run build
npm.cmd run typecheck
npm.cmd run lint
npm.cmd test
npm.cmd run release:reproduce
npm.cmd run release:audit

The isolated scdp producer used its build, typecheck, lint, test, reproduce, audit, and source-verifier routes from .verification\scdp-dsh-v0.1.2-alpha.1. WCDP does not rewrite that repository's tracked historical lock; its own provenance binds the exact public scdp tarball and uses a generated relative-path lock as producer evidence.

The retained DSH CLI/profile activation used the exact built DSH launcher, final scdp/WCDP tarballs, pnpm 11.7.0, and an ignored one-shot health probe:

$taskPnpm = (Resolve-Path .verification\runtime-tools\pnpm-11.7.0).Path
$env:Path = "$taskPnpm;$env:Path"
$env:DSH_HOME = (Resolve-Path .verification\dsh-profile-install-v0.1.0-alpha.1-r1).Path
$env:DSH_TELEMETRY_DISABLED = '1'
$dshBin = (Resolve-Path .verification\dsh-v0.1.2-alpha.1\apps\cli\lib\bin.js).Path
node $dshBin plugin --profile wcdp-activation-r1 add `
  (Resolve-Path .verification\release-inputs\session-coordinator-dsh-v0.1.1-alpha.1-published\session-coordinator-dsh-0.1.1-alpha.1.tgz).Path `
  (Resolve-Path .verification\release-readiness\final\work-charter-dsh-0.1.0-alpha.1.tgz).Path `
  --offline --ignore-scripts --store-dir (Resolve-Path .verification\pnpm-store).Path
node $dshBin --profile wcdp-activation-r1 --dump-default-config
$env:WCDP_PROFILE_PROBE_RESULT = (Resolve-Path .verification\dsh-profile-probe-v0.1.0-alpha.1).Path + '\result-activation-r1.json'
node $dshBin --profile wcdp-activation-r1 --patch .verification\dsh-profile-probe-v0.1.0-alpha.1\probe.patch.yml

The manifest and config dump establish DSH's bundle activation decision and row order; the final probe process establishes that an actual composed profile reached both mounted Host health contracts. The ignored probe path is exact-host evidence, not a distributed package file.

The final clean-consumer checks used .verification/clean-consumer-release-v0.1.0-alpha.1-r2. To reproduce them, select a fresh task-owned suffix (for example r3), then run:

node .verification\release-readiness\setup-clean-consumer-v0.1.0-alpha.1.mjs .verification\clean-consumer-release-v0.1.0-alpha.1-r3
Push-Location .verification\clean-consumer-release-v0.1.0-alpha.1-r3
try {
node ..\corepack\v1\pnpm\11.7.0\bin\pnpm.cjs install --offline --frozen-lockfile --ignore-scripts --no-runtime --trust-lockfile --store-dir ..\pnpm-store
node package-identity.mjs
npm.cmd run typecheck
node runtime-qualification.mjs
npm.cmd run build:browser
node browser\browser-smoke.mjs
} finally {
  Pop-Location
}

runtime-qualification.mjs allocates a fresh run directory by default so repeated executions do not reuse a prior Charter or storage subject. browser-smoke.mjs likewise uses an isolated profile and stores screenshots only under output/playwright/.

The dedicated L4 check is run from the repository root against that exact clean consumer:

node scripts\qualify-l4-runtime.mjs .verification\clean-consumer-release-v0.1.0-alpha.1-r2

The final candidate exits 0 with structured result PASS / L4_STANDARD_OPE. The fixture writes its exact JSON result beneath profile-runtime/l4/<run-id>/result.json. PASS requires all six Standard role messages to use the Work Charter/scdp path, reach durable acknowledged state, and be consumed by the target AgentLoop; the raw scdp diagnostic fallback is available only for a rejected phase route, is reported separately, and never counts as PASS.

Corrections discovered by qualification

• The Work Charter Typert generator originally mirrored too little of the public scdp declaration surface. It now mirrors only scdp's public index, types, and storage declarations and maps the public package root; no implementation internal is imported.
• The packed Work Charter Client declaration originally exposed a DSH-augmented PropsRuntime alias whose augmentation imports were removed by declaration emission. A truly clean consumer resolved that alias to never. Public component prop aliases now use the explicit structural props actually consumed by the components.
• The alpha.1 scdp candidate uses the split Session Controller, Client Store, and UI Renderer public faces, normalizes Windows CRLF-sensitive fixture assertions, and updates the browser/Loader composition fixtures. Public contract 3, logical schema 2, Host semantics, storage identity, and published service shape remain unchanged.
• The browser qualification fixture initially registered an undeclared child Slot and then served unauthenticated /api requests through the SPA fallback. The fixture now declares the parent-child Slot relation and supplies the browser-auth credential seam, authenticated launch URL, and authorized index flow. These were fixture defects, not accepted product failures.
• After the DSH checkout gained its exact installed graph, the source verifier's recursive directory read descended into package-local node_modules and stopped making bounded progress. Its package index now walks source directories explicitly and skips node_modules; the corrected check completes with the same source-contract result.
• The first L4 fixture preflight selected the newer Work Charter runtime-context snapshot instead of the triggering user/relay message, and a later diagnostic fallback used nonexistent scdp kind result instead of public kind outcome. Both were fixture defects corrected before the pre-correction product run; neither was treated as the final L4 result. That corrected run then isolated the Host policy failure subsequently fixed below.
• The isolated product failure was a real Standard hierarchy gap: Result Notice submission admitted only the Executor writer. The correction adds only the assigned Planner→Orchestrator phase route after an accepted Executor result, binds it to the accepted execution disposition, and emits distinct phase notice/disposition schemas. Two intermediate packed probes exposed the missing forward and return schemas before the final exact artifact passed the full chain.
• Native review found three fail-closed gaps before release: a consumed one-shot evidence record could be rewritten while reusing its consumed timestamp, accepted close could be attempted directly from draft, and pending one-shot evidence could carry consumedAt. The Host now preserves the entire consumed evidence record, requires active state for accepted close, rejects pending evidence with consumption metadata, and covers all three paths in the 17-test suite before exact-candidate runtime, browser, and L4 requalification.
• The next completed native review found that paused-state validation prevented durable revoked/unknown authority, active writer release could strand a Charter without a reassignable writer, and a per-Session action could select an unrelated global Charter instead of its applicable Workstream Charter. Paused Charters now preserve non-approved authority while resume stays fail-closed; active Charters retain their writer until accepted close atomically releases it; and the Session action carries the exact applicable Charter id into overlay selection. The 21-test suite covers the three corrections.
• The first base-runtime run against the post-review2 package stopped because its copied fixture still performed the obsolete active writer-release step. The fresh consumer fixture was corrected to exercise atomic accepted close, and only the subsequent PASS run 06022436-c996-4d7a-a043-2f42a6fa33b8 is accepted evidence; no product change was made for that fixture-contract drift.
• The third completed native review found that browser Remote mutation calls accepted a caller-supplied actor Session id and that a pending disposition could mutate a closed Charter. The browser Remote is now strictly read-only; Host/model tools retain mutation and model tools derive actor identity from the executing DSH Agent. Closed Charters reject disposition before target resolution or scdp writes. The 23-test suite locks both corrections.
• The first post-review3 clean-consumer type and base-runtime checks stopped because copied fixtures still required the removed mutation Remote aliases. The fixtures were narrowed to the exact four-method read-only contract; only the subsequent typecheck and run c78ca3d1-3a3c-4fc6-8eb8-878c558800f9 are accepted evidence. No product change was made for that fixture-contract drift.
• The fourth completed native review found that an active Charter could dispatch a new Result Notice while a material decision remained open. Submission now fails with OPEN_DECISION before route resolution or scdp writes; the DSH Skill, model-tool description, and product contract state the same boundary. The 24-test suite proves zero transport writes and no Charter revision change on rejection.
• A code-only post-review4 pack was superseded before that correction's closeout so the model-visible Skill/tool wording could carry the same open-decision boundary. The resulting post-review4-final package and run 2e27d8e1-4165-45cc-87ab-238e116d02f6 are retained as historical evidence and are not the current release subject.
• The fifth completed native review found that a Planner or Executor detached from the Workstream after activation retained transition authority. Every Workstream-target transition now reopens current scdp membership for the actor before policy mutation, and lookup failure fails closed; two regression tests cover detached Planner/Executor attempts and unavailable membership state. The 26-test suite and exact post-review5-final producer, clean consumer, base runtime, browser, and L4 reruns all pass.
• The sixth completed native review found no author-fixable issue and independently passed typecheck, lint, 26 tests, pack dry-run, source-contract verification, and diff checks. A subsequent staged-diff check exposed eight new files with a blank line after their valid EOF; those non-semantic whitespace defects were removed before the next review.
• The seventh completed native review found two P1 acceptance-chain gaps: a correction-required Result Notice did not block accepted close, and a new notice id could duplicate the same checkpoint while an older accepted execution result could still authorize Standard phase advancement. The Host now serializes each semantic route, permits only one notice per route/checkpoint, requires the latest result on every used route for accepted close, and requires the latest Executor result for Standard phase advancement. A later accepted distinct checkpoint can supersede an earlier non-accepted result without erasing history. Four focused regression paths raised the suite to 28 tests, and the exact post-review7-final producer, clean consumer, base runtime, browser, and L4 reruns pass.
• Release preparation first attempted an empty task-local pnpm metadata cache, then an authorized task-local metadata fetch; the latter reached the unpublished DSH package boundary and returned Registry 404. Neither attempt produced accepted evidence. The final route deterministically normalizes the already verified installed virtual-store lock, replaces only the public scdp tarball integrity, validates all 78 DSH overrides, prepares an attempt-local store from the prequalified store, and runs both producers frozen/offline. A test-fixture newline error, one SHA-512 validator bug, and lint-only callback style findings were corrected before the final PASS.
• Release-qualification native review found that final-evidence locking originally began only after both producers finished and that STATUS prospectively declared an uncreated commit complete. The same fail-closed lock now encloses the complete reproduction and final-verification window, release:audit encloses its complete current-build/final-evidence inspection, concurrency tests exercise both reproduction and inspection exclusion, and STATUS uses Git-bound pending/completed language.
• Publication preflight found that the packed candidate declared only dsh.client; DSH therefore installed it as a plain dependency and never activated a profile layer. The correction adds the exact dsh.bundle.patch declaration and packaged cordis.patch.yml, audits their bytes and ordering, and documents the two-tarball profile route.
• The first profile health probe used headless --help, whose app exited before the later overlay probe mounted. That attempt established only composed order and help, not Host health. A fresh custom base-backed profile then mounted scdp, WCDP, and a one-shot probe; only its dual-health PASS is accepted activation evidence.
• The clean-consumer setup generator rejected the changed WCDP SHA-256 before creating r2. Its checksum lock was updated to the new final artifact, after which a fresh frozen/offline consumer, base runtime, browser, and L4 run all passed. The rejection is a fixture identity guard, not a product failure.

Limitations and open evidence

• The local artifact graph is not evidence that a user can install the package from npm. The DSH/scdp alpha packages are unpublished and both candidates remain private.
• WCDP now has a completed local two-producer result on a generated source-bound lock with relative artifact paths. Its provenance is intentionally unsigned and local; it is not an identity signature, public attestation service result, npm publication proof, or compatibility claim beyond the exact bound graph.
• Repository documentation can correct current release status after publication, but it cannot retroactively update the README embedded in the checksum-qualified GitHub asset. The recorded checksum—not the asset name or URL alone—identifies the accepted bytes, and that packaging-time document snapshot must remain distinct from later source-document commits.
• The browser test uses real DSH SlotRegistry, Remotes, Loader, React, and Chromium, but the goal/plan/workflow/approval/Conversation/Trajectory fixtures are ownership sentinels. It proves non-replacement and additive composition, not the complete native semantics of those six features.
• The DSH package @deepseek-ai/dsh-client-ui-primitives declares a missing lib/index.js.map; Vite reports the missing map while transformation and all relevant tests pass. This is retained as an upstream packaging warning and was not repaired in the clean DSH checkout.
• Initial restricted-network installs emitted pnpm version-metadata/supply-chain fetch warnings. The task-local graph and final evidence commands completed; @tsdown/css@0.22.2 was added only to the ignored browser-evidence consumer after the authorized network retry, not to either product package.
• MIT is selected for work-charter-dsh, with the full grant included in the root and packed artifact. The Client source map identifies only Zod 4.4.3 under node_modules; its installed MIT text and copyright are included in THIRD_PARTY_NOTICES.md. At release-qualification evidence capture there was no WCDP push, tag, GitHub Release, npm publication, global installation, or global configuration change; those effects require their recorded gates.
• Compatibility with later DSH versions, Node 22, other storage providers, multi-process/cross-host coordination, full native-feature browser flows, causal efficacy, trigger quality, token savings, and production support remains UNKNOWN.
• The keyless L4 role adapters prove real DSH AgentLoop invocation, role-specific context, Host route/sequence enforcement, message visibility, causal records, and durable transport. They do not prove natural-language model quality, broad Work Charter efficacy, or independent semantic judgment.

Evaluation isolation rules

• External governance may govern development but must not be injected into baseline/candidate model context.
• Upstream baseline and candidate require separate immutable identities even when they express similar text.
• Candidate self-report cannot establish activation, compliance, efficacy, compatibility, or acceptance.
• A failed transport, unavailable dependency, or invalid fixture yields the corresponding infrastructure result and leaves unobserved product behavior UNKNOWN.
• Repeating or replacing a bounded evaluation attempt requires its governing authority; a rename or new Session does not erase consumption.

Evidence rules

• Record exact source, build artifact, installed copy, DSH ref, scdp version, configuration, command, result, and assessor.
• Record Node, pnpm, TypeScript, bundler, Host module format, Client factory format, and peer resolution used by evidence.
• Separate source/static checks from local-artifact runtime behavior, transcript evidence, controlled evaluation, and release proof.
• Preserve UNKNOWN for missing, stale, interrupted, sandbox-blocked, leaked, or identity-ambiguous evidence.
• Do not claim cross-Harness parity, causal efficacy, token savings, broad trigger accuracy, public installability, or release readiness without dedicated accepted evidence.