v0.15.1 — reconcile the context-diet wave with the code, and fix the Docker release recipe

v0.15.1 — reconcile the context-diet wave with the code, and fix the Docker release recipe

Patch release over v0.15.0. The context-diet wave shipped correct prompts but several wrong statements about what the code does. A full review of its 12 commits, plus a real-machine Docker run, found them; this release aligns every live statement with the code and fixes two release-process defects.

Fixed — model routing (the statement was backwards). An official spawn_teammate teammate runs on the route of the session that staged it — the captain's in a top-level spawn, the Lead's in a team-lead spawn — and mpd-roster-provider-plugin applies a roster member's teamModels slot ONLY when the teammate's description NAMES that member. AGENTS.md §13, agent-references/glossary.md, docs/design and docs/user-guide (English and 简体中文), the roster-provider/adapter/roles READMEs, the rendered roster-section text in mpd-roles-plugin, the adapter docblock and three skills (review-work, ulw-execute, ulw-research) said the opposite; all are corrected against routeFor / applyRoute (identity pass-through) and its tests.

Fixed — the team record. "NO mpd surface reads dsh.teamLiveTeams() any more" was false at three fallback call sites. The MPD team record is authoritative on every surface; the official call remains only the contained fallback for a composition that runs the official executor.

Fixed — the verifier's envelope. The mpd_verify_* descriptions, READMEs and code comments no longer claim the envelope is mechanically enforced or that blindness is "proven" by an observation log. Blindness is DECLARED, never observed (verifyGate is absent); an unproven basis is UNVERIFIED. The refusal rules that are true — no cited documents, forged evidence id, same-agent verifier — remain.

Fixed — workmate injection. Only the one-shot mpd_workmate_spawn carries the persona automatically; a TEAM member is given the persona by the caller in the staged prompt. Tool description, source comment and README pair agree.

Fixed — the Docker release recipe could never pass as written. AGENTS.md §11 documented credential-free commands that the driver turns into exit 3 by design (ui.replyRendered is a declared bound without --live). The recipe now runs both modes with --live and DEEPSEEK_API_KEY exported, states that --live without a key is a hard exit 3 BEFORE the build, and names --no-browser as the credential-free variant that is NOT release evidence. docker/README(.zh-CN) lists all three exit-3 causes and the declared-bound set; agent-references/verification-flow.md names the credential prerequisite behind the ui. required prefix.

Changed — the facts the manual asserts. verify:gates is documented with its nine members; the JavaScript inventory is re-measured at 57 files (33 packages/*/dist/** artifacts + 2 browser bundles + 22 vendored skill-corpus files), replacing the stale "32" and the deleted mpd-agent-teams-plugin path; the node-pty sentence states the measured 0.24.1 fact; the T-21…T-55 evidence bound is narrowed to what is actually pinned; the release sweep separates verify-no-host-override (every sweep) from verify-manual-paths (when AGENTS.md changed); the sweep command is bun test packages, because a repo-root bun test also scans the historical evidence/** fixtures.

Fixed — hygiene. docker/ui/out/readme/ (14 duplicate capture PNGs) is gitignored; the PR template carries the ## English / ## 简体中文 sections AGENTS §5 requires; the .coderabbit.yaml comment agrees with the binding CodeRabbit-completion merge gate without changing any setting.

Verification. An independent verifier failed the wave on three shipped-text defects, a repair lane fixed them, and a round-2 verdict passed every criterion (evidence/verification/context-diet-reconcile/2026-10-21T02-50-59Z, …/2026-10-21T03-03-10Z). The rootless real-machine Docker lane (--mode source --require-docker --live) ran a real model turn on all three planes: 117 passed / 0 failed / 5 declared NULL, exit 0 (evidence/docker/client-install/2026-10-21T02-50-28Z); the same lane caught a stale local pack (4 drifted files), which the branch re-packs and re-closes (609/609 identical). Released CHANGELOG entries (v0.10.0 / v0.11.0) keep their historical wording as history.

v0.15.0 — the guard split: delegation guards, a mechanical session gate, and a refreshed UI

v0.15.0 — the guard split: reconnaissance and delegation delegated again, a mechanical session gate, a stateless TUI panel, and the cordis-dev skill

Minor release over v0.14.0, and a behaviourally BREAKING one for the mpd preset's top-level
session. The 2026-10-17 wave restored the long persona prompt but withdrew all three mechanical guards
with it; the 2026-10-20 ruling splits that bundle: the two DECISIONAL guards come back
(captain.investigation, delegation.gate), the session-start gate ships mechanical again, and the
verification law's write guard (verify.mode) STAYS withdrawn — the captain writes code directly while a
DIFFERENT agent records the verdict. The same release fixes a seeded-fork qualification defect in that
gate, hardens the investigation guard's error boundary, makes the TUI sidebar deployment stateless on
dsh-tui ≥ 0.16.1 with a panel attention badge, and teaches the cordis-dev skill to load itself. Frozen
contracts: .mpd/plans/restore-guard-discipline.md and .mpd/plans/release-v0.15.0.md.

English

Breaking / host adaptation

• The mpd preset's top-level session delegates reconnaissance again. read / grep / glob on a
  SOURCE path are refused; the documentation band stays readable. The knob is
  captain.investigation — deny (default) or allow; allow restores full access.
• The generic spawn tools are refused again. subagent, subagent_fork and workflow are denied
  with the sanctioned routes named (mpd_role_spawn, the workmate library, Agent Teams). The knob is
  delegation.gate — deny (default), captain or allow. The gate is preset-scoped: a top-level
  session of another preset — the deployment default cordis included — is released, while the mpd
  captain and every member/child session stay covered whatever preset they run.
• team.gate ships mechanical again. On a trigger the session-start complexity gate stages a
  0-member / 0-task approvable plan shell; nothing is spawned until the captain extends and approves
  it. advisory and off stage nothing, and the mpd-roles row's gate: "off" pin is gone so the code
  default governs.
• Writes stay direct. write / edit / bash are NOT gated and no loop needs to be armed; the
  verification law's write guard (verify.mode) remains withdrawn. The boot line reads
  captainInvestigation=deny delegationGate=deny … sessionGate=mechanical and
  verifyGate=absent reason=withdrawn:2026-10-17-user-ruling(verify.mode) — a mode is never reported for
  a withdrawn guard.
• dsh-tui ≥ 0.16.1 owns the sidebar enable list, so the bundle's enable keeper goes READ-ONLY there:
  it cancels its ladder, installs no feed and no belt, and writes no config — not even the stale-default
  migration. On 0.15.x the keeper joins the host's self-heal and keeps exactly that one write; below
  0.15 the feed-first keeper is unchanged. There is no state migration on upgrade.

Added

• The TUI panel's attention badge and one auto-open, published from apply. dsh-tui mounts a plugin
  panel only while it is the active page, so the badge is set from the row's apply path through
  tuiPanels.badge and reflects only the displayed team's watchdog holds. The first publish after
  arming includes the empty case, which clears a stale badge. The auto-open fires at most once per
  process, on the NOT-LIVE → LIVE edge of a team — booting into a workspace that already has a team
  never steals the sidebar — retries a host refusal on the next state change, shares its one-shot latch
  across panel-seam re-binds, and is governed by the new panelAutoOpen row knob (default true).
• cordis-dev loads itself on detection. Its front-matter description leads with the auto-load rule
  and a "Load on detection" section states every signal (cordis.patch.yml or presets/*.patch.yml, a
  manifest carrying dsh.bundle / dsh.client, dsh-plugin.json, a packages/*/src/index.ts exporting
  apply, an extensions/* manifest, mpd.jsonc / .mpd/plans/**), the presence-only check, and the
  negative case (no signal means skip it and say so). Detection parses manifests for a real
  dsh.bundle / dsh.client entry, so a project that merely depends on a package named dsh no longer
  matches. A PROJECT SHAPE persona paragraph tells the captain to load the skill before the first edit,
  gate run or diagnosis.
• /mpd status reports the panel deployment: the host-assigned panel ids, the seam state and the
  keeper's verdict — the <pluginId> half of a panel id is the one fact no document can derive.

Changed

• Version carriers: package.json, dsh-plugin.json and dsh-distribution.json carry 0.15.0;
  the distribution descriptor's six component refs move from @0.12.0 to @0.15.0; the
  x-mpd-tui-surfaces disclosure names the bundle package at 0.15.0 (the separate @mpd-dsh/mpd-tui
  package keeps its own 0.1.0).
• Documentation and UI refresh. The README pair carries the 0.15.0 badge and current-release line and
  names cordis-dev in the capability list; the user-guide pair documents the restored guards and the
  delegation gate's preset scope, corrects "seven write tools" to eight, names tuiPanels as the
  primary Agent Teams surface, and covers the attention badge, panelAutoOpen and the stateless
  deployment; the tui.md pair's preamble target is rewritten to dsh-tui 0.16.1 pointing at §11.8
  (the 0.14.0 narrative is kept as history, never bare-swapped); the design pair drops mode: hard from
  the mpd-verify column while keeping every mpd-tools writeGuard mention. Documentation images and
  the three hand-authored SVGs are refreshed by the release's UI-refresh lane.

Fixed

• The session-start gate qualifies a seeded fork correctly. sessionQualifies now composes
  sessionRank, so a seeded-fork top-level session receives the mechanical gate and origin/depth
  children do not; the previous preset-name heuristic misclassified the fork (T-92). Unit and QA
  contract arms cover all four cases.
• The investigation guard's error boundary. An internal error in the guard passes the call through
  with one warning instead of failing an unrelated tool call.
• The no-id staging path is self-consistent. The mechanical notice now says the staged shell cannot
  be approved and tells the captain not to try, instead of contradicting itself; the QA case's plan-id
  parser accepts the current plan-<17 digits>-<4-char tag>-<3-char counter> format (it had parsed the
  previous 14-digit form and gone blind), and session-gate.ts emits a row warning when
  staged && planId === "", so a staging call that produced no id cannot read as healthy.
• The Web DAG node legend is ASCII under zh-CN. The node draws REQ|WRK|REV|FIX|INT
  (dag-edges-scroll §F1) instead of the localized kind chip; the task-detail body and every title
  keep the localized kind and the verbatim subject. The zh-CN capture goes 17/18 → 18/18.
• The attention badge is truthful. It counts only the displayed team's watchdog holds and publishes
  once on arm (including the empty case) to clear a stale badge.
• QA and evidence repairs from the v0.15.0 audit. bundle-lifecycle pins XDG_RUNTIME_DIR and the
  npm caches inside its sandbox and repairs three stale assertions; the delegation-gate live arm proves
  delegationGate=allow on its released side and pins agentPreset=none, so a release cannot be
  confused with a missing guard; a mechanical-default side seeds no team.gate and asserts
  sessionGate=mechanical plus the full staging contract, with the key's absence proved rather than
  assumed; the boulder claim cites current green evidence; the Docker TUI lane pins
  panelAutoOpen: false in its profile's user layer so its pre-key control capture measures what it
  claims.

Install / upgrade

The host baseline is unchanged from v0.14.0: DeepSeek Harness 0.2.1-rc.2 and dsh-tui 0.16.1.
From a checkout:

dsh plugin --profile web add .
# or the terminal surface
dsh plugin --profile dsh-tui add .

Against the published artifact (after the release is public):

dsh plugin --profile web add github:HaroldZ32/My-Power-Dsh
# or, once npm has the version: dsh plugin --profile web add @mpd-dsh/mpd

Nothing in .mpd/ changes shape. If you relied on the v0.14.0 withdrawal, the two opt-outs are
captain.investigation: "allow" and delegation.gate: "allow" in mpd.jsonc; the team.gate values are
mechanical, advisory and off.

Release verification

The release sweep ran on release/v0.15.0 with the pinned toolchain (bun 1.4.0, node v24.21.0); per-gate
logs are under gates/ and the full grading is in REPORT.md. Observed:

Gate	Result
Static aggregate	PASS — 9/9 member gates
Unit tests	PASS — 2161 pass / 3 skip / 0 fail, 2164 tests / 134 files
Typecheck	PASS — tsgo --noEmit
Doc pairs	PASS — 48 pairs, 438 links, 0 dead
Manifest / comments / rows / vendor / dist	PASS — 0.15.0 carriers, 426 commented files, 35 rows, 7 assets, 32/32 dist
Boot lanes	PASS — bundle lifecycle, preset conformance (agentPreset=mpd), verify-law
Live cases	PASS — delegation-gate, captain-scope, mcp-call; dual-track official PASS, gateway NO_ADAPTER (host bound)
Pack + closure	PASS — 608/608 files, 0 drift
Docker source (--live)	PASS — 117 passed / 0 failed / 5 declared NULL
Docker one-click (--live)	PASS — 116 passed / 0 failed / 6 declared NULL (local checkout stand-in; the live default-branch spec is a post-publish step)

The gateway (non-official) DeepSeek track cannot run on this host (NO_ADAPTER); the official track and
the Docker live rows reach a model. The full sweep, its evidence paths and every bound are in
REPORT.md.

简体中文

较 ...

v0.14.0 — DeepSeek Harness 0.2.1-rc.2 + dsh-tui 0.16.1, one shared plan→graph model, and a real-team acceptance lane

v0.14.0 — DeepSeek Harness 0.2.1-rc.2 + dsh-tui 0.16.1, one shared plan→graph model, and a real-team acceptance lane

Minor release over v0.13.2, and a BREAKING one. The bundle now targets DeepSeek Harness
0.2.1-rc.2 and dsh-tui 0.16.1; the plan→graph model is computed once in the host plane and drawn
by both surfaces; and the 2026-10-10/11 guard ceremony is withdrawn, so the top-level agent holds its
tool pack directly again. A real two-member team now builds and tests a small project through the Web
composer and the TUI PTY in the Docker acceptance lane.

English

Breaking / host adaptation

• DeepSeek Harness 0.2.1-rc.2. startContinuable() / start() are removed; the adapter rebuilds
  the native team executor and the spawn path on startActivation() + waitForChildren(), with
  delivery as a required spec field and result.output read as ContentBlock[]. webRuntime became
  webApp, so the sidebar row probes both names and self-disables with a printed reason when neither
  carries trustedHosts.
• dsh-tui 0.16.1. 0.16.1 is the harness-0.2.1 release: all 36 @deepseek-ai/dsh-* peers admit
  0.2.1-rc.2. A declaration-level comparison against 0.15.0 found nothing breaking for the adapter
  (same fifteen tui* seams, same six shapes, close(): void + active.id, tuiPanels unchanged,
  tuiPrompt still a phantom), so the pins were the whole change. dsh-plugin.json's stale
  compat.hosts moved with them.
• Preset / row parity follows the 0.2.1 standard preset: time-context, tool-schedule and the
  disabled tool-plugin-manager / tool-plugin-market are in; tool-ralph,
  tool-subagent-codex and tool-subagent-claude-code are out; backgroundMode and
  maxPendingMessagesPerMember are gone from the rows that no longer declare them.
• The 2026-10-10/11 guard ceremony is withdrawn. The top-level mpd agent holds read, write,
  edit, bash, grep, glob and subagent directly again, steered by the persona prompt. The
  roster's eight-name read-only deny and the ask_user_question schema backstop REMAIN installed; the
  roster, team, verify, memory, boulder and ULW surfaces stay shipped and callable. team.gate
  defaults to off. The boot line reports each withdrawn guard as absent with its reason.
• Honest consequence: the mechanical single-git-writer denial for member sessions is gone too. That
  rule is prose from this release on; its enforcement is the dispatch contract (members edit files and
  run gates, the captain commits) plus review.

Added

• One shared plan→graph model (packages/mpd-graph-core). One tolerant plan parser, one
  board+plan merge with its six-case report, one rank derivation (moved verbatim out of the TUI) and
  one debounced watcher. The host plane computes buildModel({ board, plan }) once per team and
  publishes it on mpdTeams.graph(...) and the /plugins/mpd-team/state payload (model +
  tasks[].rank, additive); the web client derives nothing and the TUI renders the same model.
  Plan-only nodes are drawn as ghosts (planned: true, visual: "planned") and plan-only edges are
  drawn too. New gate: bun run verify:graph (--self-test 8/8, --seed-wrong-edge negative
  control).
• A real-team acceptance lane. MPD_E2E_TEAM_PROJECT=1 drives a real two-member team through the
  Web composer and the TUI PTY: stage a two-task plan (T2 blocked by T1), approve, dispatch, wait,
  re-dispatch, close both rows while the members write and test team-project-web/ /
  team-project-tui/. docker/lib/team-project-verdict.ts reads the verdict from the record and the
  artifacts (members raised, a resolvable dependency edge, credited completions, files written during
  the step, the team's own test and a verifier-owned sum(2, 3) === 5 assertion) and ships a 10-arm
  --self-test.

Fixed

• The team web routes resolve the workspace from the SESSION the request names (new
  workspaceRootForSession) instead of the dsh process cwd, so the panel no longer says “No team in
  this workspace yet” beside a completed board.
• A task claimed under a member's EXECUTOR HANDLE is credited to that member everywhere (core progress,
  dispatch idle pool, TUI projection); member cards no longer read 0/0.
• A nested failure line no longer ends the reply wait while the lead keeps working; a headless live
  turn after approve is bounded instead of hanging while a teammate stays alive.
• Docker live rows: skipped rows are separated from a refused run, the credential-free WEB check is
  scoped to the non-live reason, and real WEB / TUI turns are graded for prompt-variable failures.
• The packer ships packages/mpd-graph-core/dist, closing the pack-closure gap.

Install / upgrade

Upgrade the host first: DeepSeek Harness 0.2.1-rc.2 and dsh-tui 0.16.1. Then, from a checkout:

dsh plugin --profile web add .

or against the published artifact (after the release is public):

dsh plugin --profile web add github:HaroldZ32/My-Power-Dsh
# or, once npm has the version: dsh plugin --profile web add @mpd-dsh/mpd

Verified by the release sweep

Gate	Result
verify:vendor	PASS — 7 shipped assets fingerprinted
verify:rows	PASS — 35 row ids
verify:docs	PASS — 48 pairs, 438 links, 0 dead
verify:manifest --pack	PASS — 1009 packed files, every required path present
verify:comments	PASS — 424 files, 37,359 declarations
verify:graph	PASS — nodes/edges/ranks/cycles equal the declared input
verify:no-host-override	PASS — 0 of 0 collisions with 213 host row ids
verify:manual-paths	PASS — 166 resolved, declared/anticipatory class counted apart
verify-dist-fresh	PASS — 32/32 targets fresh, each rebuilt twice byte-identical
verify:gates aggregate	PASS — 9/9 member gates green
typecheck (tsgo)	exit 0
bun test packages	2,129 pass / 0 fail — 2,132 tests across 133 files
test:qa	PASS — every case, plus mpd-ext --self-test (53 checks) and validate
preset-conformance --self-test	PASS — 32 harness rows, 29 preset child rows, 27/27 parity, 4/4 negative controls
pack + verify-pack-closure (twice)	PASS — 608/608 content files identical, 0 drift, 0 expected-after-pack
dual-track-smoke	official track PASS; gateway track cannot run on this host (NO_ADAPTER for provider deepseek, identical to the v0.13.2 evidence — the host carries no dsh-llm-pi-ai adapter)
mcp-call	PASS — 108 recorded tools, mcp__ast_grep__ + mcp__lsp__ present, a real ast-grep call recorded
Docker source (--require-docker --live)	PASS — 117 passed / 0 failed / 5 declared NULL (rootless; evidence/docker/client-install/2026-10-20T02-44-13Z/)
Docker oneclick (--require-docker --live)	PASS — 116 passed / 0 failed / 6 declared NULL (rootless; evidence/docker/client-install-oneclick/2026-10-20T02-57-09Z/)

Full logs: gates/. Docker evidence: evidence/docker/client-install*/.

简体中文

较 v0.13.2 的 minor（破坏性） 版本。本版把宿主基线推进到 DeepSeek Harness 0.2.1-rc.2 与
dsh-tui 0.16.1；plan→graph 模型改为在宿主平面只计算一次、由 Web 与 TUI 共同渲染；撤销
2026-10-10/11 的守卫仪式，顶层 agent 重新直接持有完整工具包；Docker 验收车道新增真实双成员团队
分别通过 Web 输入框与 TUI PTY 完成一个小工程的判定。

破坏性变更 / 宿主适配

• DeepSeek Harness 0.2.1-rc.2。 startContinuable() / start() 已移除；适配器改用
  startActivation() + waitForChildren() 重建原生团队执行器与 spawn 路径，delivery 成为必填字段，
  result.output 按 ContentBlock[] 读取。webRuntime 更名 webApp：侧栏行同时探测两个名字，两者都
  不带 trustedHosts 时打印原因并自禁用。
• dsh-tui 0.16.1。 0.16.1 就是 harness-0.2.1 版本：36 个 @deepseek-ai/dsh-* peer 全部接受
  0.2.1-rc.2。与 0.15.0 的声明级比较未发现适配器破坏（仍是十五个 tui* 接缝、六个形状、
  close(): void + active.id、tuiPanels 不变、tuiPrompt 仍为 phantom），所以这次只动版本钉。
  dsh-plugin.json 里陈旧的 compat.hosts 一并更新。
• Preset / 行对齐 跟随 0.2.1 standard：加入 time-context、tool-schedule 与禁用的
  tool-plugin-manager / tool-plugin-market；移除 tool-ralph、tool-subagent-codex、
  tool-subagent-claude-code；schema 不再声明的 backgroundMode 与 maxPendingMessagesPerMember
  从对应行移除。
• 撤销 2026-10-10/11 守卫仪式。 顶层 mpd agent 重新直接持有 read、write、edit、bash、
  grep、glob、subagent，由 persona 提示词约束。名册的八名只读拒绝清单与
  ask_user_question schema 兜底仍然保留；名册、团队、verify、memory、boulder、ULW 面继续随包
  发布且可调用。team.gate 默认 off。启动行把每个被撤销的守卫记为 absent 并带原因。
• 需要明说的后果： 成员会话的机械式单 git writer 拒绝也一并消失。该规则从本版起是文字约定，
  靠派发契约（成员改文件、跑门禁，队长提交）与评审执行。

新增

• 共享 plan→graph 模型（packages/mpd-graph-core）：一个宽容的 plan 解析器、一个 board+plan
  合并与六类冲突报告、一份从 TUI 原样搬出的 rank 推导、一个防抖 watcher。宿主平面每队只计算一次
  buildModel({ board, plan })，发布到 mpdTeams.graph(...) 与 /plugins/mpd-team/state
  （model + tasks[].rank，纯增量）；Web 客户端不再自行推导，TUI 渲染同一模型。仅 plan 声明的
  节点作为 ghost 画出（planned: true、visual: "planned"），仅 plan 的边也画出。新门禁
  bun run verify:graph（--self-test 8/8，--seed-wrong-edge 反向控制）。
• 真实团队验收车道。 MPD_E2E_TEAM_PROJECT=1 让真实双成员团队分别经 Web 输入框与 TUI PTY
  完成一个工程：拟定两任务计划（T2 被 T1 阻塞）→ 批准 → 派发 → 等待 → 二次派发 → 关闭两行，成员
  写出并测试 team-project-web/ / team-project-tui/。docker/lib/team-project-verdict.ts
  从记录与产物读取判定（成员被拉起、可解析依赖边、完成归属、步骤内写文件、团队自测与验证器自写的
  sum(2, 3) === 5），附 10 臂 --self-test。

修复

• 团队 Web 路由按请求命名的 session 解析工作区（新增 workspaceRootForSession），不再用 dsh
  进程 cwd，面板不会再在已完成看板旁显示“本工作区还没有团队”。
• claim 后 owner 存的是成员 executor 句柄，现在在 core 进度、dispatch 空闲池与 TUI 投影中统一
  归到该成员；成员卡不再显示 0/0。
• 嵌套失败行不再在 lead 继续工作时提前结束回复等待；approve 后的 headless 实时回合有超时，
  不会因队友仍存活而挂死。
• Docker live 行：跳过与拒绝运行分开记录；无凭据的 WEB 检查只归因于非 live 原因；真实 WEB / TUI
  回合按提示词可变失败判定。
• 打包器补上 packages/mpd-graph-core/dist，闭合 pack-closure 缺口。

安装 / 升级

先把宿主升级到 DeepSeek Harness 0.2.1-rc.2 与 dsh-tui 0.16.1。然后在 checkout 里：

dsh plugin --profile web add .

发布公开后可用：

dsh plugin --profile web add github:HaroldZ32/My-Power-Dsh
# 或 npm 上已有该版本后：dsh plugin --profile web add @mpd-dsh/m...

v0.13.1 — the review pass: team-plane authorization, docker lane honesty, the QA install path

v0.13.1 — the review pass: team-plane authorization, docker lane honesty, the QA install path

Patch release answering all fifteen CodeRabbit findings on the v0.13.0 PR (#42). Verified by a
blind seat (rec-20261015T071509-834da8, PASS) and by the Docker real-machine lanes in both modes
at this revision.

English

Security / authorization (four Major, CWE-862 / CWE-863 + two integrity defects).

• agent_teams_plan's LIVE append verbs (add_member / create_task) now require Lead
  authorization; a roster member's attempt is refused with a reason and leaves the record
  byte-unchanged. (The review's literal patch would have stayed bypassable through the lineage shape —
  the shipped guard narrows the ancestry and an arm proves it.)
• Lineage no longer identifies a roster member, so a member whose parentSession is the Lead
  cannot take the Lead's close override; a forked/resumed captain still heals.
• The mailbox summary is scoped by team identity (teamId stamped at send) instead of member
  ids/names that repeat across teams; unstamped legacy rows are excluded from scope:"team" and
  counted.
• The archive/reap rule is keyed by the record's own planId (stamped at approval) instead of
  Lead + name, so a discarded retry plan can no longer reap a LIVE team; records without the field are
  never archive-reaped (stated migration rule).

Docker. BROWSER_INSTALL resets before the mirror retry (a successful retry is no longer reported
unavailable); the reply verdict subtracts the pre-send capture so a stale failure panel cannot bind
a credential bound; step 01b's tarball probe falls back to the mirror's metadata AND tarball before
settling.

QA. The mcp-call case installs the staged pack non-linked (--install-links +
--legacy-peer-deps, the peer semantics a real profile has): a linked file: dependency never
materialized the pack's own closure (measured: the linked launcher resolved neither @ast-grep/cli nor
cclsp). With one shared warm npm cache the lane passes in 70.8–113.1 s (from 1037 s cold). Six
smaller TUI-case findings are fixed too.

Reported, not fixed here (host-side). Any profile whose node_modules carries a second copy of the
harness core is boot-fatal through a duplicate send_message, because @deepseek-ai/dsh-scope keys
scopes by a module-local Symbol — repro + stack in
evidence/tui/dsh-tui-015/coderabbit/skills3/collision/.

Verified. Blind verification PASS rec-20261015T071509-834da8; Docker source LIVE 114 pass / 0
fail / 4 NULL (2026-10-15T07-22-55Z) and oneclick LIVE 113 pass / 0 fail / 5 NULL
(2026-10-15T07-47-06Z), both --require-docker; static gates 8/8; unit band 1955 tests / 0 fail.
The five NITs the verifying seat recorded are follow-ups, not silent edits. Full notes:
CHANGELOG.md.

简体中文

安全/授权（4 条 Major，CWE-862 / CWE-863 + 两项完整性缺陷）。

• agent_teams_plan 的活记录追加（add_member / create_task）现在要求 Lead 授权；名册成员的
  尝试被拒并给出原因，记录逐字节不变。（评审的字面补丁仍会被 lineage 形状绕过——实发守卫收窄了祖先，
  并有单测臂证明该形状被拒。）
• lineage 不再等同于名册成员身份，parentSession 为 Lead 的成员无法取得 Lead 的关闭覆盖权；
  分叉/续接的队长仍然自愈。
• 邮箱摘要按团队身份收敛（发送时盖 teamId），不再用跨队重复的成员 id/名字；无戳旧记录被排除出
  scope:"team" 并计数。
• 归档/回收规则改按记录自身的 planId（批准时盖章），被丢弃的重试计划再也不能回收活队；无该字段
  的记录永不被归档回收（迁移规则已写明）。

Docker。 镜像重试前重置 BROWSER_INSTALL（成功的重试不再被报为不可用）；裁决减去发送前画面，
陈旧失败面板不能绑定凭据裁决；01b 的 tarball 探测在落定前回退探测镜像的元数据与 tarball。

QA。 mcp-call 案例改为非链接安装暂存包（--install-links + --legacy-peer-deps，即真实
profile 的 peer 语义）：软链的 file: 依赖从不物化包自身闭包（实测：软链下启动器既解析不到
@ast-grep/cli 也解析不到 cclsp）。共享一份热 npm 缓存后，车道以 70.8–113.1 s 通过（冷装 1037 s）。
另有六条 TUI 案例的小问题一并修复。

已报告、不在本版修（宿主侧）。 任何 node_modules 里带第二份 harness 核心的 profile 都会因重复
send_message 启动即死，因为 @deepseek-ai/dsh-scope 用模块局部 Symbol 记作用域——复现与栈见
evidence/tui/dsh-tui-015/coderabbit/skills3/collision/。

已验证。 盲审 PASS rec-20261015T071509-834da8；Docker source LIVE 114/0/4（07:22:55Z）与
oneclick LIVE 113/0/5（07:47:06Z），均 --require-docker；静态门 8/8；单测带 1955 项 0 失败。
验证席记录的 5 条 NIT 作为后续项而非裁定后改动。完整说明见 CHANGELOG.md。

v0.13.0 — dsh-tui 0.15.0 adaptation, keeper stand-down, 0-task DAG fix, team-plane guards

v0.13.0 — dsh-tui 0.15.0 adaptation, the keeper that stands down, the 0-task DAG fix, and the team-plane guards

Adaptation release: the bundle targets @deepseek-harness-tui/dsh-tui 0.15.0 and lands four
functional clauses plus an unconditional release. This entry covers the FULL delta since v0.12.0 — see
CHANGELOG.md for the complete list (two host adaptations, the
de-vendor/re-source chapter, the live team surfaces, the win32 band, the model-route repairs).

English

Adapted to dsh-tui 0.15.0. The fifteen plugin-facing ctx.tui* seams are identical between 0.14.0
and 0.15.0 (declarations additive-only), so this is a carrier move plus verification: every release
carrier names 0.15.0, and the four deliberate non-moves stay (MPD_E2E_DSH_VERSION 0.2.0-rc.2, the
compat.hosts 0.10.1 admission measurement, the registry-0.15 ecosystem-spec string, dated-history
sentences). The measured delta is frozen at
evidence/tui/dsh-tui-015/host-diff/FACTS.md.

The keeper stands down onto the host's native self-heal. On hosts whose sidebar CSV self-heals
(hostVersion >= 0.15.0, read through the already-proven probe — no new host contact) the enable-list
keeper writes nothing; on older hosts the 0.14 behaviour is preserved byte-for-byte. An explicit
/settings removal of both MPD panels stays removed session-wide; proven on a real PTY.

The 0-task DAG defect is fixed (reported live by the user): the MPD panel no longer discards a
resolved team's identity when the board is empty — it draws the header facts and a roster row instead of
a bare empty state.

Team-plane dispatch guards, with a standing hard gate. Cross-team pairing refused (both ids named),
write-task × read-only-member refused, terminal/archived-team resolution skipped; mid-run
create_task/add_member append to a live approved record, members close their own rows, the mailbox
summary is team-scoped, ids are ms+suffix with collision refusals, and a forked/resumed captain keeps
captaincy. The team-dispatch-guard QA case (17 self-test arms + a 21-arm real lane) runs inside
bun run test:qa.

Decision-events grants. The extension-grants.json flow is documented user-facing and the seam's
observability is fixed; the ledger-attribution arm is recorded RED with a NAMED host-side gate
(requireComponentIdentity's WeakMap) — the seam is built ready, NOT activated, and says so.

Verified. Loops A/B blind-verified PASS (rec-20261014T164146-027c3b,
rec-20261014T170113-33f5e1); 8/8 sandbox TUI lanes match the frozen expected-status table; Docker
real-machine lanes green at the release candidate: source LIVE 114 pass / 0 fail / 4 NULL
(2026-10-14T17-06-22Z) and oneclick LIVE 113 pass / 0 fail / 5 NULL (2026-10-14T17-12-46Z), both
--require-docker.

Known bounds (declared, not smoothed): two QA lanes SKIP for a declared environment reason
(absent fixture / no dsh-ecosystem-spec checkout); tuiRenderers and H4 remain the pre-existing
declared reds; VENDOR_LOCK.json needed three writes because a post-integration skills repair landed
after the first re-pin (recorded in the wave report).

简体中文

适配 dsh-tui 0.15.0。 十五条面向插件的 ctx.tui* 缝在 0.14.0 与 0.15.0 间完全一致（声明仅增量），
因此本波是载波迁移 + 验证：所有发布载波改名 0.15.0，四项刻意的非移动项保持不变（MPD_E2E_DSH_VERSION
0.2.0-rc.2、compat.hosts 的 0.10.1 准入实测、生态规范号 0.15、带日期的历史语句）。实测差异冻结于
evidence/tui/dsh-tui-015/host-diff/FACTS.md。

保持器并入宿主原生自愈。 侧边栏 CS V 会自愈的宿主（hostVersion >= 0.15.0，经既有探针读取、不新增
宿主触点）上，启用列表保持器零写入；旧宿主逐字节保留 0.14 行为。用户在 /settings 显式移除两个 MPD
面板后本会话保持移除——已在真实 PTY 上验证。

DAG 零任务缺陷已修（用户现场报告）：看板为空时不再丢弃已解析的团队身份，改为渲染表头事实 + 一行
花名册。

团队面调度守卫 + 常驻硬闸门。 跨队配对拒绝（双方具名）、写任务 × 只读成员拒绝、终态/归档队解析
跳过；运行中 create_task/add_member 可追加到已批准活记录、成员可自关己行、邮箱摘要按队收敛、id
毫秒+后缀且有冲突拒绝、分叉/续接的队长保任。team-dispatch-guard 案例（17 自测臂 + 21 臂真实车道）
在 bun run test:qa 内运行。

决策事件授权。 extension-grants.json 流程已有面向用户文档，缝的可观察性已修；账本归属臂以具名的
宿主侧闸门（requireComponentIdentity 的 WeakMap）如实记为红——缝"备好未激活"，并明确说明。

已验证。 Loop A/B 盲审 PASS；8/8 沙箱 TUI 车道对齐冻结预期表；发版候选上 Docker 实机双模式全绿：
source LIVE 114/0/4（17-06-22Z）、oneclick LIVE 113/0/5（17-12-46Z），均 --require-docker。

已知边界（声明而非抹平）： 两条 QA 车道因声明的环境原因跳过；tuiRenderers 与 H4 为既有声明红；
VENDOR_LOCK.json 共三次写入（集成后仍有 skills 修复落地，波报告已记录）。

v0.12.0 — the product page, and one bundle on two surfaces

The product page, and one bundle on two surfaces

@mpd-dsh/mpd@0.12.0 — published to npm, and the artifact there is byte-identical to this tree's
pack (shasum 8164dcd4a9c6759e5be86f5c62490ae7bb694cfa).

The front door is rebuilt / 门面重建

README.md becomes a page you read in one sitting — 68 524 B of manual becomes 18 429 B — in the
shape the dsh-tui project's README uses: language switch, a
hero capture of the running product, Features, Install, Quick start, Usage, Status and known limitations, the documentation index, and the provenance and license sections. The long form
lives at docs/user-guide.md, which already existed.

README.md 变成一屏能读完的产品页：68 524 B 的手册正文压到 18 429 B，长文住在本来就存在的
docs/user-guide.md。

One plugin, two surfaces / 一个插件，两个端

The spine of both READMEs is a Web | TUI comparison table: one row per concrete surface — the team
roster, the task graph, the watchdog banner, plan review, the workmate library, the settings card, the
terminal status line — with a Web column, a TUI column and a parity column. Every parity claim is
one docs/tui-parity.md already records, and the rows that are not at parity
are the ledger's own open deviations, named in the table rather than smoothed over. The table also
separates two Web surfaces that are easy to confuse: the harness's read-only Agent Teams panel in the
conversation header, and this bundle's own Team view.

Real screenshots / 真机截图

Sixteen new images (8 English + 8 简体中文), cropped to this bundle's own surfaces rather than to
harness chrome. The Web tiles come from headless Chromium driving the real app; the terminal tiles
come from rasterizing the ANSI byte stream the real TUI emitted on a real PTY at the character grid
tmux computed. The repository previously shipped zero terminal images. Method, fixture and the
three dead ends a future lane must not re-pay for:
evidence/docs/readme-0.12.0/image-provenance.md.

Also fixed by this wave / 本波一并修掉

Ten-plus pre-existing defects the wave's audit surfaced, repaired in both twins — including a
user guide that denied the plan-approval gate, an agent-preset-registry id-target documented in
six places after the repo removed it, a dependency claim repeated in six places that was false, and a
parity ledger whose banner called a live surface retired. Two Docker-lane DAG assertions were
repaired as well: one stale (four hours behind a commit nobody re-ran the lane after), and one
vacuous — it matched the scene frame's corners and stayed green with every box deleted.

Honest bounds / 如实声明的边界

• The README's original 9 KiB budget was missed; the contract records the amendment before
  verification, with the reason, and the delivered bound is 18 KiB.
• The terminal tiles' page background is the lane's choice — dsh-tui deliberately never paints one.
  Every foreground colour comes from the byte stream.
• The TUI localizes its command descriptions and status line but not its scene bodies, so the
  terminal scene tiles read the same in both locales. The README says so.
• On npmjs.com the screenshots do not render. npm's own file-walk selects README.zh-CN.md (its
  glob {README,README.*} returns it first — reproduced), and npm cannot resolve the relative image
  paths. GitHub renders everything correctly. Recorded in
  evidence/docs/readme-0.12.0/npm-publish-verification.md.

v0.11.1 — mailbox unread

v0.11.1 — mailbox unread

v0.11.0 shipped with this capability listed as a bound: "the official inbox exposes no read state".
That was true of the TEAM SERVICE and false of the HARNESS, so it is implemented instead of documented
away.

Added.

• agent_teams_mailbox — how many messages are WAITING for this agent. The count is the harness's
  own arithmetic, not an estimate: the agent inbox emits agent/inbox/inserted when a message enters,
  agent/inbox/claimed when the loop takes it and agent/inbox/discarded when it is dropped, and
  inserted − claimed − discarded is "waiting, not yet taken". watch: true attaches the counter to
  the calling agent (idempotent). The count clamps at zero, because a counter attached to an
  already-running session may have missed claims it never saw.
• subscribeAgentEvents on the adapter — the generic form of registerAgentPreStep's agent-scoped
  registration. The three inbox events are SCOPED (their dsh-scope subject resolver is
  args[0]["agent"]), so a listener on a row's ctx is filtered out of their dispatch; this seam
  registers on the agent's own scope and never lets a throwing observer break that dispatch.

Fixed.

• The team tools' boot line derived neither number: it printed tools=10 while the plane had grown,
  and then a literal breakdown that said "13 tools" when there were 14.

v0.11.0 — the team workflow, per-member routing, and a settings surface that reads

v0.11.0 — the team workflow, per-member routing, and a settings surface that reads

The official Agent Teams plugin owns the team RUNTIME and nothing else. This release adds the WORKFLOW
around it, the routing it cannot express, and the GUI/settings work that a Docker view of both shipped
surfaces drove.

Added — the team workflow (mpd-team-tools-plugin).

• Staged plan + approval. agent_teams_create / _add_member / _create_task / _edit_plan
  stage a plan; agent_teams_approve EXECUTES it — spawns every member through spawn_teammate, posts
  every task to the official board, resolves blocked_by from planned subjects to posted ids and
  owner from staged names to spawned ids, and names where it stopped if it did. dry_run reports
  without creating. Nothing is spawned before approval.
• Task contracts. agent_teams_claim_task claims on the board AND freezes the task's meaning with
  a monotonic attempt counter; agent_teams_task_contract reads it back. The counter is why the
  sidecar exists: the board's revision moves for every mutation, so it cannot stand in for an attempt.
• Halt / resume. A hold that stops new dispatch and leaves the team and its members alive —
  deliberately not an ending. agent_teams_delete is the ending, and it ARCHIVES.
• Dispatch. agent_teams_dispatch pairs each READY task with an IDLE member, sends the task, and
  RECORDS the pairing, so a second pass cannot hand the same task to a second teammate (a message is
  not a ledger). Ledger entries for tasks deleted or completed out of band are pruned first, so a
  member is never left busy forever. agent_teams_dispatch_release frees one pairing.
• agent_teams_status prints the sidecar beside the official roster and board, and /agent-teams <what the team is for> stages a plan from the current goal.

Added — per-member model routing (mpd-roster-provider-plugin).

spawn_teammate used to inherit the Lead's route: the official TeamService forwards only
{ prompt, parent }. The harness itself is not the limitation — SubagentContinuationManager
resolves request.agentOptions and hands them to the PROVIDER, which constructs the run, and the
provider NAME is row config (config.freshProvider). This bundle therefore registers mpd-roster, a
provider that delegates to the composition's own and applies the member's teamModels slot route, and
points its mpd-tool-agent-team row at it. The teammate stays a real, continuable official teammate:
no fork, no contract change. A teammate description that NAMES a roster member routes that member;
one that does not inherits the Lead's route — the descriptor label is the only identity channel the
team service forwards. An incomplete slot fails the spawn loudly, naming the member and the slot.

Added — the team GUI in the harness's own right sidebar (mpd-bundle-plugin).

A Team tab registered through ctx.sidebarRightTabs, rendering the Lead session's agentTeam
projection: completion, N of M running · ready · blocked, members with role and phase, and tasks with
owner and blockers. It lands in the sidebar the harness already ships, so it appears wherever the
harness does.

Fixed — the settings surface, on BOTH front doors.

• The MPD section now RENDERS and READS. Harness 0.1.7-rc.2 replaced the namespace registry with the
  Cordis patch editor, so the knobs are declared as the mpd-config row's own Config with volatile
  flags, and both front doors address the ENTRY (mpd-config) rather than a namespace name. Measured:
  20000 / true / 6 / git / .mpd/team in the Web dialog and in the TUI.
• An edit actually REACHES the plugins: the row config is merged as the layer above the files, with
  the routing keys stripped.
• The repeated per-row disclosure is stated ONCE per surface, so eight rows fit where five did.
• The sidebar host mounts on a checkout install. dsh-better-sidebar was not resolvable from a
  link: profile, so the bundle contributed no sidebar GUI at all; the bundle now reaches its own copy
  through mpd-better-sidebar-host.
• The watchdog's three agent/* subscriptions and the bootstrap's fs/observed go through the
  adapter, and the D6 gate covers event NAMES.

Fixed — the TUI edition. A dsh-tui profile is now part of the Docker client test, which boots
the real TUI on a tmux PTY and reads the created session's preset from the harness's own store.

v0.10.2 — the TUI plane defaults to mpd; adapter event gaps closed

Answers three review questions and lands the fixes they found.

Is the agent-team surface smaller? Yes, and it is now listed honestly in docs/plan-0.1.7-adaptation.md §8: the retired vendored body exposed 20 agent_teams_* operations; the official plugin exposes 9 tools plus this bundle's roster guard, roster section and advisory gate. Gone: the staged-plan/approval flow, the dependency-DAG scheduler with auto-claim, attempt_id task contracts, path_owner/move_path, rollover, the halt (halt/resume), delete/archive, a mailbox unread count, and the /agent-teams command. Restored: the mechanical read-only discipline (a tool guard) and the session-start gate (advisory). Impossible on the official plugin: per-teammate model routing.

Are all the plugin's harness interfaces on the adapter? The mpd team plane: yes (the D6 gate proves it statically). The official plugin itself: no, and it cannot be — it IS harness code. Two real gaps were found and closed here: mpd-team-watchdog-plugin's agent/pre-step / agent/session-start / agent/turn-stopping and mpd-bootstrap-plugin's fs/observed were subscribed on a raw ctx. The D6 gate gained an event-NAME rule family; cordis framework events (internal/service) stay direct and are named as such.

Does the TUI edition work? It did not, and now it does. A dsh-tui profile composes no dsh-web-app layer, so this bundle's agent-preset-registry id-target was skipped there and the TUI's own scoped row kept default: standard — a preset that composition does not declare. A second id-target on dsh-tui-agent-preset-registry restores D10, and @deepseek-harness-tui/dsh-tui@0.11.1 (the first release whose peers include 0.1.7-rc.2) is now the pin.

Verified in Docker: node scripts/docker-e2e.mjs → passed=42 failed=0 null=1, including 11 TUI assertions — real tmux PTY boot, and the created session's preset read from the harness's own store as agentPreset: "mpd".

v0.10.1 — the session-start gate really fires

Two functional defects measured after v0.10.0 was tagged are fixed here.

The session-start complexity gate was MOUNTED but NEVER FIRED. Three root causes, each measured on a real boot: agent/pre-step is dispatched through the AGENT's scope carrier and dsh-scope drops a listener registered on a row's ctx; the harness splices its own user-role runtime-context turn onto the pre-step decision, so the gate judged that snapshot instead of the goal; and the injected notice used the retired {kind:"plugin"} message source, which 0.1.7's format-v4 gate refuses — the injection killed the boot. Fixed by registering one listener per qualifying agent in that agent's own scope through a new adapter seam (registerAgentPreStep), reading the goal from the payload's raw claimed list, and naming the message producer.

/ulw used the same fatal message source — found by a lane-wide grep prompted by the first fix.

Gate sweep on the released tree: verify:gates 5/5, verify:vendor PASS, verify-dist-fresh 20/20, bun test packages 1174/0 fail, test:qa all self-tests passed, verify:docs PASS, verify-pack-closure ok, verify-manual-paths PASS, tsc --noEmit exit 0, the live preset-conformance / bundle-lifecycle / session-start-team cases PASS, and the Docker end-to-end client test PASSES with boot.sessionGateListener, boot.agentTeamTools (9/9 from an exact agent scope) and boot.presetMount witnessed on one session in one boot.

See CHANGELOG.md and docs/plan-0.1.7-adaptation.md §7.