v0.2.0 — verify the contract, don't redo the work

What changed

v0.2 is a pivot, driven by measured data.

In our own end-to-end run, a delegated task passed 16/16 tests after 2.5 minutes of worker time — and then the manager (Codex) spent another 5.5 minutes and 80% of the total tokens re-reading, re-editing, and re-testing the code.

The expensive part wasn't delegation. It was verification without a stopping rule.

What's new:

• Verification contract in the worker brief: allowed paths, checks, invariants, limits, review mode.
• scripts/verify_workspace.sh — a non-LLM verifier that checks the workspace against the contract and prints a small JSON receipt.
• Risk-tiered review: receipt / targeted / full.
• Hard stop rule: contract passes → report completion. No re-editing, no scope creep.

Core rule, extended:

Delegate the work. Verify the evidence. Don't redo the work.

v0.1.2 — the install path was wrong

What changed

One fix, and it matters: the default install path was wrong.

Fixed

• User skills now install to $HOME/.agents/skills — the location OpenAI's current Codex documentation actually reads. The previous $CODEX_HOME/skills default was a path Codex never loads, so installed skills would silently never appear.
• The validation gate now fails if the installer ever drifts back to a non-official path.
• Bilingual READMEs and changelog updated.

Thanks

The wrong path was caught while preparing the integration guide for awesome-deepseek-agent — a good reminder that reviewer-grade checking is what this project preaches.

v0.1.1 — the polish pass

What changed

This release is the polish pass before going public. Not much new — just the things other people would have stumbled on.

Fixed

• Install path now targets the official Codex skills directory (~/.codex/skills). The previous path was one Codex never reads.
• The install script now refuses catastrophic destinations. install_skill.sh / is no longer a footgun.
• Setup docs now distinguish the two ports: the dsh web UI lives on 3080, the MCP bridge on 8090.
• Added the Node.js requirement (^22.19 || >=24) and the actual install command (npm install -g @deepseek-ai/dsh).
• MCP tool names are pinned to @chushixixin/dsh-harness-mcp-server v0.1.x, with a note on what to re-check after upgrades.

Added

• Headless runs now keep a full worker transcript in a temp log — outside your workspace.
• .env.example template.
• CI now fails if the installer's safety guard is ever removed.

Unchanged

The one rule: a worker saying "done" is not evidence that the task is done. Codex still reviews the diff and runs the tests itself.

Feedback and small PRs are very welcome.