dsh-verification v1.0.0

What's in this release

Verification for DeepSeek Harness (DSH) agents: "claimed done" becomes "actually done." Every acceptance criterion must be backed by server-stamped, real tool evidence before the completion gate lets a goal through.

Engine (dsh-verification)

• set_verification_plan / get_verification_plan / reset_verification_plan tools
• goal-bound task epochs, frozen selectors (tool + args hash), content-addressed evidence, T0–T4 oracles, completion gate + durable permits
• advisory (record, never-deny) / enforce (block unverified completion) modes

Benchmarks & evidence

• Synthetic benchmark (reproducible): recall 100%, false-positive 0% — \pnpm --filter @bpc-oss/dsh-verification bench\
• Real-task replay audit + completion-capability evaluation (docs/value-report.md, scripts/)
• GitHub Actions CI: typecheck + build + tests + benchmark + dist-pack reproducibility, green on every push

Key fixes

• Removed verification dock clutter from the conversation input area
• Fixed session history load failure (empty claimId on no-evidence verdicts)
• Fixed write-tool lockout (missing_authority_scope) for agent/UI-created goals — epochs now always form
• Family-aware binding (binderFamilyFallback) to stop false rejections of genuine completions (e.g., docs produced by write but selector frozen to glob)
• Actionable workflow guidance in tool errors + README

Migration

• Existing sessions with a stale plan and no active task epoch load fine in advisory mode
• Strict deployments can opt out of family fallback with \�inderFamilyFallback: false\

License

Apache-2.0