DSH plugin suite: crash-surviving jobs, session anchors, three-platform sandboxes, persistent scheduling — six Apache-2.0 plugins

[Wang-Lin-Chang]

You run a 40-minute agent task. At minute 39 the session crashes: output lost, state lost, and no way to tell whether it ever finished. That happened to us on DeepSeek Harness — so we built six plugins to answer it. All Apache-2.0, all three-platform CI green.

一个 40 分钟的 agent 任务跑到第 39 分钟，会话崩了——输出没了、状态没了、连"它到底做完没有"都无从知晓。 我们在 DeepSeek Harness 上真实踩过这个坑，然后写了六个插件来回答它。全部 Apache-2.0，全部三平台 CI 全绿。

The six plugins / 六个插件

Plugin	What it does	Evidence
dsh-witness	Crash-surviving background jobs: the filesystem is the source of truth, cross-restart adoption, autopsy reports. 崩溃存活后台任务	12 scenarios / 34 assertions
dsh-anchor	Session anchor protocol: pre-committed intents, immediate post-action reconciliation against the real environment. 会话锚点协议	37 assertions
dsh-cross-platform	Linux sandbox backend for witness/anchor (chattr + bubblewrap read-only view). Linux 沙箱后端	34/34 ×3
dsh-macos	macOS sandbox backend (uchg immutable flags + sandbox-exec deny view). macOS 沙箱后端	34/34 ×3
schedule-core	Zero-dependency persistent scheduler core: SQLite archive + lease-claim dispatch + full clock discipline. 零依赖持久调度核心	unit 37 + fuzz 200/0 + diff 644/0
dsh-schedule	Cross-restart reminders and scheduled jobs — survives session death, dual remind/job actions. 跨重启提醒与定时任务	3-platform CI

Scheduling fills a specific gap: the built-in scheduler's state lives in the session log, so the schedule dies with the session. Ours lives in a SQLite archive and dispatches across restarts with a lease-claim protocol. 调度补一个明确的空白：官方调度的状态在会话日志里——会话死，调度死。我们的存在 SQLite 档案馆里，跨重启租约认领派发。

Three things we do differently / 三个不同

1. Every capability claim carries an experiment number and a control group. "Prevents overwrite" in the README means the experiment ledger has the full before/after comparison. No slogan enters a README — data does. 每个能力声明带实验编号与对照组。 README 说"防覆盖"，实验账本里就有加位前可写→加位后全挡→恢复后可写的完整对照。

2. We fuzz the wall clock. The nastiest input to a scheduler is time itself — rollback, jump-forward, DST gaps, crash windows. Our clock-disorder fuzz (200 seeds / 7770 random ops, five invariants) and an implementation×model differential test (644 assertions) are public, reproducible, and have caught real bugs. 我们把"时间"当敌人来测。 回拨/前跳/DST/崩溃窗口的时钟乱序 fuzz + 实装×模型差分测试全部公开可复现，并且真的抓到过潜伏 bug。

3. We publish our honest boundaries. at-least-once is not exactly-once — it says so in the README. The Windows CI environment can't exercise the ACL sandbox (admin runner) — that's disclosed too, and the fail-closed protocol is asserted instead. 我们公开诚实边界。 at-least-once 不是 exactly-once、Windows CI 管理员环境测不了 ACL 沙箱——都写进 README。

Audit welcome / 欢迎审计

The experiments behind every claim live in each repo's EXPERIMENTS.md. 每个声称背后的实验数据都在各仓库的 EXPERIMENTS.md 里。

Questions, porting notes, and adversarial testing are all welcome. 欢迎提问、挑毛病、上手攻击测试。

[Wang-Lin-Chang]

Update: two framework-agnostic specs are now published, and the adoption-latency number is now measured instead of assumed.

更新：两个框架无关协议已发布；收养延迟有了实测数据，不再靠假设。

New: the protocols / 新增协议

• asmfs-spec — Agent State Machine as File System: the directory structure is the state machine. Framework-agnostic layout, lock protocol, three-evidence adoption, EXIT protocol, event sourcing — every item mapped to a reference-implementation test in CONFORMANCE.md.
• autopsy-spec — Agent Autopsy Format: autopsy.json schema + a standardized death-code taxonomy (D-01~D-09) with trigger semantics and extension rules.

Measured: adoption latency / 实测：收养延迟

After kill -9, the time for a new registry instance to adopt and finalize the orphan (×3 runs, 10 trials each, Windows 11 · Node 25.8):

Configuration	p50	p99
Cold-start recovery (new instance)	9.9~10.4ms	11.5~16.8ms
Live instance monitor (100ms cycle)	219.9~224.0ms	≤297.2ms
Live instance monitor (500ms cycle)	425.2~449.9ms	≤472.6ms

Ledger: dsh-witness/EXPERIMENTS.md (EXP-8).

[Wang-Lin-Chang]

Update 2: the seventh piece is published — the suite now speaks the MCP protocol too.

更新 2：第七件已发布——套件现在也讲 MCP 协议了。

agent-runner-mcp wraps the three-platform sandboxed runner protocol as an MCP server: task_run (Windows ACL / Linux bubblewrap / macOS sandbox-exec), task_wait (EXIT:<code>), task_autopsy (death-code taxonomy), task_kill / task_adopt (three-evidence adoption). Zero runtime dependencies — the MCP layer is hand-rolled (dual framing: LSP headers + newline JSON).

Measured: 15/15 MCP protocol assertions on three-platform CI; registered in Claude Code 2.1.92 and passed its health check (✓ Connected). Session-level calls require a login we don't have — not claimed.

实测：15/15 MCP 协议断言（三平台 CI）；Claude Code 2.1.92 注册并通过健康检查（✓ Connected）。会话级调用需登录态——未实测不声称。

[Wang-Lin-Chang]

Update 3: the suite is now eleven repos + eight npm packages — and it includes a super multi-agent architecture.

更新 3：套件现在是十一个仓库 + 八个 npm 包——其中包含一个超级多 Agent 架构体系。

dsh-megamesh fuses seven measured modules into one architecture:

• 战报协议（battle-report protocol）：30 侦察兵 × 90 任务，1838.5 KB 全文 → 22.6 KB 战报，98.8% 压缩且决策无损
• 千脑联邦（federation of brains）：kill -9 主席 → 任期锁换脑 1641 ms，决策 90/90 零丢失
• 军法 + 免疫系统（invariants + rule extractor）：手写规则的假阳性 8→0、假阴性 2→0，自动提取 3 条人类没写过的规则
• 时间战场（time machine）：checkpoint/branch/checkout/merge，重演 90/90 逐份一致
• 人机共读战报（human-machine reports）：Markdown 人读区 + JSON 机器区同一文件，双区矛盾必被抓

15 个实验装置（E01–E15），每个声称带实验编号；三平台 CI 全绿。

npm 八包（one command to install everything）:

npm i dsh-megamesh dsh-mesh dsh-schedule dsh-witness agent-runner-mcp dsh-anchor
npm i @wang--lin--chang/schedule-core @wang--lin--chang/dsh-story

Honest boundaries are published in every README. 每个 README 都公开诚实边界。

[Wang-Lin-Chang]

Update 4: dsh-megamesh v0.2.0 - a shadow court for self-governing invariants (Wilson promotion criterion + promote/demote loop).

?? 4:dsh-megamesh v0.2.0--????(Wilson ???? + ??/????)?

The question we burned this round: auto-extracted guardrail rules are drafts - when may a rule go live without a human? The answer is now measured (E16, five experiments):

• ??????:????????(61 ??? 0 ??)
• ??? Wilson ?? 18 ??? vs ?? 100 ?????(????)--?????
• promote/demote ??:????????????? ? ????????????????
• ??????:????????????????????

33/33 assertions, three-platform CI green. npm:
pm i dsh-megamesh\ (v0.2.0).

The direction this opens: self-governing invariants ? self-operating pipelines (publish/inspect/promote automated, humans approve only critical actions).

[Wang-Lin-Chang]

Update 5: dsh-megamesh v0.3.0 - the shadow court is now wired into the release pipeline itself (autonomous publish criterion).

?? 5:dsh-megamesh v0.3.0--????????????????(??????)?

This round the experiment method was applied to the experiment method: a publish judge runs in shadow (records suggestions, executes nothing) until its false-judgement rate passes a Wilson statistical criterion - then it auto-executes safe releases; one accident demotes it back to shadow. Measured (E17):

• nMin ????:??? 20 ?? ? ? 4 ???;150 ?? ? ? 30 ?--???????????
• ????:??? 150 ??? vs ??? 130 ?????????????? 0
• ????:????? ? ?? ? ??????(?? 3 / ?? 3,?????)

37/37 assertions, three-platform CI green. npm:
pm i dsh-megamesh\ (v0.3.0).

Direction: self-operating pipelines - publish/inspect/promote automated, humans approve only critical actions.

[Wang-Lin-Chang]

Update 6: dsh-megamesh v0.4.0 - the publish ledger is real now (eligibility judged on 20 real releases, not simulations).

?? 6:dsh-megamesh v0.4.0--????????(????? 20 ??????,??????)?

• ????:append-only ????????????????? outcome--?? 1 ?????(dsh-mesh v0.3.0 ??????? sweep ??????,0.3.1 ??),????
• ????:Wilson ????"???????"(??????),?????"??????? bug"--20 ?????????? ? Wilson=0 ? ????
• ?????:
  ode publish-preflight.mjs\ ??/??/???? + ????--???????????,?????????

41/41 assertions, three-platform CI green. npm:
pm i dsh-megamesh\ (v0.4.0).

Direction confirmed: self-operating pipelines - the ledger is the evidence, the criterion is the gate, humans approve only anomalies.

[Wang-Lin-Chang]

Update 7: dsh-megamesh v0.5.0 — parallel-universe strategy bidding (decision parameters are no longer hand-picked).

更新 7：dsh-megamesh v0.5.0——平行宇宙策略竞标（决策参数不再人挑）。

10 candidate decision strategies replay the training batch in parallel universes, then a Pareto auction picks the winner (100% correctness at lowest expansion cost) and promotes it as the default for the holdout batch. Measured (E19):

• 10 候选竞标：全正确，Pareto 胜者 gap-2（展开 2 × 往返 1）——与固定默认打平、优于随机
• 真分支宇宙验证：文件系统快照恢复的重演与内存重演逐字段一致
• 门槛扫描：竞标可靠性由训练样本数决定（小样本会过拟合——与自治判据同源）

45/45 assertions, three-platform CI green. npm: npm i dsh-megamesh (v0.5.0).

And the publish ledger is now live: every release is appended with its checks and outcome — 21 real entries, transparent in the repo.

[Wang-Lin-Chang]

Update 8: dsh-megamesh v0.6.0 — strategy evolution (the strategy pool grows its own champion).

更新 8：dsh-megamesh v0.6.0——策略进化（策略池自己长出冠军）。

The parallel-universe auction from v0.5.0 now iterates: losers are culled, winners mutate and breed, generations repeat until the pool converges. Measured (E20):

• 世代演化：随机初始池 8 个 → 冠军 gap-50 第 1 代登顶，第 4 代早停（省 6 代空转）
• 留出批对照：进化冠军正确且成本 = Pareto 胜者（2×1）——从随机池自己长到最优带
• 假阳性排除纪律不变：正确率<100% 的候选永不放行；真值被篡改时进化全灭不产出冠军
• 可复现：确定性 rng，两次进化账本逐代一致（进化结果可审计可重演）

49/49 assertions, three-platform CI green. npm: npm i dsh-megamesh (v0.6.0).

Direction: self-evolving strategy pools — auction selects, mutation explores, elites anchor; humans read the champion's scorecard.

[Wang-Lin-Chang]

Update 9: dsh-megamesh v0.7.0 — the full autonomy loop: evolution proposes, the shadow court disposes, demotion restores.

更新 9：dsh-megamesh v0.7.0——完整自治闭环：进化提议、影子法庭把关、降级回退。

Three powers, separated (E21, five experiments):

• 进化器 produces challenger strategies (innovation, not safety)
• 影子法庭 shadow-observes the challenger — Wilson criterion on misjudgement rate, promotion only after statistical proof
• demote restores the proven fallback strategy on the first accident — promotion is not tenure

And the criterion itself evolved: v1 (correctness-only) promoted a correct-but-expensive challenger that crashed under a budget constraint; v2 adds a cost dimension (never promote a strategy that costs more than the incumbent) — measured, the v2 criterion saves that accident entirely.

53/53 assertions, three-platform CI green. npm: npm i dsh-megamesh (v0.7.0).

Direction: self-governing strategy pools — evolution explores the parameter space, the shadow court proves safety, demotion restores on accident, and the criterion evolves with every accident.

[Wang-Lin-Chang]

Update 10: dsh-megamesh v0.8.0 — the autonomy stack is wired into the real release flow (deploy gate).

更新 10：dsh-megamesh v0.8.0——自治栈接入真实发布流程（部署单）。

One command now gates every release: node publish-deploy.mjs

• 预检三关（词检/测试/总检）+ 发布账本资格 + 判据参数扫描——候选 (nMin, ε) 在真实发布史上滚动重演，选出最早稳定达标的工作点（实测：nMin=5, ε=0.001，第 5 条记录起）
• 绿灯 = 一键放行；黄灯 = 人工复核；红灯 = hold
• 事故演练：注入词命中 → 部署单红灯拦截 → 修复 → 复跑绿灯（E22 实测）

And the gate proved itself again during this very release: it held the tree because the README claim count lagged the new experiment — fixed, then green.

56/56 assertions, three-platform CI green. npm: npm i dsh-megamesh (v0.8.0).

The four bricks (preflight, ledger, criteria scan, eligibility) are now the first action of every release — the autonomy stack is operational, not aspirational.

[Wang-Lin-Chang]

Update 11: dsh-megamesh v0.9.0 — the deploy gate now cruises daily (scheduled autonomy).

更新 11：dsh-megamesh v0.9.0——部署单每日巡航（调度式自治）。

node daily-cruise.mjs is now a scheduled daily job:

• 部署单自动跑（预检三关 + 账本资格 + 判据参数扫描）
• 绿灯 = 预检结果自动入账（非破坏性自治动作）；红灯 = 巡航报警不发布；黄灯 = 报告待人工复核
• 发布动作本身仍需人工批准——人只批关键动作，巡航负责每天把"该不该发"算清楚

And during this very release the gate intercepted the cruise script's own wording slip (a forbidden word in its own comment) — held, fixed, green. The autonomy stack polices itself too.

56/56 assertions, three-platform CI green. npm: npm i dsh-megamesh (v0.9.0).

[Wang-Lin-Chang]

Correction: the Chinese paragraphs in Update 4/5/6 were garbled by a publishing-tool encoding issue (now fixed — Updates 7+ are clean). Here are the correct Chinese versions:

更正：更新 4/5/6 的中文段落因发布工具编码问题出现乱码（已修复——更新 7 起正常）。正确中文如下：

• 更新 4：dsh-megamesh v0.2.0——影子法庭（Wilson 转正判据 + 转正/降级闭环）。本炉实测的问题：自动提取的军法规则什么时候能在无人批准时生效？答案已实测（E16，五实验）。
• 更新 5：dsh-megamesh v0.3.0——影子法庭装进了发布流水线自己身上（自治发布判据）。
• 更新 6：dsh-megamesh v0.4.0——发布账本是真的了（资格判据吃 20 条真实发布史，不再吃模拟流）。

Our apologies for the garbled text — the measurement data in those updates was intact and remains unchanged. 为乱码致歉——那三条更新中的实测数据完好无损。

[Wang-Lin-Chang]

Update 12: dsh-megamesh v0.12.0 — bidding/evolution now governs a real parameter: the regression army's shard count.

更新 12：dsh-megamesh v0.12.0——竞标/进化接管真实参数：回归军的分兵数。

The parallel-universe strategy layer used to run on simulated battle reports. Now it bids over a real knob:

• regression-army: 24 experiment devices re-run as a sharded regression suite — scouts + federal brain, real timings ledger on disk.
• E25: EXP-1 first run (6 scouts, all green) → EXP-2 bid replays makespan over the real ledger (parallel penalty measured: 22-way parallelism actually thrashed the heavy devices) → EXP-3 evolution over the full domain converges to the same 3 scouts under one shared tie-break rule → EXP-4 real re-run at the bid N: 169.3s, all green. Bid replay 179.1s ≥ real 169.3s — the ledger keeps the penalty, the estimate errs conservative.
• On its first shift the regression army caught 4 real bugs before they shipped: a block-scope ReferenceError in E22, an intermittent mesh-test false positive (PowerShell [int] rounding vs Math.floor — a ±1s cross-source tolerance fixed it), a recursion hazard (the E25 driver spawning the army it imports — fixed with an isMain guard), and a silent-catch debt item.

68/68 assertions, three-platform CI green, word-scan clean, deploy-army green. npm: npm i dsh-megamesh (v0.12.0).

[Wang-Lin-Chang]

Correction to Update 12: the CI badge was red when I posted it.

Update 12 纠错：发帖时 CI 实为红，我写成了绿。

Update 12 claimed "three-platform CI green". That was false at posting time — I published v0.12.0 before checking the CI result, and CI was red on all three platforms (ENOENT: lab/bad-words.json was never shipped to the repo or the npm package, while the word-check gate reads it; the local tree had the file, so local tests stayed green and masked the break).

Fixed in v0.12.1:

• lab/bad-words.json (the word-check data) now ships with the GitHub repo and the npm package.
• npm dsh-megamesh@0.12.0 is deprecated with a pointer to 0.12.1.
• The release ledger records this as a foreseeable accident (published while CI red).

The honest boundary: my local green run is not a substitute for the CI verdict, and a promo post must not claim a green badge it has not seen. Verify, then speak.

[Wang-Lin-Chang]

Update 13: dsh-megamesh v0.13.0 — three honest upgrades, each with a control group.

更新 13：dsh-megamesh v0.13.0——三项进化，每项带对照组。

This round questions a mainstream default instead of copying it:

1. Parallel-penalty-aware scheduling (E26). The old makespan model was blind to contention — replay tied for N=2..8 (measured, not asserted), so it couldn't justify any shard count. Now the penalty coefficient α is fitted from a real 6-tier collection run (median of per-device inflation), and the scheduler picks a unique, data-backed N. The old model's blind spot is now a measured fact, not a slogan.
2. Audit army (E27). Multi-agent cross-repo inspection (12 repos × 4 gates = 48 tasks, scouts sharded + federal brain) replaces my hand-written serial audit scripts. On its first shift it caught two real signals — a red CI run and post-push local drift — and a planted trap was caught too. N=1 vs N=4 control: same verdicts, ~2.7× faster.
3. Federal brain cross-examination (E28). "Pick the max severity" is the mainstream default — we poisoned it twice in a control experiment and it got hijacked both times (severity=999 decrees). The court now runs chair proposal + independent consistency and MAD-outlier votes; both poisonings were blocked, a real positive was not mis-killed, and vetoed decrees are held with a dissent record.

84/84 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.13.0).

[Wang-Lin-Chang]

Update 14: dsh-megamesh v0.14.0 — the experimental features from v0.13.0 now serve the real release pipeline.

更新 14：dsh-megamesh v0.14.0——v0.13.0 的实验能力进真实发布流水线服役。

Two abilities stopped being demos and became production paths:

1. Scheduler on duty (E29). regression-army --auto now picks its shard count from the penalty-aware scheduler: α fitted from the collected ledger (α=0.045, data-fitted, not asserted). Control run: α-picked N=2 (145.3s, green) vs pure-makespan bid N=3 (146.9s) vs fixed N=3 (146.3s) — all green, the choice is now uniquely data-backed.
2. Dual-army release (E30). Releasing now runs two armies: deploy-army (this repo's three gates) + audit-army (12 repos × 4 gates). The audit army gained a review round: failures are re-checked by a different scout — a planted transient failure got flipped, a planted real violation got double-confirmed. Review filters false positives; it does not dilute real debt.

84/84 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.14.0).

[Wang-Lin-Chang]

Update 15: dsh-megamesh v0.15.0 — questioning two more mainstream defaults, with data.

更新 15：dsh-megamesh v0.15.0——再质疑两个主流默认，用数据说话。

1. Timeout-penalty scheduling (E31). Mainstream schedulers minimize makespan ("pick the fastest"). We asked: is fastest still fastest when parallel load thrashes heavy devices? We measured timeout-rate vs shard-count for real (including the 22-way full-parallel tier). Honest result this round: 0% timeouts on this machine — the historical 776s thrash was the product of load + a bug we have since fixed, not a deterministic function of shard count. So the risk term is wired in (risk-adjusted cost = penalized makespan × (1 + γ·r(N)), γ anchored by the worst measured tier) and currently γ=0 — the data says 0, so we say 0. The mechanism activates automatically if thrash reappears. We do not fabricate risk the data refuses to show.
2. Review round after court veto (E32). "One vote settles it" is the default. We poisoned that: a single-sample noise report flips a veto into a release in the review round (measured), while a stable fake positive is confirmed across two independent samples (measured). A veto is now the start of a review, not the end.

Also: the new unit tests for the scheduler caught a real bug in the outlier check (a dead branch: mad || 1 made the zero-MAD path unreachable). Coverage debt is being paid down module by module.

93/93 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.15.0).

[Wang-Lin-Chang]

Update 16: dsh-megamesh v0.16.0 — questioning "calibrate once, freeze forever" and linter one-size-fits-all.

更新 16：dsh-megamesh v0.16.0——质疑"一次标定永久冻结"与 linter 一刀切。

1. Alpha ledger with drift (E33). The scheduler's contention coefficient α is a function of machine load — we measured three rounds: 0.081 → 0.045 → 0.076. It drifts. So we keep an append-only history and ran a leave-one-out comparison of three update policies (freeze / sliding window / EMA). Honest verdict: N=3 has no discrimination power — freeze and sliding tie — so the policy is recorded as indeterminate and production uses the latest measured round. We do not pretend a winner exists. Bonus honesty: round 3 (0.076) looks like round 1 (0.081), which we had labeled "contaminated" — the data questions our own label. Labels and data are stored separately now.
2. Empty-catch review (E34). "No empty catch" is the linter default. We classified all 20 programmatically: 9 are protocol exemptions (file-missing / race conditions are normal states), 11 were real debt — all converted to logged errors, exemptions marked with comments. Debt ledger D3: 18 pending → 0 (every site now has a verdict).

Also D6 determinism debt cleared (seeded the one unseeded random in the bidding experiment — verdicts are reproducible now).

93/93 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.16.0).

[Wang-Lin-Chang]

Update 18: dsh-megamesh v0.18.0 — who audits the auditor? Measured.

更新 18：dsh-megamesh v0.18.0——谁来审计审计器？实测回答。

The mainstream default is that an audit tool audits your code and nobody audits the audit tool. We questioned that (E36):

• Three independent implementations (per-word regex / per-word indexOf / byte-window scan over UTF-8) cross-check the same targets — the baseline agrees on identical hit sets, so the cross-check is a real cross-check, not the same code run twice.
• Blind-spot injection: F_1 skipped the .txt extension (a realistic auditor bug). F_2's independent implementation caught the missed hit; the divergence goes into an append-only ledger with a human-review marker. Control group: a single auditor reports 1 hit where truth is 2 — silence about its own blind spot is the mainstream status quo, quantified.
• Recursion, two levels measured: F_3 (byte-stream) spot-checks F_2's results — zero divergence, two layers settle the verdict. The audit army's word check now cross-checks its own zero-hit verdicts with the second implementation.

One device fact worth publishing: the regex-union implementation and per-word scanning genuinely diverged on overlapping words (prefix/substring cases) — our own unit test caught it before release. The three paths were unified to one semantic contract (different algorithms, same contract).

99/99 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.18.0).

[Wang-Lin-Chang]

Update 17: dsh-megamesh v0.17.0 — a narrative-dialogue fusion engine, measured.

更新 17：dsh-megamesh v0.17.0——叙事-对话融合引擎，实测落地。

Two of our own plugins, fused and measured end-to-end (E35):

• Anchor chain (dsh-anchor). 20-turn long-range dialogue, each turn pre-commits intent then reconciles observed vs expected. An injected out-of-character turn was caught on the spot (DIVERGED) and a narrative repair rewound to the last consistent anchor and re-committed — 19/20 OK, 1 caught + repaired.
• 14 narrative invariants (dsh-story). Three injected violations (negative asset, realm regression, dead-character event) — 100% recall; a clean ledger shows zero mis-kills. The control group: unanchored chat has zero perception of the same drift — the fusion engine turns the mainstream status quo into something detectable.
• Dialogue report. Scouts submit a ~95%-compressed mood summary instead of the full transcript.

The honest boundary: this experiment imports the two repos' sources locally; it is excluded from the CI regression list because CI lacks those checkouts — stated, not hidden.

93/93 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.17.0).

[Wang-Lin-Chang]

Update 19: dsh-megamesh v0.19.0 — adapters should grow themselves, not hire one human per framework.

更新 19：dsh-megamesh v0.19.0——adapter 该自己长出来，而不是每个框架雇一个人写。

The mainstream status quo: a new framework appears, someone hand-writes its adapter. We questioned that (E37):

• adapter-evolver: scans a framework's npm package (package.json entry + dynamic-imported export surface) — LangGraph scan: 94 exports, recognized Graph/StateGraph as the doWork primitive — and generates a 5-function contract skeleton. Recognized primitives get wired; unrecognized ones are honestly marked "awaiting human confirmation" — the skeleton does not pretend to be executable.
• Meta-contract: the primitive map translates the framework's own language to the protocol language (queue/worker → claimTask, graph/agent/crew → doWork, lock/health → heartbeat) instead of hard-coding contract names — the hard-coded list and the meta-contract coexist as two paths.
• Shadow-court promotion reused: the E16/E17 Wilson criterion — a candidate adapter must survive 20 shadow runs with zero mis-kills before promotion. The E12 real-library data feeds the baseline.

Also: the dependency-graph preflight gate caught the skeleton template's import line being counted as a real dependency — fixed by not hard-coding paths in the template. The gate polices the generator itself.

103/103 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.19.0).

[Wang-Lin-Chang]

Update 20: dsh-megamesh v0.20.0 — Byzantine signatures measured, federation written as a spec that says "unmeasured".

更新 20：dsh-megamesh v0.20.0——拜占庭签名实测，跨机器联邦写成"未实测"的规范。

Two more prophecies land — with the honest boundary intact:

1. Byzantine signatures (E38, measured). Crash tolerance ≠ Byzantine tolerance, and we kept that line. What a single machine CAN verify — Ed25519 sign/verify (tampered, forged, and wrong-key reports all blocked), strict 2/3 endorsement quorum (N=5 requires 4), and the D-10~D-12 death-code classifier (signature forgery / double report / collusion signal) — is measured, with a control group showing unsigned reports have zero tamper perception.
2. Two specs, honestly labeled (v0.1). byzantine-spec.md: cross-machine collusion, partition timing, and weight calibration are listed as "awaiting community measurement" — we do not claim them. federation-spec.md: the CRDT battlefield graph, the Raft term-lock mapping, and the bandwidth protocol are written as a spec that says unmeasured. autopsy-spec bumps to v0.2.0 with D-10~D-12 (the prophecy's trigger signal).

111/111 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.20.0).

[Wang-Lin-Chang]

Update 21: dsh-megamesh v0.21.0 — a beautiful equation, put through the furnace before it enters the README.

更新 21：dsh-megamesh v0.21.0——一个美丽的方程，进 README 之前先过炉子。

The self-reference equation 𝓡² = 𝓡 + 𝓘 has eigenvalues φ and -1/φ — algebraically airtight, and its structure maps to our audit tower (F₀ code → F₁ audit → F₂ meta-audit → F₃ meta-meta-audit, three levels really running since E36). The beautiful claim is that per-layer residual divergence decays by 1/φ. We measured instead of believing (E39):

• Analytic boundary first: under an i.i.d. per-layer detection rate p, the decay ratio is exactly 1−p — so φ-decay holds iff p = 1/φ² ≈ 0.382. It is an equivalence condition, not an intrinsic property. The proposition became falsifiable before we ran anything.
• Measured: at p=0.7, measured decay 0.312 vs analytic 0.300 ✓ (20 seeds × 2 ratios); at p=0.382, measured 0.616 vs 1/φ = 0.618 ✓. The special case reproduces; other p's do not — φ is a special case, not destiny.
• Honest verdict: the structure layer landed; the φ coefficient remains a special case until a real defect corpus yields a measured detection rate of exactly 0.382. We do not claim the constant from a special case.

117/117 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.21.0).

[Wang-Lin-Chang]

Update 22: dsh-megamesh v0.22.0 — ARENA: a model is a witness, not a judge. A conclusion must win its bout before it earns trust.

更新 22：dsh-megamesh v0.22.0——ARENA：模型是证人，不是法官。结论打赢擂台才值得信。

We designed this one ourselves, on top of the pieces we had already measured (E40):

• Witness claims: a model declares its identity and accumulated credit with every claim — the stance is auditable, not hidden in GPU memory.
• Structural court (no semantic overclaim): the war-law layer checks structure only — dangling references, circular reasoning — because graph algorithms cannot check semantic entailment, and we say so.
• Three-vote arena: chair + consistency + MAD-outlier — the last two are non-LLM lines of defense, the countermeasure against same-architecture Transformers sharing the same hallucinations (measured: contradictory and outlier claims get contested).
• Two dimensions we haven't seen elsewhere: a rejected conclusion is not deleted — it sleeps in a parallel-universe branch and can be revived by new evidence; and the verifiers themselves hold rotating terms — two misjudgments and a judge's credit is reset to zero. Fixed judges corrupt; rotating ones don't.

Cost is metered per API call — determinism is bought with calls, and the bill is auditable.

127/127 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.22.0).

[Wang-Lin-Chang]

Update 23: dsh-megamesh v0.23.0 — ARENA ran its first real-model bout.

更新 23：dsh-megamesh v0.23.0——ARENA 第一次真模型擂台赛。

The arena protocol left the mock world (E41):

• Two real DeepSeek models (v4-flash + v4-pro) generated witness claims for the same question — 5 API calls total, metered.
• The structural court consumed real outputs (references exist, no cycles) — 0 violations.
• The three-vote arena produced a winner on real claims.
• Hallucination gold standard (an unknowable question — the 2027 Nobel physics laureate): the single model honestly answered "currently no one knows", and both models did. The data says these models did not hallucinate on this injection — we report the data as it is, not as the hypothesis wanted. The disagreement-as-signal detector is in place for when a model does fabricate.

127/127 assertions, three-platform CI green, word-scan clean. npm: npm i dsh-megamesh (v0.23.0).