v1.3.16 — DSH 0.1.5-rc.1 原生适配 + MCP 代理对齐 restrict ACL

为什么

DSH 0.1.5-rc.1 下 kixparadigm 完全无法使用：preset 挂载即抛错 → session/openWorkspacePath 失败 → 客户端 catch 吞掉 → 工作区选不上 → GUI composer 永久 data-phase="inert"。

A/B 对照（同一份 DSH_HOME）：default: standard 正常，default: kixparadigm 卡死；切 preset 弹出原始报错：

无法切换到「kixparadigm」：failed to apply loader entry persona-incentive
(@deepseek-ai/dsh-persona): invalid config: $.prefix missing required value

两处破坏性变更

1. dsh-persona 配置改名

0.1.2 的必填 text 在 0.1.5 变成必填 prefix（+suffix），prompt section 拆成 DEPLOYMENT_PERSONA_PREFIX / _SUFFIX。

修法：persona 行改用 YAML 锚点同时给出 text 与 prefix（同源，不复制文本）。schemastery 不拒绝未知键，实测两版都能挂。consistency-lib.cjs 的 persona 预算提取同步接受锚点前缀——否则锚点会让预算检查静默空转。

2. 子代理 toolFilter.deny 含 subagent → 每次派发 throw

dsh-subagent 的 applyChildComposition 调 composeFrom(childCtx, parent.ctx)，把父 preset 挂进子代理自己的 layer；view(scope).restrictableNames 只含 inherited（全局 + 祖先，不含 own layer），故 own-layer 的 subagent 不在可 restrict 名单里，restrict({deny:['subagent']}) 抛 names unknown global tool "subagent"。

view() / restrict() 在 0.1.2 与 0.1.5 逐字节一致 —— 这是两版共同的真缺陷，此前只在线上的安装副本手改过、仓库未回填，重装即复发。四份 preset 共 32 处 deny 名单移除该名；嵌套派发仍由 kix-cost 的 tools.guard + harness maxDepth 拒绝。

MCP 代理对齐 restrict ACL（同批）

• kix-focus：kix_capability_call 对被 restrict deny 的全局 MCP 省略 agent 走全局 execute（restrict 是继承面执行 ACL，带 agent 即 UNKNOWN_TOOL）；scope 可见工具仍带 agent。
• kix-guards v19：外层 kix_capability_call unwrap args.tool，GitHub 写 main/缺 branch 与直呼同一 checkGitHubWrite。

验证证据

隔离实例（装入仓库产物）：

项	0.1.5-rc.1	0.1.2-rc.1
preset 挂载	成功，无报错	成功
persona 进 system prompt	✅	✅
kix_* 工具注册	7 个	7 个
restrict.applied / denyCount / error	true / 52 / null	—
可见面 mcp__ 工具数	0	0
subagent_lite 派发	echo kix-subagent-ok → 原样返回，exit 0，autoActivated=true	—

npm test exit 0；CONSISTENCY OK；四份 preset YAML 解析正常且 prefix === text。

说明

同批入库 2026-09-10 的既有工作区改动（kix-cost 机械档路由继承、kix-route vendor 族归一、相关文档与技能）。

残余不确定：kixparadigm-classic / -null / -en 拿到了同样的机械修复与 YAML 校验，但没有各自跑一次 GUI 挂载实测；实测覆盖的是 kixparadigm（默认档）与官方 standard 对照。

v1.3.15 - runtime hardening batch

内容

承接 v1.3.14 之前已在运行态的改动，本次一并入库：

• 执行终态单源 execution-result.cjs（四根）：修掉 kix-discipline 把非零 bash exitCode 与后台 spawn 记成 green 证据的误判（canonical {kind:'foreground',exitCode} / {kind:'background',jobId}）。
• 门禁/焦点/编排/纪律/信号/停滞/浏览器/预算/成本/路由加固 + 回归补测，四变体同步（kix-stalled 补单测）。
• 视觉桥豁免：只对真正具备视觉能力的模型调整接管条件。
• kix-webauth：回环绑定 + 回环 Host 时跳过一次性 token（Host/Origin 反 DNS-rebinding 栅栏保留）。
• docs/：kix-general-evolution、kix-runtime-verification、kix-vision-exemption。

门禁

npm test 59 pass / 0 fail / 1 skip · 四变体一致性守护 OK · en CONSISTENCY OK · CI 10/10 pass

未覆盖：外部供应商推理、故障注入、完整 Web 会话执行记账 E2E。

v1.3.14 - DSH 0.1.2 integration

内容

DSH 0.1.2 原生能力对接：

• web_fetch 打开（tool-web.config.fetch: true）：0.1.2 宿主默认挂载 SSRF 加固的 dsh-web-fetch-http，0.1.1 关闭的理由已消失。实测 web_fetch https://example.com → HTTP 200 + 解码正文。
• kix-webhook：外部事件 → kix 会话（发布默认关）：规则层插件 + 13 单测；enabled: false；激励面两副本字节一致，classic/en 不部署。实测签名 POST → 202 → 新建 webhook-* 会话（preset=kixparadigm）→ 会话真实执行。
• 原生子代理模型选型：验证可用、不默认开：两条机械理由写在 dsh/README-DSH.md。

新增机制事实（实测）

• profile 的 patch 覆盖不到 preset 组成内部的行 → 启用必须改预设文件
• 预设是 lazy mount：冷启动无会话时投递只回 202、不起会话
• 202 ≠ 处理成功：入口校验失败才回 4xx/5xx，规则/建会话失败只写宿主日志

门禁

npm test 50/0/1 · check-dsh-consistency OK · kix4 composition parity PASS · audit-selection-pressure --check exit 0 · 0.1.2-rc.1 端到端复验 · 独立观察者 4 findings 全修 · CI 10/10 pass

v1.3.13 - self-bootstrap audit closure

v1.3.13（2026-09-08）自举审计闭环：单源、悬空引用、守护布局无关

• 能力地图单源：skills/kixpower/dsh-capability-map.md 经 diff 确认是 memories/dsh-capability-map.md 的旧子集（140 vs 202 行，无独有内容），删除重复副本。全部锚点由 §数字 改标题——classic 是 §6、默认档是 §4，只有标题「动态 Cordis 插件实测机制事实」两档都能命中；引用方 kix-stalled.js/kixpower-v39-legacy-notes.md/kixpower-workflow.template.md 同步改标题锚点。
• 悬空引用系统性清零：默认档不部署 DSH-ADAPTATION.md/PLUGINIZATION-ROADMAP.md/agents/，却有 13 处按「preset 根」断言引用（含 skills/kixpower/SKILL.md 的「冲突时以该文件为准」权威指针）。13 处改为「classic 档」限定；新增 dsh/preset/agents 指针（与 skills 同款 120000 gitlink）并在安装时物化，货架内 ../../agents/*.agent.md 5 条断链归零——四变体 checkMarkdownLinks failures=0（此前安装副本 5 条）。
• 守护自身布局无关：PLUGIN_IDENTITY_GROUPS 由仓库路径改按变体名解析（只认已知仓库路径/安装目录名，外仓同名目录不并入）→ 安装布局下 kix-consistency.test.js 从 160 passed/3 failed 变为 168/0；live 探测支持仓库/安装两种布局并补安装布局断言；新增「默认档共享货架指针就位」门禁（探针移走指针即 FAIL 点名）。
• 安装器镜像语义：copyTree 只对指针条目按源裁剪（普通目录绝不裁剪——安装副本 memories/ 是 kix-mem 经验库根，误删即数据丢失）；复制保留 mtime 使重复安装幂等；ensureDefaultShelf 每次调用都做镜像同步并裁剪，修掉「packed 路径货架永不重同步」；安装日志把「镜像裁剪」与「目标侧独有」分开，不再谎报「保留未删」。
• 元规则可证伪：registry 11 条各加 proof{file,contains}，校验 support 归属 → 文件存在 → 字面命中 → 非纯注释行，并排除 PRESSURE_REGISTRY 声明块——堵住 4/11 条 proof 的自指空转（改形真实载体即 4 条点名失败）。审计面改为显式契约 + findUnscopedBullets 反向断言（preamble/缩进/编号 bullet 同样被抓）；新增只读 --deaths 计数（7 通道 depth-0 调用 + 首末日期 + 根数），死亡条款从注释变成可结算，并补文档与 KIX_SESSION_ROOTS。
• 易变事实与卫生：yml 断言数/工具数/包数去数字改稳定引用；发布脚本去掉个人路径；persona 恢复被压缩误删的行为约束（不得据此拒绝任务/按风险/执行）并与 en 对齐（4481/4500、9464/9500）；kix-settle ②③ 编号对齐头部；incentive-lessons 求助索引补 ⑨⑩㉑；根 README 与 dsh/README-DSH.md 事实纠正。
• 验收路径：两路独立审查（单源 lens / 规则是负债 lens）→ 修复 → 独立 reviewer 攻击修复本身（3🔴：裁剪越界、proof 自指、指针未入库）→ 再修 → 独立 QA 复验 FAIL（指针未入版本控制、货架不自裁剪）→ 三修 → 复验 PASS（11/11，含 6 个负向探针）。门禁：npm test 25/25、check-dsh-consistency OK、registry --check exit 0、test:pressures 24/24、install-lib 20/20、安装副本 kix-consistency 168/0、四变体断链 0。

v1.3.12 - skill slimming, runtime ingestion, pre-commit lint, cross failover, role-first members

Highlights

kixparadigm skill slimming (-59%)

279→126 lines / 24.7→10.1KB. Removed content with better carriers (VS Code mechanism alignment → DSH-ADAPTATION.md; mechanical restatements → plugin map; cognitive core → persona anchors), kept skill-only increments. Dual-channel comparison fixed 3 drifts and restored 8 zero-carrier deletions.

Runtime layer → repo sync

• orchestration v12 sleep state gate (wording OR in-flight-dispatch count)
• classic-leading discipline/focus/route lifts propagated to all preset roots, identity-group drift eliminated
• live identity-group assertion no longer bound to process.cwd()

Cross-vendor provider failover

subagent_cross children now fail over automatically on provider availability errors (QUOTA/HTTP 402 etc.): circuit-break the failing provider, retry up to 2 healthy alternative vendors within the same child. No manual retry needed.

Role-first resident members (kixpower)

• subagent_reviewer / subagent_dev / subagent_qa are now resident direct tools in all four presets — role-match prefers them; generic subagent is reserved for unowned Explore/research
• Material reviews fan out 2–4 reviewer instances by risk, each with a distinct lens; cross adds provider independence, never substitutes a role
• capability_call keeps a member compatibility entry solely for Sprint current_sprint injection
• New checkResidentMemberBindings consistency gate + negative tests make re-hiding members mechanically impossible to ship
• Delegation audit rewritten: parses only real tool/call events (no more header/schema false positives), counts members by actual tool names, filters source edits by file path

Pre-commit language lint restored

• kix-discipline tracks fmt/clippy per edited extension (remind, not deny)
• VS Code Copilot pre-commit-lint-check.ps1 restored (staged-file rustfmt --check / gofmt; deny only on actual checker failure)

Verification

Full npm test exit 0 (kix-focus 123, kix-consistency 163, kix-discipline 114, kix-orchestration 115, kix-route 91, pressures 11) · CONSISTENCY OK · three-lens frozen-artifact reviewer APPROVE · runtime presets synced and hash-verified identical.

Note: restart DSH and open a new session to load the resident member tools.

v1.3.11 - settlement authority and choice pressure calibration

Highlights

• Separate root settlement authority from evidence-child reporting in kix-settle v5, preventing recursive verdict steering while retaining post-edit verification reminders.
• Tighten verdict parsing, terminal execution evidence accounting, probe failure handling, and stable 1/16 low-risk calibration sampling.
• Move execution-carrier selection ahead of mechanical step decomposition and add history auditing for routing, observer use, calibration, and large direct results.
• Synchronize default, classic, null, and English cognition surfaces.

Packages

• kixparadigm@1.3.11
• kixparadigm-en@1.3.11

Verification

Both npm registry tarballs were downloaded after publication, byte-compared with the frozen release artifacts, installed by exact version into a clean DSH_HOME, and compared byte-for-byte with the currently installed presets and vision bridge. GitHub CI passed on Ubuntu and Windows with Node 20.16 and 22.

Reinstall or sync the packages and restart DSH before opening a new session to activate the updated preset behavior. See CHANGELOG.md for the complete change list.

v1.3.10 — run_code trust posture alignment + active Code Mode choice

Highlights

• Retire the character-level run_code 1b capability scanner and align Code Mode with DSH's bash-equivalent trust posture.
• Keep nested tools.* calls on the full pre-execute path; terminal Git/SQL, control-plane, GitHub, and unknown-tool guards remain in place.
• Put Code Mode into active choice pressure without making it the default, synchronized across default, classic, and English personas.
• Add a source-repository E2E against the real DSH worker for builtin modules, Function, empty env, temporary fs writes, child processes, and loopback fetch.

Packages

• kixparadigm@1.3.10
• kixparadigm-en@1.3.10

Trust boundary

Native fs/network/child_process operations now carry the same trust as bash and are not audited as separate KIX actions. DSH worker containment is not a security boundary, and terminating a worker does not guarantee cleanup of spawned OS processes. Existing installed presets require reinstall/sync and a DSH restart before the v18 guard behavior is active.

See CHANGELOG.md for the complete change list.

v1.3.9 — incentive why-sentences + identity groups + retry-loop parse

Highlights

• Restore the incentive-face why-sentences for two-phase review and heterogeneous observers without expanding classic persona.
• Cluster write-time plugin identity checks so language-neutral copies stay byte-identical and designed variant differences are not treated as drift.
• Stop retry loops caused by scanning data as executable writes: quoted strings, comments, heredocs, script/module argv, push-option values, grep patterns piped to SQL clients, and JS division then comments are not live commands. Real force-push, dest main/master, unquoted DROP TABLE, and writeFileSync still deny.

Packages

• kixparadigm@1.3.9
• kixparadigm-en@1.3.9

See CHANGELOG.md for the complete change list.

npm publish of both packages still requires a logged-in registry machine.

v1.3.8 — provider circuit + recursive review epochs + lifecycle settlement

Highlights

• Circuit-break QUOTA/HTTP 402 providers and steer parent coordinators toward healthy routes.
• Freeze recursive review trees by artifact revision and settle only on terminal lifecycle evidence.
• Recover lifecycle parents from the host child registry, restoring recursive epochs, QA return checks, fresh-observer accounting, and QUOTA feedback.
• Add optional behavior contracts and project native sandbox policy into subagent contexts.
• Safely materialize declared preset directory pointers across PowerShell 7, Windows PowerShell 5.1, native symlinks, and Windows 8.3 paths.

Packages

• kixparadigm@1.3.8
• kixparadigm-en@1.3.8

See CHANGELOG.md for the complete change list.

v1.3.6 — incentive selection pressure + settle v2 + optional contract

v1.3.6

Thinking layer stays the incentive surface; capability surface is a discoverable menu.

• kix-settle v2: high-confidence review verdicts (LGTM / APPROVE / request-changes) without an independent observer this session get an advisory steer. Birth certificate: PR#33 (merry, glm-5.2).
• Optional contract slot on kix_discipline_spec (EXP2 first lever). Not part of completeness. Empty allowed.
• Selection pressure restored without classic-persona re-enable: compressed thinking anchors + utility criteria + on-demand skills shelf + kix-surface catalog group. No agents tree, no ritual pipeline, null stays thin, kix-budget stays off on default.
• Installer: npm pack drops git symlink entries; Windows core.symlinks=false checks them out as text pointers. Installer follows both, and materializes classic skills into DSH_HOME when the packed default has no shelf.

Classic mode still installs via npm variants from 1.3.4:

• kixparadigm + kixparadigm-classic

• EN: kixparadigm-classic-en

• npm: publish from a logged-in machine (npm publish + cd en && npm publish) — this release machine had no npm auth

• PR: #21