# Deepwork settings and status

DSMM 0.3.16 targets exactly DSH `0.2.1-rc.2`. Named policy is covered in [profiles](profiles.md), routing in [model routing](model-routing.md), and child authority in [Agent presets](agent-presets.md).

## Deployment layers and native editors

Effective settings resolve from **defaults → sparse global base → explicit native entry/profile override → admitted immutable named overlay**. The global base is `<resolvedDshHome>/plugins/dsmm/config.json`; a missing file is an empty layer. This is DSMM's storage convention, not a mandated Host layout. Trusted home resolution uses explicit `profileContext.home`, then `DSH_HOME`, then the official home default.

<a id="native-plugins-configuration-d"></a>

**Plugins → DSMM bundle config** is the single deployment configuration surface, registered as `plugins.bundle.config` for `@dsmm/dsmm`. The scope selector chooses Global or current native-profile overrides. Five flat tabs cover Run and modules, Model routes and recovery, Workflow/roles/subagents, Permissions and safety, and Configuration state; Other/advanced appears only for ungrouped schema fields. Global edits use fixed `remote.dsmmConfig`. Profile edits use the public native form resolved from the authenticated snapshot's actual namespace. Runtime entry ID, package ID, row ID and form namespace aren't interchangeable. A profile write requires the actual descriptor revision and matching raw base/user provenance. Missing or mismatched identity leaves the profile scope unavailable or read-only, never falling back to Global. Named Profiles retains its separate Settings/header entries; no duplicate permission page or Conversation configuration tabs are registered.

Global and native-profile controls have independent Save, Refresh and Discard actions and revisions. There's no Save all or cross-layer transaction. Missing keys inherit, explicit same-default values pin, and Unset removes only the edited layer's key, not a higher Host pin. Plain objects merge recursively and arrays replace. Full merged validation follows sparse-layer validation; unknown/prototype keys, non-JSON values and raw volatile refs refuse.

Native structural controls and bounded schema-aware Advanced JSON cover applicable deployment settings. Advanced input is strict JSON, not named-document JSONC. Invalid text and conflicts stay visible. Refresh preserves dirty input and its original revision; explicit discard/reload rebases it. Connection replacement, disconnection, entry replacement and disposal fence old writes. Saving doesn't restart, cancel, apply a named profile or respawn LSP.

Configuration edits and Global rules are separate transactions. Writable Global configuration needs no main session; Global rules use a trusted main session as their management entry but persist globally for contexts using that policy. Each transaction retains its own draft, CAS, Save, Refresh and Discard. Global rules read on opening, session/owner/connection changes and explicit Refresh, without periodic polling or timed retries after failure. Save adopts its returned result. First load and explicit Refresh show loading; automatic reads over an existing observation keep its presentation stable. A same-session scope gap, owner rebind or connection change keeps the last successful rules observation readable as an explicitly unconfirmed projection while withdrawing mutation authority; a real session switch clears it. Other external policy changes are observed on the next read or save, with current authority and CAS checked by the Host on every mutation. Observed revocation, conflicts, disconnection and unsynchronized runtime still withdraw the affected mutation authority without discarding its draft.

LSP isn't an applicable UI setting in this version. Its implementation, interfaces and original configuration remain, but DSMM settings hide LSP controls and automatic MCP mounting stays off even with stored `lsp.enabled:true`. Neither a save nor a restart enables it. DSH's own LSP and independently configured MCP are unaffected; the retained historical manual patch isn't a supported DSMM activation entry. See [LSP boundary](lsp.md).

### Save authority and concurrency

`dsmmConfig.describe`, `describeModules`, `describeSettings` and `save` use the existing local writable operator boundary. The native invocation peer must equal `connection.operator`, public `webServer.host` must be exactly `127.0.0.1`, and `settings.writable` must be true. A client loopback assertion, tunnel or reverse proxy isn't authority. These aren't model-visible tools and accept no arbitrary file, root or entry arguments.

Global saves use expected metadata versions, cooperative locking, a final version recheck and same-directory atomic replacement. `stat-v1-<mtimeNs>-<ctimeNs>` is not a content-integrity proof. Authority and lifetime are rechecked before commit. Rename commits the save; a failed final observation returns success with `revision:"unavailable"` and `refreshRequired:true`, requiring refresh before another mutation. Native-entry versions use the actual `settings.describe` descriptor (`native-v1-<revision>`) or report unavailable. Native-profile saves retain the Host's numeric form revision CAS. External editors can still race at rename or change content without a distinguishable stat version. A save acknowledges its layer, not adoption by every live consumer.

Native ConfigEditor can emit `loader/partial-dispose` during empty-pending reconciliation without actual fiber or Agent disposal. The signal alone isn't proof of a lifecycle change; consumers must observe actual lifetime and admission boundaries.

<a id="global-module-ceiling-d0"></a>

## Availability and capture

`modules.deepwork.enabled` is a global-only ceiling and defaults true; ordinary `defaultActive` defaults false. Native profile overrides and named/session overlays can't enable the module. Cold-off leaves Core storage, captures/CAS, configuration/status and mandatory native permissions available, without mounting DW role/routing/recovery substrate. DSMM-managed LSP stays off independently of this module ceiling. Static preset files aren't proof of callable roles.

On a mounted Host, desired-off affects new root admissions and cold role continuations, not existing residencies or freshly delegated children inheriting a parent's admission. Desired-on after cold-off remains restart-required until an independent Host restart. No hot-mount or restart queue is implied. An idle profile change doesn't absorb newer global deployment. Mode-on can't bypass an admitted off module; mode-off can replace saved on intent without pretending the module was active.

The inspector separates merged desired, startup-mounted/captured, next-root preview, and current-session admission. Without an actual session, current admission is unknown. Host bundle enablement also remains unknown when the public interface can't observe it. Sources, capture origins, global file version, native descriptor version and named snapshot reference aren't one acknowledgment.

`rootModelPolicy` is deployment-only: Global and native-profile accept `native` (default) or `configured`; named overlays reject it. An explicit native-profile value overrides Global, and Unset restores inheritance. The policy is captured with admission rather than startup-pinned: saving changes desired configuration, not an existing Agent's captured policy. `configured` enables configuration-led routing for admitted roots with an effective DSMM role and Deepwork module enabled, regardless of whether their client is Web or TUI. It does not enable a module or grant a role. Status reports the captured value and its source only when admission is known; see [root routing policy](model-routing.md#root-policy-and-child-defaults).

`presets` only carries materialization settings (`materialize`, optional `root`). The dispatcher is the only standing root; there is no per-role root switch, and named overlays cannot configure presets. See [roles and composition](agent-presets.md#roles-and-composition) for the selection roster, forced creation/resume and read-only boundaries.

`permissionControl.enabled` defaults true independently of Deepwork. Permission settings are deployment-only: Global and native-profile settings may save them, while named/session overlays cannot. Only `enabled` is startup-pinned: live saves do not remount or change its admitted value, including for newly created roots; a difference is reported as `permissionControl.enabled` restart-required. A separate cold start captures the new toggle. Dynamic outside-read, web and persistent rules require runtime revision synchronization rather than restart. OFF does not disable Core guards, readonly, native sandbox/approval or tool filters. Configuration and startup admission do not establish that a permission executor is mounted or synchronized. Actual native standing `danger-full-access` is full access: DSMM adds no ask, downgrade, path permit or refusal for unknown operations or missing classification facts. Only a deterministically matched existing explicit deny blacklist may produce a native pre-approval denial. A requested mode or configured command target alone isn't effective native authority. See [native permissions](native-permissions.md).

The rules RPC writes the global DSMM layer. A native override of outside-read, web or rule policy refuses that RPC save; edit or unset the native override instead. An enabled-only native override does not shadow dynamic policy. Ordinary configuration Save still writes its chosen layer, and the runtime uses the resolved global/native policy rather than assuming every global edit wins.

When enabled, simple command strings in `permissionControl.nativeCommands.entries` take priority over DSMM command rules and legacy command entries: a match skips their ask/deny decisions and automatically approves native `danger-full-access` for that invocation. Unmatched calls retain the ordinary policy path. The grant does not change the session's standing sandbox or transfer to another call; current invocation identity, cancellation and role/tool eligibility still apply. Native approval policy `never` cannot be overridden through the rc2 answerer. Legacy object entries retain their stored scope and behavior when no simple string matches.

The Host installs `installDeploymentPermissionRules` in its owned Core fiber with `agents` injected, the actual `DsmmDeploymentConfig`, a pure writable-Root check and an awaited notification callback. Its `initial` snapshot, `runtime` sync owner and backend are the collaborators for the permission controller and the single permissions RPC. DSH owns approval: an actual manual approval is final for that call and approved scope, without a DSMM post-approval veto from older rules, epochs or internal gates. DSMM has no independent approval queue, UI, TTL or session permit memory. The ordinary `managed-settings` module retains native SettingsForms and supplies only a scoped `configEditor.edit` façade; the root ConfigEditor and its locks, form CAS and reconciliation remain native-owned. Missing or retired ownership refuses managed saves, not an actually approved call. These source interfaces require the corresponding cold Host composition; configuration alone is not mounting evidence.

Permission revisions identify the Host profile scope and current global-file/native-descriptor versions, not configuration content integrity or per-rule version maxima. Missing native version authority refuses synchronization. Controlled saves reread storage and publish policy only after notification acknowledges it. A committed global save remains successful with refresh required when postcommit coordination fails; runtime synchronization is a separate state. Notification failure exposes saved/runtime revisions as unsynchronized; recovery rereads authoritative storage. Version, ownership and synchronization checks protect configuration writes and policy adoption, not a second call-approval gate: permission-source changes neither cancel pending native approval nor let DSMM override an actual same-call approval. New calls consume current policy. Conflicts and recovery preserve dirty editor drafts. Native and ordinary JSON rule imports receive `user-import` provenance, while rules RPC provenance comes from the live operator authority. Persistent provenance isn't native approval or a reusable grant. A native once grant doesn't widen session permissions or authorize another call, and a narrower grant isn't full access. Native rejection, caller/native cancellation and original OS failures remain possible; approval doesn't guarantee command success. Only `enabled` remains pinned to the mounted runtime; a desired OFF cannot turn off running controls before restart.

Read-only configuration projections redact LSP command/arguments/cwd, preset root and recovery prompt; environment values and names aren't disclosed. Authorized sparse editor input is a separate boundary, not a status DTO. A missing projected field is absent; an unavailable layer is unknown, not an invented default.

Only relevant effective permission changes coordinate revocation. Unrelated locale, display or model edits don't turn an old DSMM epoch into a second approval gate. Operator, connection, source and owner lifetime are rechecked after awaits and before irreversible writes. Missing or replaced authority refuses a configuration mutation; it doesn't create a reusable approval or justify replaying an unconfirmed save.

## Runtime controls

`/deepwork [off|message]` changes the receiving session's mode. Explicit intent, including a same-default choice, is separate from profile defaults. Official minimal conversations default off; DW presets and freshly admitted role children default on unless explicit intent says otherwise. Off hides common workflow/DSMM skills, not persona, read-only restrictions or host/Git permissions. Busy mutations refuse instead of queuing. Persisted mode/profile intent doesn't grant current DSMM role admission after reconstruction. Slash commands belong to the native command adapter, not headless task text.

`canSelectModel`, `canToggleMode` and `canApplyOverlay` describe independent actions and refusal reasons. Live overlay Apply is unavailable (`new-session-required`); save/select a future default for a new session. This doesn't disable ordinary mode changes or **Use profile model** where their own native service, idle/session identity and manual-intent checks pass. Use profile model selects from admitted immutable configuration, doesn't write a profile pointer, and respects a newer manual choice even when its value is unchanged.

`/dsmm-status` reports normalized bounded state; `/dsmm-status json` returns a defensive version-1 snapshot. Status separates admitted profile/revision/epoch, actual route state, effective settings and captured module/runtime binding. Roots using `rootModelPolicy: "native"` report native-owned effort and keep the native model tab's route. Eligible `configured` roots report configuration-led routing and its bounded recovery state. `profileModel` is a declared route, not proof that selection or execution already happened.

`dsmm-status` is reserved. Setting `modeName` to that exact value normalizes the mode command to `deepwork`, preserving the independent inspection command. Status computation doesn't select a model or contact a provider.

`workflow.policy` accepts `risk-based` or `legacy`. Explicit policy wins. Without it, explicitly supplied `strictGates`, `reviewCap` or `finalReviewPolicy` selects legacy; otherwise risk-based is the default. Named role restrictions retain required Orchestrator/Planner/Plan Critic, plus legacy-conditional Reviewer/Oracle. They can't enable a role outside startup/deployment ceilings.

`roleRouting[id].levels` accepts only explicit `low`, `high` and `max` overrides; invocation omission means `normal`. These are call resources, not workflow tiers or generated roles. `subagents.toolTopology` defaults `per-role` and may be narrowed/configured in a named overlay. Background, depth and route-override permission remain deployment-only. `subagents.allowRouteOverride` defaults false. See [routing](model-routing.md) for the exact tool and target grammar.

`locale` is an optional visible-output preference using the supported locale IDs in [profiles](profiles.md#inheritance-and-ceilings). Omission inherits; the current user's explicit language request wins. It doesn't change UI locale or protocol vocabulary. Retired brand-calibration/default-effort and MaxReasoningPresets fields reject with `deprecated-field`; there is no automatic migration. See [generic model parameters](model-routing.md#generic-model-parameters). The only nonblocking document warning is `blank-label`, with schema-safe diagnostics and source location where available.

## Child runtime composition

Default deployment waits for the native activation result: `enableRunInBackground:false`, and omitted `maxDepth` delegates to the native Host limit. Captured settings and actual native capabilities determine availability. A configured flag isn't execution or completion evidence.

Official AgentRegistry, SubagentRuntime and JSONL namespace plugins own execution and storage. DSMM adds scoped admission and policy, not a replacement Registry/Runtime, manual owner selector, companion or separate result queue.

The [bundle patch](../cordis.patch.yml) adds DSMM to the native composition. Core configuration/status/permissions don't require active Deepwork or a child task. `runtime.enabled` isn't a current owner selector. Desired source, mounted capability and actual live admission remain separate facts.

`subagentRuntime` projects native `binding: stock | unavailable`, DSMM admission readiness (`deliveryFenceReady`), restart requirement and a bounded reason. Readiness observes the native subagent service and activated, current DSMM admission owner. It doesn't certify every Agent, provider/control capability or restricted-role recovery across restoration. No experimental SDK API or global registry binding check is required. Saves retain actual native form revision/authorization and don't remount services.

Enabled background work must choose `run_in_background:true` before `startActivation`, using `delivery:'parent'`; otherwise delivery is to the waiting caller. Accepted child/message IDs aren't completed results. Running waiting calls have no handoff action. Native receipt disposal handles cancellation after publication and waits for cleanup.

Live direct-child Queue/Steer/interrupt require actual capabilities and exact parent/operator/lifetime authority. Read-only descendant inspection grants no control. Readiness loss closes DSMM execution; stale handles don't grant authority. Agent-scoped guards remain fail-closed after owner retirement. Hot replacement isn't a promise of uninterrupted live-session operation.

Native history loading and lifecycle remain Host-owned. A restored root or valid continuable role child obtains a fresh admission using current content and role policy; persisted choice revision and actual admission revision/epoch remain separate. First creation retains exact pending-call checks, while continuation validates native own identity, direct parent/catalog, current provider and composition. Readonly, filters, depth and cancellation remain enforced. Old objects and owner closures stay revoked, and old approvals/retry budgets are not restored. Read-only inspection never wakes Agents, and no automatic history rewrite is supplied. See [runtime recovery](runtime-recovery.md#cold-resume-and-lifetime) and the precise [Host limitations](compatibility.md#native-history-composition).

*Author's note: For a DSH deployment operator; distinguish a successful configuration save from captured runtime availability before applying policy.*