# v0.3 candidate validation

Date: 2026-09-10. Package: `dsh-riskproof@0.3.0` (local candidate, unpublished).
Node.js: 22.20.0. Platform: macOS. The local `artifacts/` directory contains the tarball
and machine-readable records, including the SHA-256 of the exact tarball tested.

## Results

| Check | Result | Scope |
| --- | --- | --- |
| Source and test TypeScript checks | PASS | Strict typechecking |
| Marketplace package metadata | PASS | Bundle, browser export, explicit config, peer/runtime boundaries |
| Unit / integration / security regressions | PASS | 172 tests, 18 files |
| Coverage thresholds | PASS | Lines ≥95%; statements ≥93%; branches ≥85%; functions ≥95%; client included and exercised in jsdom |
| DSH 0.1.0-rc.7 tarball install | PASS | Fresh Web and SDK profiles, automatic bundle composition |
| DSH 0.1.0-rc.7 functional host boot | PASS | Legacy base profile, command discovery/demo, restricted write, report, receipt, graceful SIGTERM |
| DSH 0.1.2-rc.1 tarball install | PASS | Fresh Web and SDK profiles, automatic bundle composition |
| DSH 0.1.2-rc.1 functional host boot | PASS | SDK stdio host, command discovery/demo, restricted write, report, receipt, shutdown |
| DSH 0.1.2-rc.1 Web + Chrome 152 | PASS | Real installed package, persistent beacon, actual automatic updates, pending receipts, charts, provenance/scope denials, session switch and reload |
| Desktop and narrow viewport | PASS | 1440 × 1000 and 390 × 844; compact overview does not overflow horizontally; Close and Escape work |
| Browser bundle display and lifecycle | PASS | HTML-like text stays inert, output bounded, late responses rejected, disconnect recovery, hidden-tab pause and cleanup |
| DSH 0.1.0-rc.8 / 0.1.1-rc.2 | PASS locally after shutdown correction | Fresh Web/SDK-named profile installation, real base-host functional checks, graceful exit |
| npm / GitHub / marketplace publication | NOT PERFORMED | Candidate remains local |

## What the checks prove

The installed-host test uses real DSH CLI profile management, loader, tools service, commands service
and session events. Its synthetic write body toggles an in-memory flag; that flag must stay
false under `read-only`. This test supplies a real host session but does not run a model loop.

The Web test runs the actual DSH Agent loop with a **local deterministic model adapter**.
Synthetic tools return a known web-origin string, attempt to use it as a shell argument,
and attempt a write under `read-only`. Both denied bodies would append to an isolated
marker file if executed; the test asserts the file never exists. The report must show one
successful read, two blocked calls, the source → sink link and final `deny → blocked` receipts.
No external model requests, real shell-command bodies, private-file reads or email sending
are used. This validates the host integration and UI, not behavior of any external model.

The Web experience is now a **persistent beacon, closed by default**, with a compact
on-demand overview. Ordinary tool checks and denials never open the overview. The chart
shows real counts, the latest 24 checks and up to three risk source chains. A delayed
synthetic read verifies the pending-receipt working state before completion. Page reload
retains current-server counts; a new session clears all previous-session risks. Browser
acceptance also checks an unauthenticated status request is rejected and a simulated RPC
outage removes stale charts before automatic recovery.

The current host's native report-tool card uses the tool name and raw output; it does not
consume host-local `presentCall()` titles. Commands and the report tool remain available,
and rehearsals are optional secondary content excluded from live statistics.

The Node test suite now includes jsdom client tests for asynchronous session switches,
inert metadata rendering, unavailable/mismatched snapshots, hidden-page polling and cleanup.
Host tests cover RPC validation, exact session filtering, disposal, no state allocation on
status reads, bounded output, redaction and honest observe/other-plugin-denial attribution.
No client source is excluded from coverage. Existing v3 regression coverage is retained.

## Reproduce

```bash
npm run verify
npm run test:coverage
mkdir -p artifacts
npm pack --pack-destination artifacts
npm run check:dsh
npm run check:web
```

`check:web` requires Playwright and a browser in the development environment. Use
`PLAYWRIGHT_MODULE=/absolute/path/to/playwright/index.mjs` if installed outside this project.
Use `CHROME_PATH=/absolute/path/to/Chrome` to choose an installed browser; otherwise install
Playwright's Chromium. `DSH_BIN=/absolute/path/to/dsh npm run check:dsh` selects another CLI.
The Web fixture targets the locally verified DSH 0.1.2-rc.1 Web profile.

Both scripts install into fresh temporary DSH homes. Reusing a modified tarball at the same
path in an existing profile can cause pnpm to reuse the previous package resolution.

## Evidence

- `artifacts/dsh-install-check-<host-version>.json` and `.log`: installed-package SDK checks.
- `artifacts/web/acceptance.json`: browser version, host version, tarball hash and passed checks.
- `artifacts/web/01-live-beacon.png`: first-use beacon, no open overlay.
- `artifacts/web/02-empty-overview.png` and `02b-active-call.png`: empty state and actual pending call.
- `artifacts/web/03-blocked-beacon.png` through `06-mobile-overview.png`: automatically updated
  beacon, provenance chart, final risk overview and narrow viewport.
- `artifacts/web/server.log`: host startup output with local authentication token redacted.
- [Beacon screenshot](assets/riskproof-web-beacon.png) and [overview screenshot](assets/riskproof-web-trace.png):
  retained documentation images from the real Web run, with synthetic test data.

The earlier sandbox listener restriction was removed before this browser run. Web validation
is now complete for the host/browser versions above. Other browsers, older host Web UIs,
external model providers and marketplace publication are outside this local acceptance.

## CI shutdown correction

The original smoke runner assumed every profile named `sdk` exposed JSON-RPC. On older
hosts it is a custom base profile, so writing `shutdown` cannot close it. A local natural
exit was previously counted as success without a protocol response. The runner now
detects the composed SDK service, uses acknowledged RPC shutdown when present, and uses
the launcher's graceful SIGTERM path otherwise. CI directly invokes the resolved binary
to avoid terminating an npx parent instead of the host. Timeouts and signal exits remain
failures even after `RISKPROOF_INSTALL_CHECK_OK`. Per-version `dsh-install-lifecycle-*.json`
files record exit code, signal, timeout and shutdown mode.

After this correction, local installed-host checks passed on 0.1.0-rc.7, 0.1.0-rc.8,
0.1.1-rc.2 and 0.1.2-rc.1 against the existing Web-verified tarball. The first three
use the legacy signal path; 0.1.2-rc.1 also confirms an actual JSON-RPC shutdown response.
The 172 product tests and six smoke-process lifecycle tests pass. GitHub Linux CI must
be rerun from the new commit; local macOS results do not substitute for that run.