# Independent release acceptance — 0.1.7 PASS

**Independent verdict: PASS for the exact local-install artifact below on stock DSH Web 0.2.1-rc.2, with the explicit evidence limits in this report.**

Reviewer: **release-auditor**, nondeveloper Agent Team member; not Lead or the product repair author. Date: 2026-10-24, Asia/Taipei. The reviewer independently installed the packed candidate, executed real DSH/browser checks and inspected their results. Author/Lead development tests are not substitutes for this acceptance.

## Exact accepted artifact

- [dsh-skill-toggle 0.1.7 tarball](../../../dist/dsh-skill-toggle-0.1.7.tgz), SHA256:
  `0f0ba65130c7b39994bd281b46331ec5575993cb1a2df4be14d3838b7459901e`.
- Independently checked installed host SHA256: `fd22b0daee75898db3d71d508fd8942dbcbcace9e5aa0c9004315995233faa46`.
- Independently checked installed client SHA256: `c0304862c0160c38e2160f234a425c2030cde5d948ec2197a54dbd7b585f2d0e`.
- Installed version `0.1.7`; explicit runtime dependency `yaml: 2.9.1`. Normal DSH plugin-manager install, not a source symlink. Official peer check: **No peer dependency issues found**. [Install log](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/install.log).
- Archive independently listed: 11 normal package members; no lab, model fixture, test credentials or private acceptance traces. No source rebuild/repack was performed by the reviewer.
- Actual DSH `0.2.1-rc.2`, Node `24.18.0`, Playwright CLI `0.1.19`, real Chrome and actual Web bootstrap. Acceptance-only deterministic model fixture `0.0.4`, no external model credentials.
- [Accepted manifest](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/ACCEPTED-MANIFEST.json) records exact hashes and 17 primary PASS scenario files. Their detailed scenario evidence includes **36 distinct native-entry session IDs and 36 user-entry session IDs**, excluding additional baseline checks. These are coverage counts, not a statistical reliability claim.

The isolated home/profile is under the project-owned repair-independent lab; profile `repair-independent`, port **3084**, never 3080. Every application phase authenticated an actual DSH bootstrap, asserted `window.__DSH_BOOT__`, used public RPC/fetch/scope APIs and stopped its own server in `finally`. No replacement Vite app, private registry patch, fabricated core event or opaque filesystem locator was used. The reviewer did not modify production/core/profile3080, product source or build configuration, and did not publish anything.

## Previously blocking P3: now independently closed

The [historical 0.1.6 report](INDEPENDENT-ACCEPTANCE-0.1.6.md) remains a PARTIAL verdict for its own immutable artifact. Its real failure was complete standalone catalogs with enforcement false after permissions recovered, until each old fault-era Agent was reobserved. That history is not relabeled as a 0.1.7 pass.

Two new exact-artifact tests close that finding:

1. [Global-only recovery](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/faults-actual.json): create native/user Agents under an actual own-directory0111 fault; direct instruction-file access still succeeds. While the recorded fault remains active, ordinary global snapshot **keeps enforcement false**. Restore permissions, then perform **only a global catalog refresh**, before any same-Agent prompt/pre-step or session-specific catalog. The first observed recovered snapshot is complete/enforcement true; policy revision is unchanged. Only after that proof are the old Agents exercised again to verify actual denial.
2. [Real Settings global Refresh](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/health-gui-actual.json): while fault active, actual global manager Refresh leaves controls disabled and exposes the enforcement error. After restoring access, actual global Refresh re-enables the local row without opening an old session, sending an Agent prompt or reading a session catalog. Policy revision is unchanged. No optimistic flag clear or private invalidation was injected by the harness.

Opened screenshots: [active fault](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/global-health-active.png) and [recovered via global Refresh](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/global-health-recovered.png).

## Full previous real-app matrix rerun on 0.1.7

All evidence below is newly produced under the **0.1.7 hash-specific output directory**, not copied positive results from 0.1.6 or 0.1.5. JSON verdicts, real call/result records, source markers, revisions and relevant snapshots were inspected; exit0 alone was not used as a verdict.

| Area | Observed result | Exact-artifact evidence |
|---|---|---|
| Basic modes / both entrances | Enabled allows both, manual denies native but allows user, disabled denies both. Native tool must actually be declared, have durable call/result and matching error/body outcome. Explicit user injection is checked independently. | [baseline](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/baseline-result.json) |
| Warm verifier-only EACCES / new Agent | Configured verifier-only extra root really returns EACCES; source remains readable/hash unchanged. Catalog degrades but known policy overlay remains active; actual native/user disabled-body loading denies. Restoration and own-directory fault/recovery checked as described above. | [faults](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/faults-actual.json) |
| Cold verifier fault | Extra root inaccessible **before host process startup**, with no earlier healthy scan in that process. Managed off denies through actual native/user entrances; bundled and unrelated alias retain source allowance. | [cold](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/cold-actual.json), [fault/input proof](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/cold-input-preserved.json) |
| Cold invalid policy + verifier fault | Policy unavailable/non-writable; managed denied at both entrances; bundled/alias still load both; invalid input remains byte-identical, not silently repaired. | [cold invalid](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/cold-invalid-actual.json), [preserved input](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/cold-invalid-input-preserved.json) |
| Warm malformed leaf / recovery | Array mode rejected as invalid; last-good non-writable; managed denied and bundled allowed through both entrances. Invalid evidence preserved; known valid backup restores Ready/writable. | [last-good](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/last-good-actual.json) |
| Ordinary real-app body edits | Same-file V1→V2 edit retains concrete policy identity; disabled denies both. Stable manual denies native/allows user; workspace enabled allows both; source model restriction remains. Source restored by checked finally path. | [source edit](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/source-edit-actual.json) |
| Alias / protected provenance | A synthetic filesystem-labeled same-path alias that does not match the document keeps its own source allowance despite the real file's off policy. Protected preset and own-Agent runtime/filesystem-labeled peers stay read-only, mutations403, and both actual entrances preserve protected bodies. | [provenance](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/provenance-actual.json) |
| Context labels | A concrete local row wins in some presets and is shadowed in another; context labels reflect both. Actual protected session winner is separate/read-only. EN and Traditional Chinese labels rendered. | [provenance](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/provenance-actual.json), [GUI](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-result.json) |
| Source flags / identities / atomic writes | Enabled does not loosen source model/user flags. Same-name project A/B files have different IDs; A off does not affect B; both entrances checked. Same-revision concurrent writers produce one commit/one409. Mixed forged-ID batch rejects without revision change. | [regressions](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/regressions-actual.json) |
| Live sessions / evidence | After a successful user load, later native/user requests deny after off. Original events remain byte-identical; historical name evidence persists without active-context claims. | [regressions](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/regressions-actual.json) |
| Lock / storage / stale revision | Actual owned lock→LOCKED423, chmod0500 policy directory→STORAGE_UNAVAILABLE503, stale revision→409; restoring permission allows a real committed receipt. Lock is retained during fault and only harness-owned inode removed afterwards. | [statuses](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/statuses-actual.json) |
| Commit + degraded snapshot | Actual verifier-access fault returns HTTP200/committedRevision plus real degraded snapshot; disk inspected. GUI acknowledges saved policy while still showing incomplete-catalog warning in both languages. | [statuses](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/statuses-actual.json), [degraded GUI](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-degraded-actual.json) |
| Lost acknowledgement | Browser transport first forwards request to actual host and captures real successful receipt, then aborts only delivery to page. Saved value is independently confirmed. GUI truthfully says it cannot confirm whether saved, not definitely not applied. No fabricated server response/catalog. EN/zh-TW checked. | [GUI errors](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-errors-actual.json) |
| Operational GUI | Actual423 and503 produce distinct English/Traditional Chinese banners, blocked controls and appropriate operator recovery guidance. | [GUI errors](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-errors-actual.json) |
| Settings / shortcut / batch / keyboard | Actual Settings slot and correct workspace header dialog. Protected rows unselectable/no policy controls. Filtered two-row batch confirms exact count and global scope; cancel preserves revision, commit changes only selected rows and returns receipt. Keyboard search/Tab at390px with visible focus/no horizontal overflow. | [GUI](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-result.json) |
| Full restart | Global off, A enabled/B inherit survive stop/restart; both actual entrances allow A and deny B. | [persist](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/persist-actual.json), [restart](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/restart-actual.json) |
| Missing first-run policy | Policy file explicitly absent before boot; Ready/writable with source defaults. Both entrances and source restrictions exercised; first actual policy commit creates0600 state. Full restart preserves exact bytes/revision and both deny newly disabled skill. Original healthy policy restored after stop. | [first state](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/first-state-actual.json), [first restart](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/first-restart-actual.json), [gate](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/first-state-gate.json) |
| Transport | Unauthenticated401; authenticated cross-Origin403. Official same-origin owner carrier, no second backend. | [regressions](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/regressions-actual.json) |

The fault helper's Node EACCES check is an OS activation control, not by itself proof of product execution. Product evidence additionally compares a healthy complete catalog, configured verifier-root failure/degraded catalog, source-read control, actual native/user dispatch outcomes and recovery. The additional root is configured only on this plugin's verifier; actual source-provider configuration is unchanged. No global disable-all workaround passes the bundled/alias controls. Raw registry get alone is not treated as an authorization test: it can legitimately return body plus restricted invocation flags.

## Screenshots opened and visually checked

All are newly captured actual 0.1.7 DSH pages, not inferred screenshots:

- Global health [fault active](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/global-health-active.png) / [global Refresh recovered](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/global-health-recovered.png).
- Context/protection [English](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/settings-context-en.png) / [Traditional Chinese](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/settings-context-zh-TW.png).
- [Actual lock banner](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-locked-en.png), [Traditional Chinese storage failure](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-storage-zh-TW.png).
- [Unknown acknowledgement after real commit](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-unknown-en.png), [degraded discovery plus acknowledged save](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/gui-degraded-zh-TW.png).
- [390px keyboard focus](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/narrow-keyboard.png).

## Evidence limits — not silently promoted to real-app PASS

- **Between-SDK-get-and-proof races:** deterministic mid-read scheduling was not established in the full app. This member verifies ordinary real-app edits; one-shot and consecutive unstable-edit races remain separately labeled [Lead isolated public-SDK evidence](LEAD-VERIFICATION-0.1.7.md), not retroclaimed as browser race coverage.
- Deterministic cooperating-writer later-revision scheduling, postcommit thrown-refresh/no-snapshot branch, polling-coalescing, parser differential parity, cancellation/disposal/shutdown edge schedules remain Lead/author isolated or development evidence. Real-app acceptance here covers committed degraded snapshots, real response-loss acknowledgement and normal app shutdown, not every synthetic schedule. No mock response was used to claim a real refreshError branch.
- No external model reasoning, active instruction residency, KV/prompt-cache savings, power-loss durability, arbitrary noncooperating-writer race protection, hot uninstall, Windows ACL or new-machine/OS install claim. The supported writer protocol still requires cooperation or stopping the host for manual edits.
- Stock fresh spawn/fork does not copy parent-own registry. No private scope mutation was used to invent inheritance; same-UUID workspace relocation has no public API and is not asserted. Native slash picker may retain names; actual loading is checked. Older subagent/fork/compaction, document-move/new-workspace-UUID acceptance evidence remains historical and was not silently called a new 0.1.7 rerun.
- The old0.1.6 negative trials and report are preserved. This new version used calibrated fixture0.0.4 and fresh output files; there were no failed product scenarios in this 0.1.7 run. Old fixture mistakes are documented in the historical report, not erased or reclassified as product repairs.

## Executed commands and reproducibility

From project root; no product build or pack by acceptance reviewer:

```bash
DSH_HOME="$PWD/.lab/repair-independent/home" \
DSH_AGENTS_HOME="$PWD/.lab/repair-independent/agents" \
node node_modules/@deepseek-ai/dsh/lib/bin.js plugin --profile repair-independent \
  add "$PWD/dist/dsh-skill-toggle-0.1.7.tgz"

COMMON=(--execute-after-freeze --tarball dist/dsh-skill-toggle-0.1.7.tgz \
 --sha256 0f0ba65130c7b39994bd281b46331ec5575993cb1a2df4be14d3838b7459901e \
 --version 0.1.7 --port 3084)
node .lab/repair-independent/run-phase.mjs "${COMMON[@]}" --phase baseline
for phase in faults source-edit provenance statuses persist restart last-good \
             regressions gui-errors gui-degraded health-gui; do
 node .lab/repair-independent/run-phase.mjs "${COMMON[@]}" \
  --browser-script .lab/repair-independent/browser-bootstrap.js \
  --node-scenario .lab/repair-independent/scenarios.mjs --phase "$phase"
done
node .lab/repair-independent/cold-wrapper.mjs "${COMMON[@]}"
node .lab/repair-independent/run-phase.mjs "${COMMON[@]}" \
 --browser-script .lab/repair-independent/browser-gui.js --phase gui
node .lab/repair-independent/first-state-wrapper.mjs "${COMMON[@]}"
```

Commands above describe executed phase shapes; GUI error phases followed the main GUI phase in the actual run. Existing evidence is exclusive-create and must not be overwritten on replay. Use a new run directory/phase name after inspecting reset requirements. [Tested harness snapshot](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/harness-sha256.json) pins the 16 test/fixture files, including the new global-before-prestep assertion and real Refresh test. [Phase driver](../../../.lab/repair-independent/run-phase.mjs) always validates the supplied artifact SHA and stops its own server in finally.

## Final restored state and independent signoff

All application phases finished with their child server stopped; no acceptance background job remains and port3084 is free. Verifier root/source directory permissions0755, policy directory0700/file0600 and original V1 source restored. The valid test policy was [archived](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/healthy-policy-before-stop-reset.json), then the stopped disposable lab was explicitly reset to valid empty/default policy. A final [real restored bootstrap](../../../.artifacts/repair-independent/0.1.7-0f0ba65130c7/restored-result.json) confirmed Ready/writable/complete before stopping. Invalid-input evidence was retained, not silently repaired. Logs were bootstrap-redacted before persistence; private deterministic request traces are not public deliverables.

**release-auditor independently approves exactly 0.1.7 / SHA256 `0f0ba65130c7b39994bd281b46331ec5575993cb1a2df4be14d3838b7459901e` for the stated local-install compatibility scope and limitations. Lead did not perform this release signoff. No production installation or public publishing is authorized by this verdict.**