# DeepSeek Harness Plugin

Kiokuko provides an out-of-tree DeepSeek Harness bundle at `kiokuko-dsh`.
`kiokuko-dsh` is the guarded Cordis entry. `kiokuko-dsh/dsh` remains a compatibility import. It mounts the DSH-only Kiokuko runtime contracts; it does
not fork DeepSeek Harness or modify a repository's files.

These installation instructions use the full compatibility package. A separate
`kiokuko-dsh/core` entry and local core/Lisp artifacts are available through
the [configured module build](core-modules.md). Selecting a subpath alone does
not remove files or dependencies from an installed full package.

## Compatibility

Compatibility depends on the native APIs exercised by the disposable-profile tests, not a package-version prefix. Each CI run resolves the latest official DSH master, builds that revision and records it with the test evidence. The resolved SHA forces compatibility coverage even for prose-only changes; daily GitHub runs also detect upstream-only changes. The SHA is shared within that run, never reused as a fixed baseline for later runs. Historical release records and locked fixtures remain reproducibility data, not proof of current-upstream support.

On hosts exposing the batch executor API, development Lisp preserves the Agent’s selected native or PTC executor. Host-owned nested calls use DSH’s exported invocation pipeline, retaining scoped policy, cancellation settlement and host-only task authority. They are not submitted as model batches.

Protected Lisp on current DSH retains the selected executor and enforces its scoped native-tool restrictions and monotonic guards. Native execution supports protected Lisp; the reserved PTC `run_code` transport is explicitly denied before its program runs. To use protected Lisp, select native execution in the DSH profile. Disabling or unloading Lisp never installs, replaces or disposes the selected executor, so it cannot leave a stale executor tombstone; the protected fence still survives plugin unload. Existing hosts that provide reversible `presentAs` retain the prior presentation behavior.

CI uses the canonical DSH fixture for native history, routing and packed Web lifecycle coverage. Historical source-repair CLI tests use the current catalog's historical codecs for v0/v3 fixtures. Local tests do not prove an npm `--latest` update or the user's running profile. The E2E runner defaults to the manifest's compatibility target; `KIOKUKO_EXPECTED_DSH_VERSION` selects an explicit fixture version. `KIOKUKO_DSH_CLI_ONLY=1` runs only the packed Web lifecycle and requires `KIOKUKO_REQUIRE_DSH_CLI=1`.

## Task state and explicit operations

`/kioku-task status` reads the current task from the existing Kiokuko ledger. All
task categories use `ToDo`, `Working`, `Pending`, `Done`, and `Ignore`; an
implementation task may additionally have a coding Goal. Research, writing,
analysis, and conversation do not acquire a coding Goal merely to track state.

```text
/kioku-task create research Inspect this repository's startup behavior
/kioku-task start
/kioku-task wait
/kioku-task resume
/kioku-task complete --evidence <host-observed-reference>
/kioku-task ignore --reason The requested investigation is no longer needed
```

Operations may name an existing task ID after the operation. `create` takes an
existing task category and the exact requested work. `ignore` requires a reason.
`complete` accepts repeated `--evidence` references to successful operations
observed by the host in the current execution generation.
Words such as “start”, “done”, or “ignore” inside ordinary messages, quoted text,
code, or tool output do not perform these operations. The model's structured
`task_operation` tool uses the same owner, repository, revision, and generation
checks and retains native tool permissions.

Only `Working` permits managed effects. A stop request stays `Working` with a
pending-stop marker until the native agent, owned processes, child agents, and
managed Lisp workers have stopped. `Done` requires current host-observed
verification evidence. A failure or cancellation retains its actual outcome
and becomes `Pending`; it is never treated as `Ignore`. Reopening terminal work
requires an explicit resume and a new generation. Old results cannot complete
or modify that new generation. Model changes transfer the same task to the
verified primary continuation; CLI resume rereads its persisted state.

Jev/Laya/OpenAI interpretations are advisory. If they are unavailable or abstain, the
host records an unresolved decision and accepts a validated main-model
interpretation or an explicit operation. The original request and authority
checks remain in force. The CLI displays this SQLite snapshot and committed
events; ordinary conversation text and native todo items are not state evidence.

## Model tool exposure

`toolExposure.mode` defaults to `auto`. On verified OpenAI API routes, normal
chat/research/analysis/writing/review omit Kiokuko model tools; build/debug/devops
use lean descriptions. Native
and external tools remain available. Explicit `full` preserves the surface.
`phase` removes only verified Kiokuko tools that are unavailable in the current
execution phase. Opt-in `lean` applies the same phase policy and removes the
exact duplicate `Business payload` schema text from seven Kiokuko tool
descriptions when the selected pi-ai route is an explicitly configured OpenAI
Responses or Chat Completions route. The `parameters` schemas and registered
execution definitions remain unchanged. Unknown ownership, route, or schema
falls back to the original surface; unowned DSH tools are never removed because
the public registry does not expose registration provenance.

```yaml
toolExposure:
  mode: auto
```

The native fixture reports serialized request bytes and app-level transformation
counts. Those measurements do not represent provider token usage or cost.

## Install

The published `kiokuko-dsh` npm package is the one-shot path when a matching
release is available because its tarball already contains `dist/`:

Run the following from a DeepSeek Harness checkout:

```bash
pnpm dsh plugin --profile web add kiokuko-dsh
pnpm dsh --profile web --dump-config
```

For the [dsh-cli](https://github.com/askdkc/dsh-cli) terminal UI, use its `dsh-cli` profile:

```bash
pnpm dsh plugin --profile dsh-cli add @askdkc/dsh-cli
pnpm dsh plugin --profile dsh-cli add kiokuko-dsh
pnpm dsh --profile dsh-cli
```

Skip the first command if the UI bundle is already installed. `web` and `dsh-cli` have separate package and bundle lists; installing Kiokuko into one does not enable it in the other. `add` installs and registers the bundle. Use `update` only after installation:

```bash
pnpm dsh plugin --profile dsh-cli update kiokuko-dsh --latest
pnpm dsh --profile dsh-cli
```

The remaining examples use `web`; substitute `dsh-cli` for that profile. With a globally installed `dsh`, omit `pnpm`.

For a direct GitHub install, run the following from a DeepSeek Harness checkout:

```bash
pnpm dsh plugin --profile web add github:askdkc/kiokuko-dsh
pnpm dsh --profile web --dump-config
```

If pnpm blocks the Git package's build, approve the repository in the affected
profile's `pnpm-workspace.yaml`, preserving other entries in its `allowBuilds` map:

```yaml
allowBuilds:
  "kiokuko-dsh@git+https://github.com/askdkc/kiokuko-dsh.git": true
```

This rule covers future commits from that repository. Repository matching for
GitHub tarball downloads is confirmed in [pnpm 11.25.0's implementation](https://github.com/pnpm/pnpm/blob/v11.25.0/pnpm11/building/policy/src/index.ts#L137-L176);
verify the pnpm version used by the DSH command before relying on it. Package-name
approval alone does not cover Git sources. If `approve-builds` reports no pending
packages, inspect the affected profile's `allowBuilds` entries and correct the
repository rule directly; do not repeat the same command or approve all builds.
Then rerun the original installation command.

An optional `#<commit>` in the dependency spec selects a reproducible source
revision. It is separate from build approval and is unnecessary when following
the default branch. Do not turn a resolved commit from an error into a permanent
per-update approval requirement.

With an installed dsh CLI, use the same commands without the `pnpm` launcher.

### Local checkout

Build in the Kiokuko checkout before installing it:

```bash
pnpm install --frozen-lockfile
pnpm run build
```

Then install the built directory using the installed DSH CLI (prefix `dsh` with
`pnpm` when running from a DSH checkout):

```bash
dsh plugin --profile web add /absolute/path/to/kiokuko-dsh
dsh --profile web --dump-config
```

## Update

Finish active tasks and stop DSH before changing installed packages. Kiokuko has
no standalone setup/update CLI: [DSH plugin management](https://github.com/deepseek-ai/deepseek-harness/blob/master/apps/cli/reference/README.md)
forwards package commands to pnpm in the selected profile. The commands below use
an installed `dsh`; prefix them with `pnpm` when running from a DSH checkout.

For an npm-installed Kiokuko, update the plugin itself:

```bash
dsh plugin --profile web update kiokuko-dsh --latest
```

The `agenticreplay` distribution uses `>=0.1.0 <1.0.0`. This includes future patch and minor
releases such as 0.1.2 and 0.2.0 without changing Kiokuko's dependency declarations.
Lockfiles keep the tested versions until you explicitly update dependencies:

```bash
dsh plugin --profile web update --depth Infinity agenticreplay
dsh plugin --profile web why agenticreplay
dsh web
```

The package supplies the bundled recording libraries; `--depth Infinity`
selects the indirect AgenticReplay dependency. Prereleases and 1.0+ are excluded. The range
does not guarantee future API compatibility. After restarting, check a new
recording with `/kioku-agenticreplay list`, `show`, and `export`.
When upgrading from OrcaReplay, rename explicit `orca` settings to `agenticReplay`
first. Saved session choices are preserved; legacy recordings are retained but
not imported. See the [recording guide](agenticreplay-recording.md#upgrade-from-orcareplay).

For an intentionally commit-pinned Git install, change the dependency spec to
the intended new revision; updating a fixed source reference does not move it
to a newer commit. The repository build approval above remains unchanged.
For a local checkout, update/build that checkout and
install its built path again. These profile commands do not update the lockfiles
in a separate Kiokuko development checkout.

## Startup failure after a DSH update

Stop DSH before updating the plugin. For an npm installation, run these commands from the DSH source checkout (omit `pnpm` for an installed `dsh` CLI):

```bash
pnpm dsh plugin --profile web update kiokuko-dsh --latest
pnpm dsh web
```

If package files remain broken, stop DSH and reinstall the npm package:

```bash
pnpm dsh plugin --profile web add kiokuko-dsh@latest --force
pnpm dsh web
```

Use the affected profile in place of `web`. For GitHub or local installs, reinstall the original package spec instead of changing distribution. Keep pnpm build approvals and release-age policies; the update guidance above explains release-age exclusions. Reinstallation may repair stale or incomplete package files, but it cannot guarantee compatibility with a changed DSH API. Retain the original error when reporting a failure. Never delete session logs, the Kiokuko database, or profile settings as a startup repair.

The guarded bundle entry prints these next steps for dependency-import failures and Kiokuko activation failures, then preserves the original rejection. It cannot print before DSH resolves that entry or when DSH never activates it because a required service is unavailable; those errors remain DSH-owned. The public library imports are unchanged.

Released v0/v1/v2/v3 history readers are bundled privately into the npm artifact. Their DSH packages are build dependencies only, so installing Kiokuko does not hoist an older DSH LLM over the running host. This preserves the released readers rather than substituting the current host's history format. Other plugins may still install conflicting DSH packages; inspect their dependency paths if the same Typert error persists.

## Remove

| Target | After `dsh plugin remove` | How to remove it |
|---|---|---|
| DSH rows (`kiokuko-dsh` / `kiokuko-models`) | Removed; the stock export row is restored | No further action |
| Deployed Skills under `~/.agents/skills` | Remain | `setup-dsh.mjs --remove` |
| DSH block in `AGENTS.md` | Remains | `setup-dsh.mjs --remove` |
| `kiokuko-models.json` | Remains | Remove manually only when the saved provider definitions are no longer needed |
| Kiokuko database and `.agenticreplay/runs` | Remain intentionally | Do not remove them as part of plugin removal |

Disable individual rows when temporarily turning Kiokuko off. Disabling the whole
bundle also removes the provider referenced by `agent-default-model`, leaving its
default-model binding unresolved. `patchReload: "live"` has no reader in the
current DSH and must not be treated as evidence that a profile change took effect
immediately.

```bash
dsh plugin --profile web remove kiokuko-dsh
```

## Usage

### Subagents

DSH's standard agent preset provides `subagent` (the in-process `spawn` provider) and `subagent_fork` (the `fork` provider). Both default to continuable background execution. The preset is shipped at `@deepseek-ai/dsh-web-app/presets/standard.patch.yml`; Kiokuko injects the host `subagents` service and does not duplicate either model-facing tool. A native generic child of a normal Kiokuko turn runs without a second Kiokuko intake or execution-mode question.

Custom agent presets must configure the corresponding DSH tool rows and providers. Kiokuko does not edit profiles or user presets. `deepPlanning.maxConcurrentAgentsTotal` and Deep's `budget.maxConcurrentAgents` apply only to Deep Planning, not ordinary subagent tools. Parallel execution requires multiple model tool calls and an available DSH provider. The fixed-runtime test checks wiring and lifecycle with a fake model; it does not establish how often a real model delegates or whether delegation saves time, tokens, or money.

Skill prompts default to full source. The optional deterministic compiler and
its native/package delivery checks are documented in [Skill prompt compiler](skill-compiler.md).

Do not run `/kiokuko-soul`. The plugin mounts the bundled `kiokuko-soul` content
as the `kiokuko:soul` system-prompt section automatically. Start the selected
DSH profile and enter your task, for example:

```bash
dsh web
```

The package exposes `.`, `./client`, and `./dsh` and declares
`dsh/cordis.patch.yml` as its bundle patch. Use a profile when testing or when
you need an isolated configuration:

```bash
dsh plugin --profile kiokuko-test add github:askdkc/kiokuko-dsh
dsh --profile kiokuko-test --dump-config
dsh plugin --profile kiokuko-test remove kiokuko-dsh
```

A DSH session can use a Git repository, a `.kiokuko.json`-bound project, or an
ordinary directory as its workspace. For an ordinary directory, Kiokuko keeps
the path binding in its database and does not create `.git`, `.kiokuko.json`,
or any other metadata file in the workspace.

`kiokuko-dsh` disables the existing `session-log-download` Host row and inserts
its own row under the stable `kiokuko-dsh` id. Its DSH lazy-CJS client owns the
Header modal and `/export` command UI while the Host route uses cursor-backed
streaming export. Removing the bundle restores the stock row without rewriting
unrelated plugins or settings. Startup also refreshes an existing Kiokuko managed
block in the startup directory’s `AGENTS.md`, as described below.

## Bundled standard Skills: canonical source and refresh

The repository's `skills/<name>/` directories are the single canonical source
for the 16 standard Skills and for the separately bundled Japanese output and
Lisp Skills.
`src/dsh/standard-skills.ts` resolves them relative to the built module
(`dist/dsh/` → `../../skills/<name>`), and `src/dsh/standard-skill-integrity.ts`
refuses to load a tree that breaks the manifest: exactly one management marker
per file, frontmatter `name` equal to the manifest name with a non-empty
description and no `disable-model-invocation`, every local Markdown link
resolvable inside its own Skill, and exactly 16 standard Skills with 42 Markdown
files and 26 reference files.

The Japanese output Skill and Lisp Skill bring the package inventory to 18 Skill
directories. The Japanese output directory is
`japanese-translation-for-oss-models/`; its frontmatter/provider name is
`natural-japanese-output`. Both names refer to the same Skill. Setup deploys the
16 standard Skills plus
Japanese output: 17 directories and 43 files, including the 26 references. Lisp
is supplied through the DSH Skill provider and is not installed globally by this
setup path.

`veteran-programmer-skill` checks workflow completeness before and after changes
spanning setup, delivery, persisted state or runtime handoffs. SOUL and the code
index route to it when applicable; isolated edits do not require a workflow audit.

For code changes, SOUL also routes to `one-shot-software-completion`. Its compact
`SKILL.md` covers the completion contract; four references cover discovery/scope,
boundaries/lifecycle, verification/completion, and failure recovery. Read only
references relevant to the current risk, normally one or two at a time. Provider
selection delivers the index without automatically appending the references in
either `full` or `compiled` mode. They remain available in the deployed Skill
directory and through explicit bundled reference selection. Context capacity
alone does not establish remaining input budget or model quality.

### What setup updates and when

The enabled plugin runs setup on every load, before registering its DSH surfaces:

1. Validate the bundled Skills and preflight the deployment targets.
2. Synchronize all 16 standard Skill directories and the Japanese output Skill
   to the process user's `~/.agents/skills/`, creating missing files and replacing
   stale managed files.
3. Replace the existing `<!-- BEGIN KIOKUKO-DSH MANAGED BLOCK -->` through
   `<!-- END KIOKUKO-DSH MANAGED BLOCK -->` section of the startup directory's
   `AGENTS.md` with the DSH contract. Preserve all text outside those markers.
   Absent or unmanaged `AGENTS.md` files are left alone. A legacy generic block
   is migrated only when its opening marker is followed by an explicit
   `kiokuko-dsh-template-version` ownership marker. Unowned generic blocks and
   other plugins' sections remain byte-for-byte intact.

The DSH contract comes from `SOUL_ROUTING_ENTRY_CONTRACT`, also used by the
host prompt. `task_prepare` and `task_answer` are host operations; the model does
not manufacture request identity or attest that it read a Skill. The DSH host
owns intake, session binding, memory delivery and finalization. The generic
`kiokuko use` command is not part of this package and must not be used to
regenerate DSH instructions. Setup never adopts an unowned generic Kiokuko
block as DSH configuration. Apply the entire DSH section only in a DSH session
with kiokuko-dsh enabled; otherwise ignore all instructions inside it. The
section's presence does not activate the plugin or its instructions.

Updating the npm package changes the bundled source. Setup executes when the
updated plugin is loaded, **not inside npm's install/update lifecycle**. Stop the
old DSH process, update the plugin, then start DSH from the target project:

```bash
pnpm dsh plugin --profile web update kiokuko-dsh --latest
# Run the next command from the project whose AGENTS.md should be refreshed.
pnpm dsh web
```

Other clients must reload their Skill catalog, and existing conversations must
be restarted to read updated instructions. This does not rewrite a prompt
already assembled in a running session. A conversation using a directory other
than the DSH startup directory needs explicit setup there, or a DSH restart from
that directory. Parent-directory/global instruction files and unrelated Skill
copies are not scanned or modified.

Setup refuses unmanaged Skill collisions, symlinks, unsafe parent permissions,
and malformed or duplicate project management markers. It reports failures with
the affected path/reason; the bundled provider remains available, but that warning
means setup is incomplete. Files are published atomically one at a time. If a
write fails midway, fix the reported problem and rerun setup; it resumes by
comparing every file. Back up or rename a conflicting user-owned file yourself
before retrying; setup never removes it to force an update.

### Repair or check an explicit workspace

From the repository checkout, build once, then run setup with the actual project
path. `--check` performs no writes and exits with status 1 for drift or errors;
without it, setup performs the repair. `--json` gives structured results.

```bash
npm run build
node scripts/setup-dsh.mjs --cwd /absolute/path/to/project --check
node scripts/setup-dsh.mjs --cwd /absolute/path/to/project
node scripts/setup-dsh.mjs --cwd /absolute/path/to/project --check
# Explicitly remove byte-identical deployed copies and the DSH AGENTS.md block.
node scripts/setup-dsh.mjs --cwd /absolute/path/to/project --remove
node scripts/setup-dsh.mjs --cwd /absolute/path/to/project --remove --check
```

The same `scripts/setup-dsh.mjs` ships in the installed package. Use the **actual
installed kiokuko-dsh package directory** instead of the checkout to verify that
installation's content:

```bash
node /absolute/path/to/installed/kiokuko-dsh/scripts/setup-dsh.mjs --cwd /absolute/path/to/project --check
node /absolute/path/to/installed/kiokuko-dsh/scripts/setup-dsh.mjs --cwd /absolute/path/to/project
node /absolute/path/to/installed/kiokuko-dsh/scripts/setup-dsh.mjs --cwd /absolute/path/to/project --check
```

The destination defaults to the current process user's home. `--home
/absolute/path/to/home` explicitly selects another home when diagnosing a different
runtime user. Check the reported paths: a successful source build or bundled
parity check alone does not prove that another process's deployed files match.

`node scripts/verify-standard-skills.mjs` remains a source/bundle integrity check
for the 16 standard Skills (42 files, 26 references). Use `setup-dsh.mjs --check`
for the complete 17-directory, 43-file deployment **and** project instruction check.

## STORE contract and permissions

This package intentionally targets the DSH STORE `user-reviewed` track. Its
source and npm tarball are larger than the STORE automatic-review size bound;
that bound is a catalog automation limit, not a runtime or npm packaging
limit. The package is therefore not represented as a small, auto-approved
plugin.

The manifest declares MIT licensing, the canonical GitHub repository, Node.js
`>=24.16.0`, the DSH capabilities described above, and the `web` and `dsh-cli` profiles.
An untested release is not rejected merely for its version label. A matching
disposable-profile run supplies behavior evidence; `headless` remains unverified. The legacy `dsh-tui` profile declaration is retained for existing installations.

Runtime effects are explicit:

- local reads and writes are limited to the configured Kiokuko data directory,
  SQLite state, backups, runtime descriptors, registered project roots, and
  Kiokuko-managed instruction files;
- repository-relative verifier and backup subprocesses are restricted and are
  never an implicit model-facing shell tool;
- Skill discovery/source retrieval and remote embeddings can use the network,
  but remote embeddings are disabled by default; and
- optional GitHub or embedding credentials are supplied by the user and are
  never bundled or persisted by the plugin.

`prepare` runs `node scripts/prepare-build.mjs`, which normally builds through
the invoking package manager. Only `CI=true` together with
`KIOKUKO_CI_DEFER_PREPARE=1` defers this package's duplicate build to the selected
verifier's clean build; dependency lifecycle scripts remain enabled. See
[CI build ownership](verification.md#consolidated-duplicate-invocations).
Git installs still need build approval in the consuming profile; use the
repository-scoped rule in [Install](#install) so ordinary updates do not require
another commit-specific permission.

The npm tarball already contains `dist/`, so its normal install path does not
depend on a consumer-side build permission.

## Runtime contract

Kiokuko owns the input → model → tool → result → continue/finish loop through
DSH's AgentFactory/Agent API. The default bundle disables the stock AgentLoop;
model connections, native SessionEvent records and Web/CLI consumers retain
their DSH contracts. The explicit legacy-loop profile selects the stock loop
instead of the Kiokuko factory; the two loops never drive the same agent.

The native session retains the human request, attachments, model responses and
tool results. Kiokuko's SQLite database owns task identity, execution receipts
and memory. AgenticReplay records correlated execution for inspection; it does
not replace the memory store or authorize replay of effects.

Current session ownership, explicit operation permissions, cancellation and
Plan state are checked at the operation boundary. Memory retrieval, extraction
and saving are optional: their failure cannot authorize an operation, block
unrelated development or establish completion. Diagnostics distinguish work,
verification, receipt persistence and memory storage.

Owned operations keep stable request identities and durable receipts. Exact
retries return saved results; changed arguments conflict. After interruption,
unknown effects are reported without re-execution. Receipt persistence retries
and memory adoption retries reuse their existing journals and staged results.

A follow-up stays in its native session. Resume requires the exact session and
repository binding; ambiguous or stale ownership cannot be replaced with a
repository-wide latest task. Explicit task completion advances its authority;
final closing rechecks that authority so a delayed close cannot retire resumed
work. An idle model or a passing intermediate test is not task completion.

Lisp is an optional tool surface. Every Lisp worker is OS-isolated; workspace
changes and external commands use host tools and their permission checks.
The development surface coexists with ordinary tools, and its worker failure
leaves those tools available. See [owned execution](owned-execution.md) for
operation receipts, recovery and the protected compatibility mode.

## Verification

From the Kiokuko checkout, `npm run build && node scripts/run-tests.mjs tests/dsh/e2e`
builds the package, runs the Cordis composition test with an in-memory host
adapter, and validates model/tool/ledger/turn-end boundaries. The
pack/install/Web-start/Web-stop/remove flow is exercised by the pinned
end-to-end suite when a `dsh` executable is available; without one the CLI
portion is reported as `unsupported`.

The terminal profile has a separate acceptance runner. Supply a built DSH CLI,
packed UI and Kiokuko tarballs, the installed `node-pty/package.json`, and a
package manifest from which `@xterm/headless` resolves:

```bash
npm run test:cli-profile -- /path/to/dsh/bin.js /path/to/dsh-cli.tgz /path/to/kiokuko-dsh.tgz /path/to/node-pty/package.json /path/to/dsh-cli/package.json
```

It uses a temporary HOME and profile, checks registry `add` and `update --latest`,
loads the supplied tarballs, and drives a real terminal through normal input,
Esc cancellation, Lisp evaluation, shutdown, and JSONL resume. SBCL must already
be installed for Lisp evaluation. It sends the first Kiokuko slash command as
soon as the terminal accepts input, without waiting for plugin registration,
and verifies that the command never reaches the model. The model provider is a
scripted offline fixture: this checks host integration, not real-model behavior. Runtime package
paths and versions are recorded with the result. Missing prerequisites and
runtime errors fail the runner rather than count as successful acceptance.

The same runner also has an explicit `source` stage for the existing Linux
consumer lane and macOS runtime job. It loads the current Kiokuko build and the
pinned `@askdkc/dsh-cli@0.14.11` bundle through source patch overlays, using the
canonical DSH fixture and a private profile. This stage performs no package
operations and does not prove installation or registry-update behavior. The
npm/pnpm consumer checks and packed module/Skills checks remain separate.
The terminal run checks task completion rejection without evidence, task
wait/resume, model-switch state transfer, persisted task recovery, and clean
exit as well as ordinary input, cancellation and Lisp evaluation. It declines
the fixture's derived-memory proposal through the native terminal UI.
A cold model continuation can retain its ancestor's protection while Lisp is
disabled for the current session. Task resume changes task state only. The
runner checks that input stays blocked, invokes the displayed
`/kioku-lisp enable` recovery command, and then verifies admitted input.

CI uses a source-bound selected plan. Known application changes run five jobs:
selection, one Linux native build, combined Linux core/Lisp checks, combined
consumer/runtime/terminal checks, and the required aggregate. UI changes add
the browser job. Host/platform boundaries add the affected CPU/OS checks.
Only genuine prose documentation can select the two lightweight jobs; Skills
Markdown remains runtime input. Dependency, exports, package, build, test or
verification changes, releases and manual runs select complete CI coverage.
Unknown paths, unavailable/empty diffs, renames and deletions also select full.
Consequently this CI/fixture repair itself selects full coverage.

Full mode has 27 jobs, including selection, and 22 required verification
reports. It retains all Main partitions, all four Lisp partitions on each OS,
three semantic platforms, macOS runtime and browser coverage. Lisp still tests
`macos-latest`; source and packed Skills remain separate. Ordinary mode has
two required reports, each combining existing checks with a shared build.
Required selected jobs cannot be missing, skipped, failed or cancelled.
Unselected jobs remain explicitly unselected, never reported as executed tests.

The fixture declares exact DSH, terminal UI and headless-terminal versions in
one npm lockfile and uses one normal `npm ci`, preserving the DSH peer graph.
Native test artifacts bind to the selected commit, source, contract and
Node/npm/Rust toolchain. Representative bundles remove unselected binaries,
carry their limited scope, and cannot become complete release-review artifacts.
Only full-mode consumer verification retains a release-review tarball. Local
host validation plans have a separate scope and are rejected by GitHub CI.
Future GitHub runs are still needed to measure actual runner usage.

The compatibility coverage is:

| Harness profile | Status |
|---|---|
| web | disposable install/start/uninstall runner and native integration tests |
| dsh-cli | isolated packed-profile install/update and interactive terminal runner |
| headless | unknown; not declared as supported |
| sdk | unsupported until a real Loader/SDK host is supplied |
| acp | unsupported until a real Loader/ACP host is supplied |
| sdk-minimal | unsupported until a real Loader/SDK host is supplied |

Run the corresponding acceptance test against the intended DSH installation.
An unavailable DeepSeek binary leaves a profile unverified; it is never
converted into a passing runtime claim.

## DSH acceptance boundary

DSH acceptance is limited to the DSH surface and the directly relevant
Kiokuko contracts listed by the DSH verifier set. There is no generic Kiokuko
HTTP, TCP, or standalone Web product surface in this package. The only Web
lifecycle checked here is the DeepSeek Harness `web` profile loading and
unloading this plugin; terminal coverage uses the separate `dsh-cli` profile.
An unavailable DeepSeek CLI is reported as
`unsupported`, never as a successful install or runtime execution.

## AgenticReplay recording

AgenticReplay dependencies and recording configuration are installed automatically with
this package; the feature is **enabled by default** and records each chat without
asking, including delegated and managed child sessions. Set `agenticReplay.askOnStart: true` to ask once per chat instead; only an
affirmative choice then starts capture, while skipping or an unavailable question
UI continues without recording and child sessions need an explicit start. The decision survives reloads, and a saved
refusal outranks the recording default. The first recorded model/tool observation creates
`.agenticreplay/runs/` in the verified session workspace. Set `config.agenticReplay.enabled: false` and reload to disable
recording. `/kioku-agenticreplay stop`, `list`, `show <run ID>` and
`export <run ID>` finalize and inspect the selected session's trace. This records
DSH internal events, not a complete replayable HTTP/filesystem capture.
See [AgenticReplay recording](agenticreplay-recording.md) for configuration, limits, sensitive data,
storage, disabling and removal.


## Optional code-intelligence provider

Enable Lisp through the existing session/preset route. Mount a V1-capable
`@askdkc/dsh-lsp-server` bundle in the same intended preset/service realm; Kiokuko
uses the calling agent's `codeIntelligence` service, scoped filesystem and process
services. It never looks up a parent-global provider as a fallback. The V1 contract
export is side-effect-free and imported only as a type. The checked-in declaration
is generated from the unreleased provider prerequisite, so optional runtime absence
does not prevent compilation or startup.

The current v0.1.12 registry artifact lacks V1. Use the [local patch recipe](../patches/code-intelligence/README.md)
for development and review; it does not update your active CLI profile. For an
installed compatible provider, confirm `(kioku.code:capabilities)` in the actual
session instead of treating a download, build, or package version as activation.
The suite and optional Lisp module contain the bridge; the core artifact contains
neither Lisp code nor parser/server dependencies. See [the API](lisp.md#read-only-code-intelligence)
for outcomes, scope, disk freshness, budgets, and protected fences.

### Observation and early verification

DSH host intake is independent of same-named tools from external Kiokuko MCP
servers; those tools must not substitute for the admitted DSH request.
AgenticReplay classifies native structured error envelopes and failed process
results as errors even when the native flag is false, retaining that flag and a
conflict marker without copying private exception bodies. Domain JSON/text is
not interpreted as a failure signal. This protects new DSH recordings; existing
OpenCode recordings and the upstream recorder are not rewritten.

Each execution-context refresh includes a bounded snapshot of the current coding
workflow's pending or stale focused checks. It reads host evidence, survives a
restart through the existing workflow ledger, and separates item checks from the
final Goal check. The model is instructed to verify small edits early and reserve
actual host capacity for verification/reporting. DSH does not expose a remaining
step budget at this seam, so no numeric capacity or automatic budget enforcement
is claimed. Missing or unavailable evidence cannot become a passing check.