Resolve merge by regenerating cordis/config catalogs and the doc graphs from
the merged tree, and re-record the tools README and tools doc bilingual pair
hashes so the pairing gate matches the merged content.
The mount-local baseline guard was seeded from "a baseline already exists in
the log", which a resumed session and a hot plugin remount both satisfy. That
made a resume skip its baseline, so offline AGENTS.md edits or removals never
reached the first resumed request — violating the documented resume contract.
Distinguish the two by agent/session-start: a startup or resume emits it before
the first step, while a remount attaches to an already-live session and never
witnesses it. Only a remount (no witnessed start, baseline already logged)
keeps the single logged baseline and skips; a resume falls through and
re-composes from current files. Adds a regression that resumes a session with
an offline baseline edit and asserts the fresh baseline reflects it.
cancel() emitted agent/cancel-requested whenever queued or steering work
existed, even under keepInbox with no active turn — a call the contract
documents as a no-op. Consumers could misread that notification as a real
cancellation. Emit only when the call actually aborts the active turn or
discards pending work, matching the "effective call" contract.
Codex review of the acp-only fix found lsp-local carries the identical
defect: its server config's unrestricted env merges into the connection's
ordinary spawn channel, so a configured DSH_* fact crashed the spawn with
the reserved-namespace rejection. The partition now lives on the seam as
splitEnvChannels() beside the scrub it complements; the ACP run and the
LSP connection both use it, and each proves child delivery end-to-end
(MOCK_ECHO_ENV / LSP_FAKE_ECHO_ENV fixture knobs). Seam + consumer README
rows updated (en+zh, re-recorded). bash-local is already two-channel;
mcp/pty/sdk bypass the seam and only share the scrub.
The acp run passed config.env wholesale into the spawn spec's ordinary
channel, which rejects the reserved DSH_* namespace — a deployment fact
like DSH_PERMISSION_MODE (the acp-agent example's own knob, used by the
with-key e2e) crashed the spawn. The run now splits DSH_* entries onto
dshEnv, where the scrubbed base expects current facts to arrive. New
layering test drives the split through the real seam via a MOCK_ECHO_ENV
knob on the mock server; README env prose updated (en+zh, re-recorded).
User verdict: landstrip is not battle-tested — a days-old,
single-maintainer project (~48 GitHub stars at rejection), which a
security-invariant dependency cannot be. The note moves
proposed/feature -> rejected/feature with the verdict on the Status
line; the sandbox note's deferred-phases cross-link now records the
rejection instead of instructing an evaluation, and the NIH roll-up's
pointer follows. Supersedes this branch's earlier cross-link commit.
The dsh-translate-docs skill now triages updates onto a briefing-driven
path — gen-translation-brief output as the translator's whole working
set, orchestrator-applied mechanical fence edits, scoped record/check —
while the whole-document path for new pairs is unchanged. The i18n
README documents the scoped gate forms and the briefing tool;
development.md lists the new command; the new bilingual Agent Note
records the decision and the ten-example benchmark behind it (briefed
path ~1/3 the tokens and wall clock of the corpus-loading path at equal
judged quality; whole-document re-translation rejected on preservation
collapse). Counterpart updates in this commit were produced with the
new briefed path; the new note's Chinese side is a whole-document
translation.
gen-translation-brief assembles the minimal-update working set for an
out-of-sync pair from its consistency record: the authored side's diff
since last confirmation, the counterpart sections that diff lands in
(heading-mapped only where the last-confirmed structures align), the
terminology rows the diff touches, and a per-direction rules digest.
verify-translation-pairing now accepts pair paths to check just the
named pairs during update iteration; --write requires naming the
confirmed pairs (--write --all is the explicit corpus form) so a bulk
re-record can no longer silently bless drifted pairs the caller never
reviewed. Each record's comment names its own scoped command.
Implements the turndown Agent Note from the NIH dependency audit (full
variant, not the minimal entities-only fallback): dsh-tool-web's fetch
rendering now converts HTML through turndown + @joplin/turndown-plugin-gfm
(atx headings, fenced code, dash bullets, GFM tables/strikethrough) over
the real domino DOM, with script/style/noscript removed wholesale. The
hand-rolled ~86-line regex converter html.ts and its entity tables are
deleted; renderBody wraps the conversion in try/catch falling back to
the raw HTML body, because turndown's recursive DOM walk overflows with
a RangeError on pathological nesting (measured: 4k levels on the main
thread, 8k in a worker) where the regex version could never throw.
Closure weight, measured: tool-web IS in the single-exe runtime closure,
and the exe asset globs would pack ~7.9 MB of the three new packages —
but ~6 MB of that is domino's test corpus, with runtime lib/ at ~550 KB
against a ~174 MB artifact (<0.5% either way), so the swap wins.
Per testing policy the previously-missing keyless web_fetch snapshot
ships in the same change: the acp-agent `web-fetch` scenario boots a new
web.cordis.yml overlay (web seam + real dsh-web-fetch-local provider +
tool-web fetch-only + a loopback HTTP fixture server on a fixed port
serving deterministic HTML with entities, a GFM table, and nesting), so
recording and keyless replay both drive the real HTTP fetch and real
conversion end to end; the scenario pins the new `web` header class.
The Agent Note moves proposed -> implemented and is rewritten per the
lifecycle contract (Decision/Consequences/Testing, closure verdict and
alternatives recorded); tool-web and acp-agent READMEs updated in both
languages and pairs re-recorded.
The reference-admission discard listener matched on followup()'s returned id,
but an agent/inbox/enqueue listener that synchronously cancels emits
agent/inbox/discard before followup() returns to assign that id. The match
then missed, leaking both the submit and discard listeners plus the attached
context per referenced prompt. Match on the content reference instead — the
same value send() carries onto the message, known before followup() runs, and
symmetric with the submit wrapper's content check.
The prior "ordinary allowed path" test passed only because the fake agent
returned a fixed 'stub' id that collided with the id the test constructed;
it now releases each wrapper through its own allowed admission, and a new
regression drives the synchronous-discard timing directly.
CI now exports DSH_GATE_CONCURRENCY into every job, and the lsp suites
spread the raw parent env into the spawn spec's ordinary channel — which
the seam rightly rejects for DSH_* names. The specs now build their child
env the way production does (scrubbedParentEnv() + explicit extras).
The acp with-key e2e never mounted dsh-subprocess-local, leaving the
provider's inject unsatisfied, so no 'acp' provider ever registered.
Review fix (ds-review-bot on #623): matching baselines with differing
seedLength still resolve different policies — overrideOf folds own switches
past the boundary, so a stored seedLength: 1 marks event 0 as subsumed seed
history while a live seedLength: 0 lets the same event tighten the session;
adoption retained the stored header and a restart silently restored the
wide baseline. When either side carries a baseline, the seed boundary is
part of the policy identity and a mismatch rejects as an id collision.
Red-first in the shared coordinator contract (both backends).
Review fixes (ds-review-bot on #623):
- Persistence adoption compares the immutable policy baselines: onCreated's
ownerless claim and adoptLivePrefix retain the STORED header, so a
same-id live session with a conflicting baseline now rejects as a
collision instead of appending under read-only and resuming under the
stored danger-full-access.
- resolve() resolves the session override BEFORE applying an explicit
approved mode: the one-shot grant no longer bypasses the unconditional
durable-header validation.
- The approval narrator attributes positionally over the session's OWN
events (past the seed boundary): a fork child whose baseline delta has
no own override narrates 'inherited from the delegating session' instead
of misattributing a stale seed-carried switch to the user or the
operator.
Red-first: baseline-conflict adoption in the shared coordinator contract
(both backends), resolve-with-explicit-mode validation, and the fork-child
narration attribution case.
PR #679 implemented the swap and falsified the note's parity premise:
vitest's fake clock does not intercept node:timers/promises, so the
change traded deterministic fast tests (llm-retry ~4s->~10s real
sleeps, two pty teardown tests rewritten real-time, a weakened
workflow grace-timer guard) for ~10 deleted lines. Moved the note
proposed -> rejected with the verdict on the Status line; the frozen
proposal body is kept per the rejected-lifecycle contract.
Store the captured validation error as unknown in a wrapper object and
rethrow it directly: the instanceof-Error normalization added an
un-inducible false branch that failed harness.ts's 100% branch gate.
Review fixes (ds-review-bot on #623):
- overrideOf (both knobs) rejects a seedLength past the log end before
slicing: a malformed durable boundary would otherwise empty the
own-switch slice until the log outgrew it, letting a wide baseline
shadow a REAL later tightening. Malformed durable metadata fails loud,
never open.
- The session-query derived index carries the two baseline fields end to
end: schema columns on both session tables (SESSION_QUERY_SQLITE_SCHEMA
_VERSION 6 — derived, rebuilds in place), inserts, header selects, the
candidates CTE, rowHeader, sameHeader, and the cross-source
assertSessionHeadersCompatible — so a search hit's header keeps the
child's inherited confinement and conflicting live/persisted baselines
reject.
Red-first: out-of-range seedLength tests in both policy suites;
baseline round-trip and live/persisted baseline-conflict tests in the
session-query sqlite suite.
Tianyi Cui
_Kerman
kingwl