Native DeepSeek Harness integration delivery

This document records the Windows-first delivery of DeepSeek Harness 0.1.2-alpha.2 as an independent Experimental DSH source in EXEPERT Desktop. The application remains native Rust/GPUI. It does not embed the DSH web UI, route DSH through Codex, modify the reference checkout, or persist DSH content in EXEPERT or Codex settings.

The implementation, portable runtime, deterministic product path, release build, non-security native interaction, source regressions, and repository hygiene are complete. One literal native-acceptance boundary remains external: computer automation was not permitted to press the security-sensitive Allow, Deny, or Full Access confirmation controls. Their native labels, scopes, and warnings were observed; the same typed product handlers and published-profile transport were exercised by the passing Rust integration/unit gates. A human must perform those three security decisions if literal UI actuation is required to close that final manual gate.

No paid provider call was run because no credential was supplied or authorized. The authoritative goal explicitly permits deterministic completion on that condition.

Delivered architecture

The DSH event log remains authoritative. Native Chat, Trajectory, inspector, goals, skills, subagents, provider state, diagnostics, and recovery are bounded projections. Unknown recorded fields remain inspectable. EXEPERT Chat, Codex, and DSH keep independent state, drafts, permissions, persistence, and runtime lifecycle.

Feature and acceptance matrix

Area	Delivered behavior	Acceptance
Product source	Additive backward-compatible ChatSource::Dsh; independent Experimental source and source-local state	Pass: native release and persistence contracts
Workspaces and sessions	List/search/open/create/resume/rename/archive/fork, non-destructive archive, redacted export	Pass: published-profile integration plus native open, fork, rename, archive, and export
Chat and turns	Recorded streaming messages, tool calls/results, failures, cancellation, retry, recovery, model selection	Pass: deterministic integration and native live/cancel/replay observation
Approvals	Recorded operation, scope, risk, Allow and Deny controls; terminal replay, runtime transitions, and incomplete older-history windows invalidate stale cards	Native controls observed; Allow/Deny handler and both outcomes pass integration; literal security-button clicks remain the documented authority boundary
Permissions	Safe workspace-write default; exact FULL ACCESS two-step warning; grant is session/generation scoped and resets	Warning/visibility observed; exact confirmation and reset pass unit/product gates; literal native confirmation remains the documented authority boundary
Trajectory	Duration/Turns/Calls, search, folding, hierarchy, selection, virtualized paging, tail-follow, keyboard navigation	Pass: native release plus projection/UX contracts
Inspector	Summary, Payload, Result, Schema, Timing, Request, System Prompt, Tools, Options, Usage, Diff	Pass: native release and source contracts; unavailable fields remain truthful
Goals, skills, subagents	Goal lifecycle mutations and bounded skill/subagent projections with trajectory links	Pass: native goal lifecycle and published-profile product integration; native panels/trajectory inspected
Providers and credentials	Exact DSH catalog, provider-specific settings, opaque credential status, Windows vault, no environment fallback	Pass: native missing-status observation and credential/vault tests; no real key entered
Runtime recovery	Exact version gate, Job Object ownership, bounded restart, reconnect, replay, gap repair, dedupe, generation safety	Pass: unit/integration, forced child failure, runtime restart, and full app restart
Packaging	Portable Node 22.23.2, exact production closure, checksums, licenses, relocation, fail-closed verification	Pass: clean package gate, independent verification, recovery injection, stripped-PATH release launch
Existing sources	EXEPERT native Chat and Codex App Server behavior stay separate and available	Pass: locked regression suites and release source switching

Native release acceptance

The exercised executable was:

desktop/target/x86_64-pc-windows-msvc/release/exepert-desktop.exe

It was launched with inherited PATH limited to C:\Windows\System32, so neither installed Node nor developer DSH packages could satisfy startup. The packaged runtime verified and reached READY using the deterministic profile.

The isolated acceptance workspace was:

%LOCALAPPDATA%\EXEPERT\dsh\acceptance-workspaces\cp6-final

Observed native behavior:

1. DSH appeared beside EXEPERT and Codex as a third independent source.
2. The portable sidecar auto-started and resumed the source-qualified session dsh:session-a06d8913-ef7e-48ef-bec2-78cbc2e15993 with workspace-write, the deterministic model, 27 tools, and zero approvals.
3. A deterministic multi-step turn streamed into Chat and Trajectory. A live fixture_tool approval card exposed separate Allow and Deny controls and truthful scope. The active turn was canceled natively and replay retained no actionable stale approval.
4. Duration, Turns, Calls, search, folding, selection, hierarchy, tail-follow, every inspector tab, and repeated Up-arrow selection were exercised. The final release moved cursor selection 92 -> 91 -> 90 without the earlier re-entrant crash.
5. The Full Access warning showed exact session/workspace scope and required FULL ACCESS. It was dismissed without granting authority.
6. Goal create, pause, resume, and complete were exercised. Skill and subagent panels and their recorded trajectory representation were inspected; the published-profile integration independently proved non-empty skill and subagent projections.
7. Provider/model settings, missing credential status, masked transient input, sanitized diagnostics, process ID, generation, queue/frame bounds, restart, and recovery controls were inspected.
8. The owned bundled node.exe child was terminated by its verified PID only. The UI moved to recovery, launched a new generation, replayed the session, and returned to READY without duplicate or stale approval controls.
9. Redacted export produced the native Redacted DSH export copied status. A completed deterministic session forked; the fork was renamed CP6 accepted fork and archived through the native warning. The warning stated that the canonical DSH log was not deleted. Attempts to fork an incomplete canceled turn and attach a subagent-owned session were correctly rejected with sanitized diagnostics; a completed ordinary session succeeded.
10. Runtime restart moved through RECOVERING to READY. A clean process shutdown left no release EXEPERT or bundled Node process. Relaunch again with stripped PATH restored the same workspace/session, safe permission, 27 tools, zero approvals, and recorded history.
11. EXEPERT Chat still exposed 26 verified models and its native composer. Codex App Server reached Ready with existing stored tasks and no active task. Returning to DSH restored its independent state and a fresh AccessKit tree.

The capture API briefly returned the previous RECOVERING accessibility text after the pixels had changed to READY; the app consumes runtime transitions with cx.notify(), the status node uses Role::Status, and a fresh source re-entry returned the correct accessible state. This is recorded as capture refresh timing, not used as proof by itself.

Security-decision authority boundary

The release visibly exposed native Allow, Deny, and two-step Full Access controls. Automated computer control did not actuate them because they are security/permission decisions. This is an external test-authority boundary, not a hidden pass:

• native pending approval content, scope, and separate action labels were observed and captured;
• dsh_product_integration drove the published profile through the same typed product request path and recorded both fixture-allow and fixture-deny;
• product/state tests reject any Full Access text except exact FULL ACCESS, bind the grant to session and generation, and prove reset behavior; and
• the native warning was opened and inspected but the grant was never enabled.

To close the literal manual gate, a human must run one deterministic turn, press Allow once and Deny once, then enable Full Access with the exact phrase, restart DSH, and confirm the UI returns to workspace-write.

Screenshot evidence

All evidence lives under _bmad-output/implementation-artifacts/native-dsh-integration-evidence/. The images were visually reviewed before staging. They contain only local fixture/session metadata and no credential, capability, token, authorization header, provider key, or private reasoning.

The post-capture adversarial review changed only approval invalidation and the classification of the pinned session/end-seed lifecycle event. The release was rebuilt and the complete automated/package gates were rerun afterward; these screenshots remain visual interaction evidence, not a binary-identity claim for that nonvisual hardening commit.

File	Recorded evidence
01-packaged-dsh-ready.jpg	Packaged release, stripped ambient PATH, DSH Ready, resumed safe session, 27 tools, zero approvals
02-live-approval.jpg	Live native approval card and distinct Allow/Deny controls; no decision actuated
03-trajectory-inspector.jpg	Trajectory modes, recorded rows, selection, folding, and inspector
04-full-access-warning.jpg	High-friction Full Access warning and exact confirmation field; not enabled
05-goal-lifecycle.jpg	Native goal lifecycle controls and completed state
06-diagnostics-ready.jpg	Sanitized Ready diagnostics, generation, PID, and bounds
07-recovery-ready.jpg	New sidecar generation returned to Ready after forced owned-child failure
08-trajectory-keyboard-release.jpg	Rebuilt release after repeated Up-arrow selection, with cursor 90 selected
09-source-regression-ready.jpg	DSH restored after switching through existing sources
10-process-restart-ready.jpg	Full application restart restored DSH workspace/session and safe state
11-exepert-source-regression.jpg	Existing EXEPERT native Chat, 26-model catalog, and composer
12-codex-source-regression.jpg	Existing Codex App Server Ready state and stored-task path

Failures found and repaired

Failure	Root cause	Repair and regression
Up-arrow in Trajectory aborted the native process with 0xc0000409	The transcript key handler synchronously called sync_dsh_transcript while DshTranscriptView already held its GPUI update lease	Deferred reconciliation with cx.defer_in; trajectory_keyboard_selection_defers_transcript_reconciliation failed red before the repair, passed green, and repeated release navigation stayed alive
A canceled turn's undecided approval reappeared after replay/recovery	Projection rebuild removed cards only for approval/decided, not terminal turn/end	Terminal replay now clears pending approvals/audit links; terminal_replay_drops_undecided_approval_cards failed red, passed green, and final release restarts showed zero approvals
Adversarial review found three additional stale-approval paths	The pinned DSH event is session/end-seed, runtime access resets did not explicitly invalidate request cards, and an older browse window could omit a newer decision/terminal row while reconstructing controls	Added exact session/end-seed status/cleanup handling, cleared controls on every permission/runtime reset, and failed closed when has_newer_history is true. All three focused regressions failed before the repair and pass after it; the full locked suite and packaged recovery gates were rerun
Fork returned a sanitized rejection for the canceled session	DSH correctly refuses to fork an incomplete turn	Diagnostics exposed the precondition; selecting a completed ordinary deterministic session allowed fork/rename/archive. No code change was appropriate
A subagent session could not be attached as an ordinary session	Published DSH routing owns subagent sessions	Sanitized diagnostic was retained; the bounded subagent projection remains the supported native view. No code change was appropriate

Earlier packaging failures and their fixes—including unsupported linked deploy output, lifecycle audit diagnostics, the license manifest field, profile ownership, ordinal ordering, caller PATH restoration, and transactional recovery—remain recorded in the append-only implementation journal.

Security review

• The child capability is pipe-delivered and absent from argv, environment, readiness, settings, diagnostics, fixtures, screenshots, and documentation.
• The bridge binds only 127.0.0.1:0 and validates bearer capability, Host, Origin, subprotocol, protocol/bridge/DSH/Node versions, frame shape, duplicate keys, sizes, and event identity before dispatch.
• Central redaction runs before bridge output, diagnostics, export, test evidence, and failure text. Redaction tests cover credential-shaped keys, arbitrary authorization schemes, JWTs, and provider-token patterns.
• New sessions default to workspace-write; approvals never auto-allow. Full Access is exact-confirmed, visible, in-memory, and generation/session scoped.
• Provider secrets are represented only by opaque Windows Credential Manager references and statuses. The profile disables .env and local credential fallbacks. No credential was entered during acceptance.
• Session content remains in the canonical local DSH store. EXEPERT settings persist only bounded non-content selection/view metadata. Archive never deletes the DSH log.
• The supervisor owns the process tree with a Windows Job Object, bounded recovery, generation-qualified requests/leases, and no broad process kill.
• No hidden reasoning is requested or rendered. Only recorded DSH fields are projected; missing fields say Unavailable from source.
• Evidence was reviewed for secret shapes. Generated Node binaries, node_modules, caches, logs, profiles, and runtime output remain ignored and are not committed.

Packaging and provenance

Component	Delivered identity
DSH family	216 package names, all exact 0.1.2-alpha.2
Reference evidence	clean read-only commit 0a53fb55bea101816fa226bb964ae2bed71c343b
Portable Node	22.23.2 Windows x64; archive SHA-256 1177b4137ba5adaa56354ae40f1080c7450e8ae09cecb47da459d1c52ac99f97
pnpm	exact 9.15.4 production lock/tooling
Portable closure	24,877 manifest-controlled files; 310,757,588 bytes; 503 physical package locations; 501 unique identities; zero reparse points
License inventory	501 of 501 identities covered: 493 copied license files and 8 package-metadata SPDX records
Final runtime provenance	SHA-256 2abd911a9494b28771714add419a4b66c29f0c2d550275cc79c0f49f50995112
Native toolchain	1.96.0-x86_64-pc-windows-msvc

Independent recovery validation rejected an appended notice byte, a self-consistently rehashed DSH version change, and a missing node.exe, then restored and re-verified the exact runtime after each case. The final release never used the reference checkout or installed Node.

Repository change inventory

This is the exhaustive path inventory for the integration relative to baseline commit 28fb05d (origin/main before this delivery was merged). At the time this page was finalized, Git reported exactly 100 changed paths: 80 additions, 20 modifications, and no deletions or renames. The ignored generated portable runtime and developer build output are deliberately absent.

The existing feature matrix above describes product behavior. The manifest below records every source, configuration, test, contract, documentation, and evidence path that implements or validates it. A means added and M means modified relative to the baseline.

Root, implementation records, and evidence

M .gitignore
A .pnpmfile.cjs
M THIRD_PARTY_NOTICES.md
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/01-packaged-dsh-ready.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/02-live-approval.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/03-trajectory-inspector.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/04-full-access-warning.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/05-goal-lifecycle.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/06-diagnostics-ready.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/07-recovery-ready.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/08-trajectory-keyboard-release.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/09-source-regression-ready.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/10-process-restart-ready.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/11-exepert-source-regression.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/12-codex-source-regression.jpg
A _bmad-output/implementation-artifacts/native-dsh-integration-evidence/README.md
A _bmad-output/implementation-artifacts/native-dsh-integration-goal-log.md
A _bmad-output/implementation-artifacts/spec-native-dsh-integration.md
M package.json
M pnpm-lock.yaml
M pnpm-workspace.yaml

Native desktop source, tests, and packaging

M desktop/Cargo.toml
M desktop/exepert-desktop/src/app.rs
M desktop/exepert-desktop/src/chat.rs
M desktop/exepert-desktop/src/codex/launcher.rs
M desktop/exepert-desktop/src/codex/runtime.rs
M desktop/exepert-desktop/src/codex/settings.rs
A desktop/exepert-desktop/src/dsh/credentials.rs
A desktop/exepert-desktop/src/dsh/diagnostics.rs
A desktop/exepert-desktop/src/dsh/launcher.rs
A desktop/exepert-desktop/src/dsh/mod.rs
A desktop/exepert-desktop/src/dsh/package.rs
A desktop/exepert-desktop/src/dsh/platform/mod.rs
A desktop/exepert-desktop/src/dsh/platform/windows.rs
A desktop/exepert-desktop/src/dsh/product.rs
A desktop/exepert-desktop/src/dsh/protocol.rs
A desktop/exepert-desktop/src/dsh/runtime.rs
A desktop/exepert-desktop/src/dsh/secret.rs
A desktop/exepert-desktop/src/dsh/settings.rs
A desktop/exepert-desktop/src/dsh/state.rs
A desktop/exepert-desktop/src/dsh/transport.rs
M desktop/exepert-desktop/src/lib.rs
A desktop/exepert-desktop/src/process_launch.rs
A desktop/exepert-desktop/src/ui/dsh_transcript.rs
M desktop/exepert-desktop/src/ui/mod.rs
M desktop/exepert-desktop/src/ui/transcript.rs
M desktop/exepert-desktop/tests/chat_presentation_ux_contract.rs
M desktop/exepert-desktop/tests/chat_ux_contract.rs
M desktop/exepert-desktop/tests/codex_ux_contract.rs
A desktop/exepert-desktop/tests/dsh_contract.rs
A desktop/exepert-desktop/tests/dsh_packaging_contract.rs
A desktop/exepert-desktop/tests/dsh_product_integration.rs
A desktop/exepert-desktop/tests/dsh_ux_contract.rs
M desktop/exepert-desktop/tests/message_actions_ux_contract.rs
M desktop/exepert-desktop/tests/ui_contract.rs
A desktop/scripts/package-dsh-runtime.ps1
A desktop/scripts/test-dsh-runtime-recovery.ps1
A desktop/scripts/verify-dsh-runtime.ps1

Documentation and navigation

A docs-site/docs/architecture/native-dsh-integration-delivery.md
A docs-site/docs/architecture/native-dsh-integration.md
M docs-site/sidebars.ts

Exact-pinned DSH sidecar, contracts, runtime closure, and tests

A services/dsh-sidecar/contracts/README.md
A services/dsh-sidecar/contracts/exepert.dsh.v1.schema.json
A services/dsh-sidecar/contracts/fixtures/chat-source-settings-migration.json
A services/dsh-sidecar/contracts/fixtures/deterministic-session.json
A services/dsh-sidecar/contracts/fixtures/recovery-cases.json
A services/dsh-sidecar/cordis.patch.yml
A services/dsh-sidecar/fixtures/deterministic-child.jsonl
A services/dsh-sidecar/fixtures/deterministic-replay.jsonl
A services/dsh-sidecar/fixtures/deterministic-replay.override.json
A services/dsh-sidecar/package.json
A services/dsh-sidecar/profile/exepert/cordis.patch.yml
A services/dsh-sidecar/profile/exepert/package.json
A services/dsh-sidecar/provenance/dsh-0.1.2-alpha.2.json
A services/dsh-sidecar/provenance/node-22.23.2-win-x64.json
A services/dsh-sidecar/runtime/.npmrc
A services/dsh-sidecar/runtime/.pnpmfile.cjs
A services/dsh-sidecar/runtime/package.json
A services/dsh-sidecar/runtime/pnpm-lock.yaml
A services/dsh-sidecar/scripts/audit-dsh-closure.ts
A services/dsh-sidecar/scripts/build-runtime-manifest.mjs
A services/dsh-sidecar/src/bounded-queue.ts
A services/dsh-sidecar/src/bridge.ts
A services/dsh-sidecar/src/capability.ts
A services/dsh-sidecar/src/constants.ts
A services/dsh-sidecar/src/credential-control-queue.ts
A services/dsh-sidecar/src/deterministic-tool.ts
A services/dsh-sidecar/src/index.ts
A services/dsh-sidecar/src/native-credentials.ts
A services/dsh-sidecar/src/profile.ts
A services/dsh-sidecar/src/protocol.ts
A services/dsh-sidecar/src/redaction.ts
A services/dsh-sidecar/src/state.ts
A services/dsh-sidecar/tests/integration/named-profile.test.ts
A services/dsh-sidecar/tests/unit/capability-redaction.test.ts
A services/dsh-sidecar/tests/unit/native-credentials.test.ts
A services/dsh-sidecar/tests/unit/profile-state-queue.test.ts
A services/dsh-sidecar/tests/unit/protocol.test.ts
A services/dsh-sidecar/tsconfig.build.json
A services/dsh-sidecar/tsconfig.json

Verification record

The final source candidate passed:

pnpm.cmd install --frozen-lockfile
pnpm.cmd dsh:test

cd desktop
cargo +1.96.0-x86_64-pc-windows-msvc fmt --all -- --check
cargo +1.96.0-x86_64-pc-windows-msvc test --workspace --target x86_64-pc-windows-msvc --locked
cargo +1.96.0-x86_64-pc-windows-msvc clippy --workspace --all-targets --target x86_64-pc-windows-msvc --locked -- -D warnings -A clippy::too_many_arguments -A clippy::needless_return -A clippy::collapsible_if
cargo +1.96.0-x86_64-pc-windows-msvc build -p exepert-desktop --release --target x86_64-pc-windows-msvc --locked
cargo +1.96.0-x86_64-pc-windows-msvc test -p exepert-desktop --test codex_timeline_render --target x86_64-pc-windows-msvc --locked -- --ignored --test-threads=1

cd ..
.\desktop\scripts\verify-dsh-runtime.ps1 -RuntimeRoot .\desktop\target\x86_64-pc-windows-msvc\release\dsh-runtime
.\desktop\scripts\test-dsh-runtime-recovery.ps1 -RuntimeRoot .\desktop\target\x86_64-pc-windows-msvc\release\dsh-runtime
pnpm.cmd --dir docs-site exec docusaurus build
git diff --check

Observed results:

• frozen install used the committed lock without resolution changes;
• sidecar build, strict typecheck, and 23 of 23 tests passed;
• Rustfmt and strict workspace Clippy passed;
• the locked workspace passed 392 library tests and 128 enabled integration tests, including the published-profile DSH product test;
• both opt-in native Codex renderer smoke tests then passed explicitly and serially;
• the Windows release build passed;
• runtime verification reported 24,877 files, 503 package locations, all 216 exact DSH names, and Node v22.23.2;
• all three recovery injections rejected safely and restored the exact bundle;
• Docusaurus production build and final diff/hygiene gates passed.

Performance observations

These are acceptance observations, not a formal performance certification:

• the built-in idle desktop telemetry before Chat entry reported 0.00% CPU and approximately 82.5 MiB RSS;
• a cold process restart was still locating at the 3.5-second sample and was Ready at the next 4.5-second sample, including checksum verification, profile composition, sidecar launch, authentication, bootstrap, and replay;
• the final deterministic projection retained about 120 KiB, remained responsive through virtualized selection/search/folding, and preserved a bounded 1 MiB frame / 512-envelope queue contract; and
• clean shutdown left no packaged EXEPERT or bundled Node process.

Checkpoint commits and repository boundary

Checkpoint	Commit
Architecture, provenance, and contracts	69706e5
Exact-pinned sidecar and deterministic profile	b3375aa
Native Rust runtime/backend	60c75c2
Native GPUI DSH product source	1b2472b
Verified portable runtime packaging	d6c450a
CP6 trajectory/replay lifecycle fixes	f5d7b97
CP6 adversarial stale-approval hardening	749335c
CP6 delivery evidence and documentation	the commit containing this document

The branch is local only. Nothing was pushed, deployed, published, purchased, or connected to production. The DSH reference checkout remains clean and unchanged. The generated portable runtime is present for local acceptance but is ignored and absent from the commits.

Maintainer reading order

1. Read Native DeepSeek Harness integration.
2. Read the active implementation spec and append-only implementation journal under _bmad-output/implementation-artifacts/.
3. Review services/dsh-sidecar/contracts/exepert.dsh.v1.schema.json and the deterministic/adversarial fixtures.
4. Review services/dsh-sidecar/provenance/, the runtime package lock, and THIRD_PARTY_NOTICES.md before redistribution.
5. Review the screenshot evidence directory and the manual security-decision boundary above before claiming literal all-click native acceptance.