git:20260901.9a31c17 to git:20260911.8ea0938

25 added, 39 removed. Audit A to A.

---

name: dsh-developer

- description: "Use for any DSH plugin idea, repository, bug, upgrade, audit, UI, test, or release request. Answer or inspect directly when no change is needed; otherwise plan effects and proof, then implement, repair, and verify."

- whenToUse: "For requests to create, change, diagnose, test, harden, upgrade, package, or ship a DSH plugin, even when they do not name this skill."

+ description: "Use for any DSH plugin idea or development request, including DSH itself. Answer or inspect directly when no change is needed; otherwise implement and verify through the native project workflow."

+ whenToUse: "For DSH plugin and harness development requests, even when they do not name this skill."

---

# DSH Developer

- ## Start from conversation

- 1. Extract outcome, target, constraints, profile, trust, effects, and DSH lanes; discover first.

- 2. Choose **Answer** (advise), **Inspect** (read-only evidence), or **Build** (change, repair, upgrade, test, package).

- 3. For Build, inspect for a compact plan: outcome, files/effects, proof path, and material choices. Ask only what changes result or authority. Obtain approval before mutation; same-scope approval counts.

- 4. Then implement, test, diagnose, and repair autonomously; keep one accountable agent and omit mechanics.

- ## Route specialized work

+ ## Understand and act

- Load one reference family per response; safety may join it. Resolve authority first.

+ Establish the outcome from conversation and workspace. Choose **Answer** (advise), **Inspect** (read-only evidence), or **Build** (implement, repair, test, package). For Build, form a compact plan: outcome, files/effects, proof path, and material choices. Then implement, test, diagnose, and repair autonomously, preserving unrelated work.

- - Audit: Doctor first; load [safety](references/safety.md) for untrusted source.

- - Codex/Claude hooks: Hook Bridge Doctor first; classify exact installed bytes statically, never run or expand handlers, and keep activation unclaimed.

- - Creator export: load [the contract](references/creator-export.md); state its new-directory effect.

- - Upgrade: impact before edits; declare attachments when inference is incomplete.

- - Target profile: preflight before installation.

- - Trusted candidate: exact compatibility; execute trusted bytes only.

- - Permission/fixed-authority/delegated issue: load [authority safety](references/authority-safety.md).

- - Core gap: load [core-gap rules](references/core-incubation.md), or [the lab gate](references/execution-lab.md) if execution-bearing.

- - Owned child: load [the isolated-cell contract](references/isolated-cell.md).

- - Apply or recovery: load [the transaction contract](references/cell-apply.md).

- - UI: load [the agent-native route](references/agent-native-ui.md); admit its browser.

+ For a vague idea, propose the capability and state assumptions. Inspect existing configuration, skills, integrations and services before creating a plugin. Try a plausible follow-up change before inventing a framework. Ask only for consequential unresolved choices or missing authority. Implementation requests authorize scoped reversible edits; do not ask again.

- Approval covers edits, not execution trust. DeepSeek runs untrusted source only in an admitted Bubblewrap-backed cell. Codex/GPT requires proven credential/network/write/process/cleanup isolation. Otherwise use static proof; never execute to inspect.

+ ## Select the workflow

- ## Implement, prove, repair

+ Use `dsh_developer` in DSH. Else resolve `../../bin/dsh-developer.js` from this skill directory; `DSH_DEVELOPER_BIN` may override it. Load references when their operations become necessary.

- Use workspace tools: `dsh_developer`/protected `dsh_ui` in DSH, otherwise `DSH_DEVELOPER_BIN`.

+ - Create or change plugins or DSH: [development](references/development.md) owns project inspection, exact-source knowledge and host execution.

+ - Untrusted-source audit: Doctor first, then [safety](references/safety.md).

+ - Hooks: Hook Bridge Doctor first; classify exact installed bytes statically, never run or expand handlers or claim activation.

+ - Creator export: [contract](references/creator-export.md).

+ - Upgrade: impact before edits. Target profile: preflight before install. Ordinary candidate: `verify`; product/promoted bundle: `compatibility`.

+ - Permissions or delegated authority: [authority safety](references/authority-safety.md).

+ - Missing harness-wide guarantee incubated inside this plugin: [core-gap rules](references/core-incubation.md), or [lab gate](references/execution-lab.md) for execution.

+ - Native `cell-plan`/`cell-run`: [native cell](references/native-cell.md). Provider or executor development: [isolated cell](references/isolated-cell.md). Apply or recovery: [transaction](references/cell-apply.md).

+ - UI: [agent-native route](references/agent-native-ui.md); admit its browser.

+ - Session failures: [diagnostics](references/session-diagnostics.md).

- For approved execution in the current top-level DSH Agent:

+ ## Execution and proof

- 1. `cell-plan`: outcome plus 1–4 exact commands/timeouts. It accepts no path/cwd/profile/env/provider/mount/network/session; source is the exact live `exec.agent` in `agents.roots()`, never cwd.

- 2. A plan is not approval. `cell-run` accepts only its digest after audited `tools/pre-execute` grants the displayed plan once; conversation/fields cannot. One admitted offline, credential-free cell runs commands in order without source/profile writes.

- 3. Bound diagnostics. Changed runs remain in a controller stage. Apply only through the exact-digest next action and fresh allowed-once approval; load its transaction contract. Discard exits. Caller paths grant nothing.

+ Edit authority does not itself grant execution trust. Ordinary trusted development uses the calling host’s real execution policy. `run`, `verify` and `dev` are CLI execution, never permission supplied by metadata or model fields. A disposable profile separates configuration; it is not a sandbox.

- Use every applicable gate in order:

+ DeepSeek runs untrusted source only in the admitted host provider (WSL2/Bubblewrap on Windows; Apple container on supported Macs). Codex/GPT untrusted execution requires proven credential/network/write/process/cleanup isolation. Otherwise use static inspection.

- 1. Inspect; use static Doctor until trust is proven.

- 2. Make one authorized edit set; preserve unrelated work.

- 3. Run narrow tests, full validation, then Doctor on the unchanged tree.

- 4. Add preflight, impact, and trusted compatibility when relevant.

- 5. Repair and rerun that gate and all downstream gates; never weaken safety or evidence.

+ Run relevant behavior tests and project checks; complete this product’s full validation after integration. Ordinary plugins use static Doctor (`skipRuntime: true`, CLI `--skip-runtime`) plus `verify`. Product/promoted bundles use their release gates; upstream uses its own checks. Repair failures and rerun that gate and all downstream gates affected by the change. Preserve valid evidence for unchanged code; never weaken safety to obtain a pass.

- DSH 0.1.1-rc.2 blocks; 0.1.2-alpha.3 advises. `--skip-runtime` only explores. Inventory is metadata; behavior is exercised; absence is local.

+ Audit lanes: DSH 0.1.1-rc.2 (blocking) and 0.1.2-alpha.3 (advisory). Development and knowledge may target other exact versions without claiming certification.

- ## Authority and finish

+ ## Finish

- Approved edits need no repeat approval. Publishing, registry/profile/provider/GitHub, and wider targets need separate authority.

+ Publishing, registry/provider/GitHub changes, existing user profiles and wider targets need their own authority. Disposable development profiles belong to the authorized test workflow. Preserve ambiguous staging; schedule nothing after cancellation.

- Answer ends with the answer and assumptions. Inspect ends with findings, evidence, and risks. Build ends with a tested outcome and proof—or an exact blocker and recovery. Preserve ambiguous staging; schedule nothing after cancellation.

+ Return the answer or findings with evidence, assumptions and material limits. For Build, return the tested outcome—or an exact blocker and recovery.