RC: DSHX Production 1.0

.github/workflows/ci.yml

@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  core:
+    name: Core / Node 24
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Verify exact source checkout
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          actual="$(git rev-parse HEAD)"
+          if [[ "$actual" != "$EXPECTED_SHA" ]]; then
+            echo "wrong source checkout: expected=$EXPECTED_SHA actual=$actual" >&2
+            exit 1
+          fi
+          echo "exact source checkout: $actual"
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Install frozen dependency graph
+        run: npm ci
+      - name: Verify exact DeepSeek Harness release closure
+        run: node scripts/verify-dsh-closure.mjs
+      - name: Unit and contract tests
+        run: npm test
+      - name: Verify DSH ownership boundary
+        run: node scripts/verify-ownership-boundary.mjs
+      - name: Boot and dispose official DeepSeek Harness composition
+        run: node scripts/runtime-smoke.mjs
+      - name: Syntax check shipped JavaScript
+        shell: bash
+        run: |
+          set -euo pipefail
+          while IFS= read -r file; do node --check "$file"; done < <(find src bin scripts -type f -name '*.mjs' -print | sort)
+      - name: Syntax check PTY smoke
+        run: python3 -m py_compile test/tui_smoke.py
+
+  linux-tui:
+    name: Linux TUI / pinned Codex / local IPC
+    needs: core
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Verify exact source checkout
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          actual="$(git rev-parse HEAD)"
+          if [[ "$actual" != "$EXPECTED_SHA" ]]; then
+            echo "wrong source checkout: expected=$EXPECTED_SHA actual=$actual" >&2
+            exit 1
+          fi
+          echo "exact source checkout: $actual"
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Install frozen dependency graph
+        run: npm ci
+      - name: Verify exact DeepSeek Harness release closure
+        run: node scripts/verify-dsh-closure.mjs
+      - name: Build pinned Codex TUI + local IPC bridge
+        shell: bash
+        env:
+          DSHX_VERSION: 1.0.0-ci
+        run: bash scripts/build-codex-tui.sh
+      - name: Verify thin-fork and transport invariants
+        run: node scripts/verify-tui-invariants.mjs
+      - name: Verify local IPC data plane
+        shell: bash
+        run: dist/bin/dshx-ipc-bridge --check
+      - name: Exercise real TUI through Linux PTY + CJK + resize
+        shell: bash
+        run: |
+          set -euo pipefail
+          VENV="$RUNNER_TEMP/dshx-pty-venv"
+          python3 -m venv "$VENV"
+          "$VENV/bin/python" -m pip install --disable-pip-version-check pexpect
+          "$VENV/bin/python" test/tui_smoke.py

.github/workflows/rc-platform.yml

@@ -0,0 +1,106 @@
+name: RC Platform Gate
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rc-platform-${{ github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  windows:
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release/')
+    name: Windows ConPTY / CJK / local IPC
+    runs-on: windows-latest
+    timeout-minutes: 150
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Verify exact source checkout
+        shell: pwsh
+        env:
+          EXPECTED_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          $actual = (git rev-parse HEAD).Trim()
+          if ($actual -ne $env:EXPECTED_SHA) {
+            throw "wrong source checkout: expected=$env:EXPECTED_SHA actual=$actual"
+          }
+          Write-Host "exact source checkout: $actual"
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Install frozen dependency graph
+        run: npm ci --include=optional --ignore-scripts=false
+      - name: Verify exact DeepSeek Harness release closure
+        run: node scripts/verify-dsh-closure.mjs
+      - name: Boot and dispose official DeepSeek Harness composition
+        run: node scripts/runtime-smoke.mjs
+      - name: Build pinned Codex TUI + local IPC bridge
+        shell: pwsh
+        env:
+          DSHX_VERSION: 1.0.0-ci
+        run: ./scripts/build-codex-tui.ps1
+      - name: Verify thin-fork and transport invariants
+        run: node scripts/verify-tui-invariants.mjs
+      - name: Verify Windows local IPC data plane
+        shell: pwsh
+        run: |
+          & .\dist\bin\dshx-ipc-bridge.exe --check
+          if ($LASTEXITCODE -ne 0) { throw 'local IPC data-plane self-check failed' }
+      - name: Exercise real TUI through Windows ConPTY + CJK text
+        run: node test/tui_smoke_windows.mjs
+
+  macos:
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release/')
+    name: macOS PTY / CJK / resize / local IPC
+    runs-on: macos-26
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+      - name: Verify exact source checkout
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          actual="$(git rev-parse HEAD)"
+          if [[ "$actual" != "$EXPECTED_SHA" ]]; then
+            echo "wrong source checkout: expected=$EXPECTED_SHA actual=$actual" >&2
+            exit 1
+          fi
+          echo "exact source checkout: $actual"
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Install frozen dependency graph
+        run: npm ci --include=optional --ignore-scripts=false
+      - name: Verify exact DeepSeek Harness release closure
+        run: node scripts/verify-dsh-closure.mjs
+      - name: Boot and dispose official DeepSeek Harness composition
+        run: node scripts/runtime-smoke.mjs
+      - name: Build pinned Codex TUI + local IPC bridge
+        shell: bash
+        env:
+          DSHX_VERSION: 1.0.0-ci
+        run: bash scripts/build-codex-tui.sh
+      - name: Verify thin-fork and transport invariants
+        run: node scripts/verify-tui-invariants.mjs
+      - name: Verify macOS local IPC data plane
+        shell: bash
+        run: dist/bin/dshx-ipc-bridge --check
+      - name: Exercise real TUI through macOS PTY + CJK + resize
+        shell: bash
+        run: |
+          set -euo pipefail
+          VENV="$RUNNER_TEMP/dshx-pty-venv"
+          python3 -m venv "$VENV"
+          "$VENV/bin/python" -m pip install --disable-pip-version-check pexpect
+          "$VENV/bin/python" test/tui_smoke.py