diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aabb61e..f34c2b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,8 +44,8 @@ jobs:
run: pnpm vitest run packages/core/tests/config-loader.test.ts packages/core/tests/config-validation.test.ts packages/core/tests/policy-errors.test.ts packages/core/tests/policy-resolver.test.ts
- name: Core property contracts
run: pnpm vitest run packages/core/tests/core-property.test.ts
- - name: DSH execution and host contracts
- run: pnpm vitest run packages/dsh/tests/dsh-request-contract.test.ts packages/dsh/tests/host-composition.test.ts packages/dsh/tests/vertical-slice.test.ts packages/dsh/tests/keyless-vertical-slice.test.ts
+ - name: DSH execution, host, and release-bridge contracts
+ run: pnpm vitest run packages/dsh/tests/dsh-request-contract.test.ts packages/dsh/tests/host-composition.test.ts packages/dsh/tests/vertical-slice.test.ts packages/dsh/tests/keyless-vertical-slice.test.ts packages/dsh/tests/dsh-012-compat.test.ts
- name: Auth, knowledge, CLI, and overlay contracts
run: pnpm vitest run packages/auth/tests/auth.test.ts packages/model-knowledge/tests/knowledge.test.ts packages/cli/tests/user-commands.test.ts packages/dsh/tests/knowledge-overlay.test.ts
- name: CLI package typecheck
@@ -65,11 +65,12 @@ jobs:
- run: pnpm install --frozen-lockfile
- run: pnpm qa:pack-install
- # Optional upstream source lane: explicit DSH_REFERENCE_DIR, never a
- # default hermetic dependency.
+ # Optional upstream source lane: kept manual while the DSH 0.1.2 package set
+ # is rolling through npm. compatibility.json records the current source
+ # target separately from the verified install baseline.
dsh-upstream-source-contract:
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch'
steps:
- uses: actions/checkout@v4
- - run: echo 'dsh-upstream-source-contract is informational; requires DSH_REFERENCE_DIR checkout'
+ - run: echo 'Use compatibility.json target.dshRelease as the source canary; promote it to the install baseline only after the npm package set and clean profile journey are verified.'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ca096f..cefcabf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ DSHelm is still in alpha. Entries before the first public npm publication are **
- Added a CI gate for publishable package metadata and reduced duplicate/stale branch runs.
- Kept `dshelm init`'s default `@dshelm/dsh` bundle version aligned with the installed CLI package version.
- Added a machine-readable publishable package graph and version-independent pack/install verification, removing release-version literals from CI and reading the verified DSH package baseline from `compatibility.json`.
+- Audited DeepSeek Harness `0.1.2-rc.1` as the current source target and added forward-compatible bridges for the new Session snapshot API plus subagent `agentOptions` / `reasoningEffort` semantics, while keeping `0.1.0-rc.7` as the verified install baseline until the full npm graph and clean-profile journey pass.
+- Rebuilt the bilingual README landing experience around a visual routing flow, explicit compatibility/evidence cards, a real control-plane screenshot, and clearer separation between demonstrated contracts and unverified provider/runtime claims.
## 0.3.0-alpha.0 — 2026-08-19 — source milestone
diff --git a/README.en.md b/README.en.md
index cc4bc64..ac93458 100644
--- a/README.en.md
+++ b/README.en.md
@@ -1,49 +1,129 @@
-# DSHelm
-
-[简体中文](README.md)
-
-DSHelm is an explainable multi-model routing layer for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). It keeps model selection, policy overrides, and routing evidence explicit while leaving sessions, tools, workflows, and execution to the DSH ecosystem.
+
> [!IMPORTANT]
-> DSHelm is currently a `0.3.0-alpha` source preview. npm packages have not been published yet, and the project should not be treated as production-ready.
+> DSHelm is a `0.3.0-alpha` **source preview**. The npm packages are not published yet and the project is not production-ready. DeepSeek Harness `0.1.2-rc.1` is the current **source target**: core/session/subagent and browser-source bridges are in place, but the 0.1.2 client package graph has moved away from the legacy `dsh-client-runtime` into the new client module system. It will not be promoted to the verified install baseline until the complete npm graph, client manifest/lockfile migration, and clean-profile/Web journey are proven.
-## What it provides
+
+
+
-- **Capability-aware model routing**: apply runtime, authentication, context, and cost constraints before ranking candidates.
-- **Resolution Trace**: record the selected role/model/reasoning level, override source, and candidate elimination reasons.
-- **DSH-native integration**: use DSH extension surfaces instead of duplicating its session, tool, workflow, or desktop runtime.
-- **Explicit user control**: project- and request-level configuration can override DSHelm recommendations.
-- **Evidence-backed compatibility**: keep model and platform claims tied to reproducible runtime evidence rather than informal rankings.
+## Understand DSHelm in two minutes
-## Current status — September 2026
+DSHelm is an **explainable multi-model routing control plane** for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). It does not replace DSH sessions, tools, workflows, providers, or agent execution. Before execution, it answers three questions:
-The current `main` line contains the `0.3.0-alpha` authentication and model-orchestration work, DSH profile installation, `doctor` / `explain`, Resolution Trace, the Web control plane, and read-only OmO migration support.
+1. **Which role / provider / model should handle this step?**
+2. **Which runtime, authentication, context, or cost constraints eliminated alternatives?**
+3. **Did the final choice come from defaults, a user/project override, or the current request?**
-The next public milestones are tracked as community issues:
+
+
+
-| Issue | Goal |
+| DSHelm owns | DeepSeek Harness owns |
| --- | --- |
-| [#7 — npm alpha](https://github.com/Altairpaca/dshelm/issues/7) | Publish a verifiable public alpha and capture clean-HOME install/uninstall evidence |
-| [#8 — platform evidence matrix](https://github.com/Altairpaca/dshelm/issues/8) | Collect reproducible Linux, macOS Apple Silicon, and Windows 11 + WSL2 installation reports |
-| [#9 — first-run example](https://github.com/Altairpaca/dshelm/issues/9) | Ship a credential-light planner → workers → reviewer example with an observable trace |
-| [#10 — contributor entry points](https://github.com/Altairpaca/dshelm/issues/10) | Define contribution paths for provider/model evidence, platform verification, docs, examples, and reproducible bugs |
+| policy, routing, capability evidence | agent lifecycle, sessions, tool execution |
+| provider/model/reasoning selection | provider adapters and real model calls |
+| user/project/request overrides | profile/plugin composition |
+| Resolution Trace and selection explanation | host, Web, Headless, SDK execution surfaces |
+
+**Planner, worker, and reviewer roles can use different models while every decision remains inspectable.**
+
+### Real control plane
-The project remains a **source preview** until those release and verification gates are actually satisfied.
+
+
+
-### Inspect routing and execution before configuring a provider
+## Credential-free first run
-Two credential-free fixtures make the evidence boundary explicit:
+The repository keeps two deterministic fixtures separate because they prove different layers:
```bash
pnpm example:first-run
pnpm example:dsh-execution
```
-`example:first-run` validates the **routing and explanation contract only**. `example:dsh-execution` goes one layer further: it uses the real DSH Context, agent factory and AgentLoop for planner → two bounded workers → reviewer, while keeping model responses deterministic through a synthetic provider. It therefore proves that resolved routes reach actual DSH requests without claiming external-provider connectivity or model quality. See [`examples/README.md`](examples/README.md) for the exact scope and output.
+| Command | What is real | What it deliberately does not prove |
+| --- | --- | --- |
+| `example:first-run` | DSHelm Core resolver + Resolution Trace | no DSH agent execution, no provider call |
+| `example:dsh-execution` | real DSH `Context` + `AgentRegistry` + `AgentLoop`; planner → bounded workers → reviewer; actual request routes captured | synthetic LLM adapter, so no external network/OAuth/model-quality claim |
+
+The execution fixture compares the routes received by the actual DSH adapter with the DSHelm resolutions one by one. It therefore proves that **DSHelm routing decisions reach the real DSH request path**. See [`examples/README.md`](examples/README.md) for the output contract and evidence boundary.
+
+
+Why keep two fixtures?
+
+Resolver and execution contracts are different failure domains. Keeping them separate makes routing regressions cheap to isolate while still providing a real DSH integration proof without requiring an API key.
+
+
+
+## Current capabilities
+
+| Capability | Status | Evidence today |
+| --- | --- | --- |
+| DSH-native profile / bundle | Alpha | isolated `dshelm` profile, `@dshelm/dsh` bundle, clean-profile journey |
+| Multi-model routing | Alpha | hard gates, evidence scoring, policy overrides |
+| Resolution Trace | Alpha | candidate outcomes, field provenance, selected route |
+| Account/auth discovery | Alpha | API keys, provider OAuth, selected product login state; product credentials are not copied |
+| Web control plane | Alpha | Roles × Models and latest routing explanation |
+| planner → workers → reviewer | Alpha | deterministic real-DSH execution fixture |
+| OmO migration | Preview | read-only SUPPORTED / MAPPED / LOSSY / UNSUPPORTED report |
+| npm install | Release gate | unpublished; tracked in [#7](https://github.com/Altairpaca/dshelm/issues/7) |
+| Cross-platform verification | Community evidence | Linux, macOS Apple Silicon, Windows 11 + WSL2 reports in progress |
+
+## DeepSeek Harness compatibility
+
+### Current state
+
+DSHelm deliberately separates a verified install baseline from the newest upstream source target:
+
+- **Verified install baseline — `0.1.0-rc.7`**: package/runtime, clean HOME, profile composition, bounded boot, doctor/explain/uninstall have been exercised.
+- **Current source target — `0.1.2-rc.1`**: the latest DeepSeek Harness source release published on **September 3, 2026**. Confirmed core/session/subagent changes are bridged and the Web control-plane source no longer imports the removed legacy runtime types; **the 0.1.2 client package graph migration and Web bundle verification remain promotion blockers**.
+
+The machine-readable status lives in [`compatibility.json`](compatibility.json), and the full seam-by-seam audit is in [`docs/compatibility/dsh-0.1.2-rc.1.md`](docs/compatibility/dsh-0.1.2-rc.1.md). The current upstream target is [`dsh-v0.1.2-rc.1`](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-rc.1).
+
+### 0.1.2 changes bridged or explicitly located
+
+| Upstream change | DSHelm handling |
+| --- | --- |
+| `Session.events` replaced by `seq` / `eventAt()` / `snapshotEvents()` | session-log bridge prefers `snapshotEvents()` and falls back to legacy `events` |
+| `SubagentCapabilities` adds the `agentOptions` gate | DSHelm provider advertises `agentOptions: true` at runtime while remaining compilable against the legacy type surface |
+| `AgentOptions` adds `reasoningEffort` | current hosts receive the reasoning option directly; legacy hosts retain the `request/header` seed path |
+| callers may specify provider/model/reasoning/max output for subagents | DSHelm maps policy resolution onto the official `agentOptions` seam; max-output policy is not claimed yet |
+| old `packages/client/runtime` / `@deepseek-ai/dsh-client-runtime` disappears from the 0.1.2 source tree | browser source now types only the `sessions.binding(...).session.projections` face it actually consumes; no legacy runtime client-type import remains |
+| `@deepseek-ai/dsh-client-modules` now owns `dsh.client` discovery, boot graph, `/plugins` bundles and lazy materialization | mechanism audited; `@dshelm/dsh` dependency/inject metadata must migrate atomically with the exact-version lockfile and a real Web load assertion |
+
+The package manifests are intentionally **not** force-bumped to `0.1.2-rc.1` in this step. Upstream npm publication is rolling on September 3, and the DSHelm lockfile still represents the verified legacy baseline. Promotion must happen together with complete package availability, the client module graph, lockfile regeneration, and a fresh install/profile boot/Web-client materialization.
+
+
+Why not claim generic “0.1.x support”?
+
+DSH prerelease session, subagent, client, and profile seams are still moving. DSHelm records compatibility per seam and per piece of evidence so a semver range does not imply a runtime guarantee that has not been measured. The exact release gate is documented in [`docs/RELEASING.md`](docs/RELEASING.md).
+
+
## Source preview
-Requirements: Node.js `>=22.19.0`, pnpm `11.7.0`, and a DSH CLI available on `PATH`. See [`compatibility.json`](compatibility.json) for the currently verified stack.
+Requirements: Node.js `>=22.19.0`, pnpm `11.7.0`, and a DSH CLI matching the verified baseline. Check [`compatibility.json`](compatibility.json) before trying a newer DSH train.
```bash
git clone https://github.com/Altairpaca/dshelm.git
@@ -53,7 +133,7 @@ pnpm install --frozen-lockfile
pnpm preview:init
```
-Then inspect the installed profile and routing state:
+`preview:init` builds the workspace and installs the source preview under `$DSH_HOME/profiles/dshelm`. It does not log into providers or copy Codex, Claude, or other product-owned credentials.
```bash
dsh --profile dshelm --dump-config
@@ -63,26 +143,47 @@ node packages/cli/dist/index.js explain deepseek/deepseek-v4-flash
dsh --profile dshelm
```
-The source-preview installer does not copy Codex, Claude, or other product-owned credentials into DSHelm. Uninstall removes DSHelm-owned discovery/profile state while preserving credentials by default:
+Uninstall preserves credentials by default:
```bash
node packages/cli/dist/index.js uninstall --yes
```
-The intended post-publication entry point is `npx dshelm init --yes`; it is deliberately not presented as a runnable installation command until the npm release exists.
+The intended post-publication entry point is `npx dshelm init --yes`; it remains documentation-only until registry artifacts and clean-install evidence exist.
-## Architecture and community
+## Workspace map
```text
-task requirements → runtime/auth hard constraints → model capability evidence → user/project/request overrides → DSH execution + Resolution Trace
+@dshelm/core policy schema · merge · resolver · Resolution Trace
+@dshelm/model-knowledge capability evidence · provenance · confidence
+@dshelm/auth provider/account capability discovery
+@dshelm/dsh DSH adapter · host service · subagent provider · Web client
+@dshelm/compat-omo read-only OmO migration
+
+dshelm CLI · init · doctor · auth · explain · uninstall
```
-DSHelm Core owns policy, configuration, routing, and explanation. DSH and its plugins remain responsible for task execution. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for the boundary.
+[`release-packages.json`](release-packages.json) owns the publishable package graph and `pnpm qa:pack-install` owns the reusable packed-install journey. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for the full boundary.
+
+## Community roadmap
+
+| Issue | Next step |
+| --- | --- |
+| [#7 — npm alpha](https://github.com/Altairpaca/dshelm/issues/7) | DSH dependency + client-module promotion, registry publish, clean-HOME/Web install/uninstall evidence |
+| [#8 — platform matrix](https://github.com/Altairpaca/dshelm/issues/8) | reproducible Linux, macOS Apple Silicon, Windows 11 + WSL2 verification |
+| [#9 — first-run evidence](https://github.com/Altairpaca/dshelm/issues/9) | deterministic execution fixture landed; add provider-backed evidence |
+| [#10 — contributor entry points](https://github.com/Altairpaca/dshelm/issues/10) | provider/model evidence, platform verification, docs, routing examples, reproducible bugs |
+
+DSHelm prefers upstream public contracts over parallel undocumented APIs. Relevant DeepSeek Harness discussions include [model planning/execution #3297](https://github.com/deepseek-ai/deepseek-harness/discussions/3297), [desktop host #3118](https://github.com/deepseek-ai/deepseek-harness/discussions/3118), [`dsh doctor` #1719](https://github.com/deepseek-ai/deepseek-harness/discussions/1719), and [CLI provider/fallback #3283](https://github.com/deepseek-ai/deepseek-harness/discussions/3283).
-Compatibility work is tracked through reproducible evidence across DSH versions, providers/models, Linux, macOS, Windows 11 + WSL2, and credential/network/data-location boundaries. Public DSH interface questions should be discussed against the corresponding upstream contract rather than maintained as a parallel undocumented API.
+For contribution workflow, see [`CONTRIBUTING.md`](CONTRIBUTING.md); for support channels, [`SUPPORT.md`](SUPPORT.md); for participation expectations, [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). Issues and pull requests are welcome in English or Simplified Chinese.
-For contribution workflow, use [`CONTRIBUTING.md`](CONTRIBUTING.md). For usage questions and channel selection, use [`SUPPORT.md`](SUPPORT.md). Community participation is covered by [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). Issues and pull requests are welcome in English or Simplified Chinese.
+## Security and evidence boundaries
-DSHelm is an independent project. It is not affiliated with or endorsed by DeepSeek or by any model/provider mentioned in the repository.
+- Only opaque `CredentialRef` values enter policy and traces; product-owned secrets remain product-owned.
+- Authentication state that cannot be confirmed is reported as `unknown`, never guessed as logged in.
+- Soft model scores are maintainer heuristics with provenance and confidence, not a model leaderboard.
+- Synthetic fixtures prove routing/execution contracts, not external-provider availability or model quality.
+- DSHelm is an independent community project and is not affiliated with or endorsed by DeepSeek or any model/provider named in the repository.
Apache License 2.0.
diff --git a/README.md b/README.md
index 8897f6a..4a92336 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@