[viztor]

Phase P-T1b of docs/improvement-plan.md, stacked on #109.

An in-process harness that runs the plugin inside the real host, so the routing phases that follow (P-H, P-R1, P-R2) are measured against today's behaviour rather than against fakes. Additive only: no src/ change.

The sections from "What changed" to "Verification" describe the original scope. Where they disagree with Restacked onto main 1.8.0 below (the pinned and patched e2e-host cell, the patches/ line, the single S0_TODAY table), the restack section is current.

What changed

Item	Files	What it does
Harness, tier A	test/support/host.ts	A bare cordis Context with LlmRuntime and dsh-llm-pi-ai mounted with { providers }, for the internal/config waterfall and pi-ai's credential paths.
Harness, tier B	test/support/host.ts	dsh-app-boot's boot() with a temporary HOME, a test bundle (llm, llm-pi-ai, editor: ConfigEditor, settings: Settings, the plugin), a fake credentials service and a launch-environment snapshot. Rows carry package names through a stub module loader, because the plugin finds pi-ai by options.name. The apply order is fixed (plugin-first, as the binary does it, or pi-ai-first), because the loader starts rows in parallel. It also rebuilds hasProviderApiKey as providerWithApiKey.
Contract tests	test/host-waterfall.test.ts, test/host-shapes.test.ts, test/host-credentials.test.ts, test/host-editor-contracts.test.ts	Waterfall: the listener fires for another plugin's fiber, prepend puts it outermost, raw === _config holds for _reload/update/_commitVolatile but not for the editor candidate (F14), and a deep-frozen input is never mutated while the fiber keeps the return value (F12). Shapes: the profile shape, the Config defaults snapshot, recordKeyFor, no secret-role nodes, the loader's interpolation and pi's public exports. Credentials. Editor: configEditor.edit writes raw beside the YAML, _commitVolatile re-resolves through a prepended listener, and settings.describe and hasProviderApiKey get baselines.
Tier A smoke	test/host-harness.test.ts	listProviders() equals pi-ai's keys (F11), and each builder option is exercised once.
Characterization	test/host-characterization.test.ts	Today's behaviour on pi 1.1.0, with each row tagged KNOWN_DEFECT or INTENDED_CHANGE where P-R1 is expected to flip it. S0_TODAY is shared with the binary e2e.
Keyless matrix	test/support/keyless-matrix.ts, test/keyless-matrix.test.ts, test/e2e/keyless-matrix.e2e.ts	The 401-vs-404 cell table and a pure classifier, its unit test, and a gated live run.
Binary e2e	test/e2e/host-binary.e2e.ts, test/e2e/host/	Runs the probe bundle in the installed host, gated on DSH_HOST_E2E=1 and reading DSH_HOST_PREFIX.
CI	.github/workflows/ci.yml, package.json	The e2e-host job. Cell a: pi 1.1.0, pinned and patched, on PRs that touch the host seams, cordis.patch.yml or vite.config.ts. Cell b: whatever npm installs, nightly and on dispatch. Adds the test:e2e:host script.
Docs	AGENTS.md, CONTRIBUTING.md, docs/improvement-plan.md, test/support/src.ts, vite.config.ts	Repo map, e2e section and commands, the plan's P-T1b entry and status (in review), the test door, and the e2e config base.

Behaviour changes

• Plugin: none. This is a pinning phase, and no file under src/ changes.
• Test and CI only:
  • The e2e-host job also runs on pull requests that touch vite.config.ts. That file holds the pack config for lib/index.mjs and the test settings that the e2e config inherits.
  • When the binary e2e fails, its message now gives the real cause. It says "timed out" only when the test's own deadline killed the host, "killed by <signal>" for a crash, and gives the probe's fatal message whenever there is one. The dsh install helper reports spawn errors and signals instead of "exited null".

Review

Three lenses (correctness, tests, repo rules), three rounds. No reviewer was missing in any round.

Round	Found	Upheld	Fixed
1	25	25	25
2	6	6	6
3	4	4	4

Each round's upheld findings were fixed before the next round ran. Round 3's four findings are fixed in this commit:

• The endpoint: legacy wording is narrowed. Go's Google traffic stays on the modern cell under every family.
• whyRunFailed separates timeouts, signal deaths and fatal probe results.
• vite.config.ts is added to the e2e-host scope.
• The plan now says the harness itself rebuilds hasProviderApiKey.

Verification

Node	Step	Result
26.12.1	pnpm run check	0 errors, 21 warnings (limit 21)
26.12.1	vp test run	87 files, 1360 tests passed
26.12.1	vp test run --config vitest.mock.config.ts	3 files, 51 tests passed
26.12.1	pnpm run build	exit 0, ESM 2 files, 340.57 kB
26.12.1	scripts/check.ts	check passed (no ETARGET)
26.12.1	shuffle, seeds 1 / 42 / 1234	87 files, 1360 tests passed each
26.12.1	vp test run --coverage	96.47 / 92.55 / 96.52 / 96.47 against floors of 95.9 / 91.3 / 95.9 / 95.9
24.22.1	shuffle seed 7, mock suite	1360 tests and 51 tests passed
—	local-path and credential scan of the diff and new files	No local paths found. The only sk- hit is the fixture sk-ambient-go-not-a-key. A canary file gave the expected hits, so the scan did read its input.

The first five rows were run again right before the commit. The rest come from the implementation run on the same tree.

Note: the catalog freshness check fails on every branch until the vendor-catalog refresh lands on main. That failure is unrelated to this PR.

Restacked onto main 1.8.0

The branch now carries main 1.8.0 through its parent, P-T1a (#109), merged in at fb6a686. Head: ec38185.

New scope

A harness that is the real host, on both harness channels.

• Tiers A and B (test/support/host.ts), the contract tests and the tagged characterization run on whichever channel install is selected. On every PR they run on alpha and rc newest (pi 1.5.0), through P-T1a's CI matrix. Each channel's floor (pi 1.3.0 on alpha, 1.1.0 on rc, unpatched) runs nightly.
• Where hosts differ, a row carries one expectation per host cell (S0_TODAY_BY_CELL, forHost, forChannel). The rows that differ: pi's catalog bases, the ids pi can place, F10 (pi wires Go's Google protocol natively from 1.3), and pi-ai's default window and max tokens (these follow the bridge, so they are keyed by channel).
• The keyless matrix splits its dispatch sets. TODAY_DISPATCH is the rc floor's: legacy /zen(/go)/v1 completions plus the modern Responses, Messages and Google routes. NEXT_DISPATCH is what npm installs already reach: modern /inference(/go)/openai/v1 completions.
• The e2e-host job boots each channel's published binary the way npm installs it. The npm cell runs on PRs that touch the host seam. The floor cell runs nightly and on dispatch, pinned to the recorded cordis family. No cell applies a pi patch.
• The cordis family (cordis, loader, schemastery, include, group, cosmokit) is pinned exactly in package.json, and the channel switch moves the pins. A relock therefore keeps each lockfile at the record's floors. A new harness-channel case requires every family member the lockfile resolves to be a direct pin.
• A host defect the plugin cannot fix is recorded as a [HOST_LIMITATION] row. The row is detected from the host's answer, never from a version. Today there is one: on alpha 0.2.2-alpha.2, npm resolves cordis 4.0.6-alpha.2, and under it no config-editor save succeeds. The two save rows skip on both alpha cells.

Dropped because main or the parent now covers it

• The pinned e2e-host cell (pi forced to 1.1.0, harness patch applied with patch -p1, cordis and loader overrides, cache key on patches/*.patch) and the floating cell. Under D14'' they are replaced by the per-channel npm and floor cells, both with unpatched pi.
• The patches/ line in the AGENTS.md repo map and the patch -p1 step in the CONTRIBUTING local-run snippet. There is no pi patch (D14'').
• The alpha 0.2.2-alpha.3 bump and the cordis waterfall-shape rewrite of the tier listeners. They came from an earlier, unpushed attempt. The records stay at alpha.2, as P-T1a has them, and the bump is a follow-up (see below).

Decisions applied

• D14'': both channels, as each one ships, and no pi patch. This is why the per-channel cells, the floor/newest split and the dropped patches/ line exist.
• D22'': two channel records, named once in test/support/host-versions.ts. The rows read their cell from the record, and the plan text was returned to P-T1a's version wherever the earlier attempt had moved it to alpha.3.
• D26: host gaps are the host's job. That is why the alpha save failure is a HOST_LIMITATION row, and why the row is detected from the host's answer rather than from a version.
• D24 (debug gate) and D25 (tool-fallback plane) concern src/, which this phase does not touch, so neither applies here.

Live re-measures CI must confirm

• e2e job (keyless matrix, every PR): no path-gone verdict on TODAY_DISPATCH or on NEXT_DISPATCH.
• e2e-host nightly or dispatch: both floor cells (rc pi 1.1.0, alpha pi 1.3.0) and both npm cells on the CI runner. The alpha cells must still record the HOST_LIMITATION, or stop recording it once the host is fixed. npm must still resolve cordis 4.0.6-alpha.2 for dsh 0.2.2-alpha.2.
• Nightly test matrix: unit and mock (all tier A/B and contract files) on the alpha and rc floor installs. Measured green locally on 2026-11-03.
• host-drift job: it should now report dsh alpha 0.2.2-alpha.3 (and cordis, loader and schemastery alpha.2) against the alpha record.

---

Generated by Claude Code

[viztor]

catalog freshness is red because src/catalog-data.ts is stale against the live vendor catalog: the vendor added a Go model (kimi-k3.1-pro) after this stack was branched. The failure doesn't come from this PR, which doesn't touch the catalog or its generator. The same check fails on every branch of the stack (#108, #109). No fix is ported here: the shim is generated, never edited by hand, and regenerating it needs models.opencode.ai.

The fix is the nightly scheduled run on main (it ran at about 09:30 UTC the last few days). It regenerates the shim and opens a chore/generated-refresh pull request. Once that is merged into main, I'll merge main up the stack, which turns this check green. A re-run before then would fail the same way, so I haven't spent one.

---

Generated by Claude Code

[viztor]

This phase's first reviews ran on the general reviewer because the dedicated reviewer was unavailable. It has now had the dedicated review.

Rounds (by lens: correctness, rules, matrix)

round	found	upheld	fixed
1	15	11 (correctness 4, rules 3, matrix 4)	11 (two pairs were the same issue from two lenses)
2	5	4 (correctness 2, rules 1, matrix 1)	4 (one pair was the same issue)
3	3	3 (correctness 1, matrix 2)	3

All upheld findings were low severity.

Fixed

• test/e2e/host-binary.e2e.ts: the hook's budget now comes from its own deadlines (two installs plus the boot), each install has its own deadline, and afterAll stops a host that a failed hook left running.
• test/support/host.ts: providerWithApiKey now runs upstream's credentialRef grammar check and throws the same TypeError, and its comment lists the deliberate differences. The pi-ai-first table now carries its own tags.
• .github/workflows/ci.yml: the pinned cell now forces cordis and the loader along with pi, uses both in its cache key and asserts both against HOST_VERSIONS.
• test/host-characterization.test.ts: there is now one test per row and facet in each apply order, titled with that order's tags. The fixture check that the two orders differ is now structural. The single facet that depends on the apply order now has its own [KNOWN_DEFECT] case, which boots no host.
• CONTRIBUTING.md: it now gives the same F-fact accounting as the plan. It also gives the right place for the dummy keys (the temporary home's credentials document) and says what P-R1 must do to the apply-order case in the same diff.
• docs/improvement-plan.md: it has the same F-fact accounting. It now gives the correct reason hasProviderApiKey is restated, its credential-mapping row names all three toPiCredential branches, and its Go Gemini bullet carries the P-R1 note.
• test/host-shapes.test.ts: new F5 pin (a route-level api and baseURL collapse pi's protocols onto one). New plugin-less F4 pin: an id pi cannot place is not listed, and a turn on it returns INVALID_CONFIG without sending a request.
• test/host-credentials.test.ts: covers toPiCredential's env and non-api-key branches. The env branch is checked through pi's Models.getAuth (when that branch was removed, the case failed). The citation is corrected to auth.ts:74-84.
• test/host-editor-contracts.test.ts: there is a case for the credentialRef grammar, and the F4 save case is now tagged with its fact number.
• test/host-waterfall.test.ts: the pi-ai save-check case is now tagged F8/F4.

Declined

No upheld finding was declined. The other findings (4 in round 1, 1 in round 2) did not survive verification, so they were left alone.

Nothing under src/ changed. All gate steps passed: check, unit, mock, build and the bundle gate.

Commit: 409b5e1

---

Generated by Claude Code

[viztor]

Restacked onto main 1.8.0. This branch now carries main 1.8.0 through its parent, P-T1a (#109). Pushed head: ec38185d750412b6e520f94b176be8b3e076f1d2. The PR body has a new section, "Restacked onto main 1.8.0", with the new scope.

Conflicts and how they were resolved

Docs

• AGENTS.md: kept P-T1a's repo-map lines (host-versions with two channel records, report-host-drift, use-channel, and the config line with opencode-store-contract.ts) and added P-T1b's host.ts, keyless-matrix.ts and test/e2e/host/ lines. P-T1b's patches/ line was dropped, because under D14'' this repo carries no pi patch. The Commands block is the union of both sides.
• CONTRIBUTING.md: kept P-T1a's per-job e2e list with main's newer bullets and added P-T1b's keyless-matrix and host-binary bullets. The real-host harness and e2e-host sections were rewritten for both channels: newest and floor pi, unpatched, npm and floor cells, and per-cell tables. Release step 3 is P-T1a's text.
• docs/improvement-plan.md: the status table and step 4 are P-T1a's. Step 5 is P-T1b's, rewritten for the per-cell tables. F14, D22'', the waterfall-shape bullet and the P-R1 row went back to the parent's text, because their alpha.3 claims were only true in an unpushed earlier attempt.

Code (the merge had no textual conflict but was wrong)

• Tier files: on alpha's pi 1.5.0, 26 rows failed. pi's catalog bases had moved, the ids pi can place had changed, F10 is native from 1.3, and pi-ai's defaults follow the bridge. These were re-measured into one expectation per host cell (rc floor 1.1.0, alpha floor 1.3.0, newest 1.5.0), plus forChannel for the bridge's defaults.
• e2e-host job: rebuilt from pinned+patched/floating into per-channel npm and floor cells with unpatched pi. The binary e2e now reads the table for the cell it installed.

Dropped

• The pinned cell (pi forced to 1.1.0, the harness patch, cordis and loader overrides, a cache key on patches/*.patch) and the floating cell.
• The patches/ repo-map line and the patch -p1 step in the local-run snippet.
• The alpha 0.2.2-alpha.3 bump and the cordis waterfall-shape rewrite from the earlier unpushed attempt. Both are out of scope here and listed below as a follow-up.

Review rounds

Round	Found	Upheld	Fixed
1	15	15	15
2	9	9	9
3	11	11	11

Round 3's main fixes:

• package.json now pins include, group and cosmokit exactly, alongside cordis, the loader and schemastery, so a fresh relock keeps the whole family at the record's floors.
• A new harness-channel case requires every family member the lockfile resolves to be a direct pin.
• scripts/host-drift.ts is added to the e2e-host PR scope.
• The report-host-drift row in docs/testing.md is rewritten.
• The cosmokit-check wording was corrected wherever it appeared.

Live re-measures still owed

• e2e keyless matrix (every PR): no path-gone verdict on TODAY_DISPATCH or on NEXT_DISPATCH.
• e2e-host nightly or dispatch: both floor cells and both npm cells on the CI runner. The alpha cells must still record the HOST_LIMITATION, and npm must still resolve cordis 4.0.6-alpha.2 for dsh 0.2.2-alpha.2.
• Nightly test matrix: unit and mock on the alpha and rc floor installs. Green locally on 2026-11-03, not yet on CI.
• host-drift: it should report dsh alpha 0.2.2-alpha.3 (cordis, loader and schemastery alpha.2) against the alpha record.

Follow-ups

• Channel-bump PR: alpha moved to 0.2.2-alpha.3. Its cordis changes the internal/config waterfall shape, so the bump has to rewrite the tier listeners. It should land as its own PR, not inside this one.
• Upstream report: an npm install of dsh 0.2.2-alpha.2 resolves cordis 4.0.6-alpha.2, which breaks dsh-app-boot's own internal/update listener. Every config-editor save fails with "next is not a function". This should be reported to the harness.
• P-R1: its route claim must accept both waterfall shapes by feature detection.
• Retargeting: origin/main has moved again (fix: harden the test suite, fix plane/mount/credential defects, and add the improvement plan #105), so the bottom of the stack needs a retarget or a main merge.

The dedicated reviewer was unavailable, so all twelve review and verify passes ran on the general reviewer: review:P-T1b:both-kept#1, review:P-T1b:resolutions#1, review:P-T1b:rules-docs#1, verify:P-T1b#1.1, review:P-T1b:both-kept#2, review:P-T1b:resolutions#2, review:P-T1b:rules-docs#2, verify:P-T1b#2.1, review:P-T1b:resolutions#3, review:P-T1b:both-kept#3, review:P-T1b:rules-docs#3, verify:P-T1b#3.1.

---

Generated by Claude Code