[Pls-1q43]

Summary

Make live Skills and Codex → DSH MCP synchronization work with the current DSH 0.2.1-rc.2 contracts, while preserving the upstream package identity, commands/UI shapes, per-item preferences and Codex skill rank 800.

Skills

• Use registration-owned control.invalidate() rather than a nonexistent shared service method, including master/per-item/default/select-all command and HTTP changes.
• Keep synchronous provider factories and own watcher teardown. Observe YAML metadata/add/delete/rename, recover late-created roots, and heal lost/startup events with a metadata-only signature fallback (including rapid add/delete returning to the prior signature).
• Parse YAML invocation policies, fail closed on invalid policies and fix flat-file resource bases; bodies remain read-on-load.

MCP

• Use complete TOML parsing and portable validated stdio/HTTP/env/header/timeout mapping; unsupported tool-access policies are not silently broadened.
• Resolve the native client through the Host Loader, with npm-peer fallback; admit the exact 0.2.1-rc.2 peer without a compatibility exemption.
• Retain actual Cordis Fibers immediately, cancel the full startup pipeline, and await same-namespace retirement before replacement. Configuration/revocation admission is independent of unrelated handshakes and teardowns.
• Keep last-good clients on read/parse failures; handle repeated atomic saves/missing parents with directory watching plus fallback checks. Preserve explicit clients' native reconnect and late dependency activation.
• Correct POSIX silent-command argument boundaries; do not assume /bin/sh on Windows. Merge HTTP headers case-insensitively and avoid reverse-bridge false positives from ordinary data paths. Report redacted config/connection diagnostics rather than source excerpts or upstream error strings.

Distribution and scope

• Add isolated current registry/native SDK contract fixtures, tarball privacy gates and CI coverage. Export English/Chinese metadata and an original MIT icon; exclude local deployment notes from distribution.
• Only generic upstream changes are included: no private adaptation directory, user paths, Codex/auth/profile configuration, service inventories, runtime status snapshots, logs, credentials or node_modules. New lockfiles use canonical public registry URLs.
• Existing import/export/reverse-install implementations are not redesigned. Version remains 1.6.2 for maintainer-controlled release; this PR does not publish npm.

Verification completed locally

• Clean npm ci --ignore-scripts and npm test: 77/77 passed, 0 skipped (including the original regression suites and actual-tarball content/privacy checks).
• npm run test:current: 5/5 passed against real SkillRegistry 0.2.1-rc.2 / Cordis 4.0.5; repeated the complete Skills suite six consecutive times after addressing a watcher/cache race.
• Native MCP suite under Node 24: 3/3 passed — discover/call/dispose/re-add a hermetic stdio server, recover from an initial explicit-client failure, and activate after tools arrive late. No real service/network endpoint is used.
• Built the actual npm tarball, installed it into an isolated temporary prefix, compared runtime source bytes, imported the packed entry, loaded its bundled skill, and checked its CLI. No personal profile was modified.
• Audited outbound staged files and packed bytes for local paths/private artifacts/credential-shaped literals; git diff --check passed. Commit attribution uses a GitHub noreply address.

Portable tests were run locally on Node 22; native SDK fixtures use Node 24 for their locked dependency engine requirements. CI adds Node 20/22 registry contracts on Linux/Windows, Node 24 native protocol contracts, and separate composition checks for DSH 0.2.0-rc.2/0.2.1-rc.2. Those remote jobs are not pre-claimed as passed. Composition dumping is explicitly not treated as host boot, full Desktop/GUI acceptance or all-platform certification.

Implementation details, intentional constraints and reproducible commands: docs/LIVE-SYNC.md.

[Pls-1q43]

Upgrade-resilience follow-up

Pushed feec228 to this same PR branch.

• Separate DSH Host admission from npm's optional SDK peer hint. engines.dsh now admits the bounded 0.2 patch/prerelease family (>=0.2.0-rc.2 <0.3.0-0) alongside the retained legacy declaration. Later compatible RCs no longer require a new exact core-version pin; 0.3 prereleases are also excluded. No version exemptions.
• Add native MCP capability/config checks before executable resolution or child/network startup. Check actual declared transport/nested fields as well as supplied-value preservation: Schemastery preserves unknown fields, so a successful validation round trip alone is insufficient. Allow added native defaults; reject dropped settings or broadened explicit env/header maps with static, credential-free diagnostics.
• Keep the existing watched Skills provider, rank 800, preferences, commands and lifecycle. Unsupported Skills registry/control contracts clean up the optional registration without disabling MCP/commands. Include rollback coverage for a failure on the second provider registration.
• Preserve pending-Fiber cancellation, explicit native reconnect/dependency waiting, independent namespace retirement and per-server failure isolation.
• Add portable, locked rc.3 fixtures and a Linux/Windows CI matrix while retaining existing verified runtime graphs.

Local verification on the final source

Check	Result
npm test	90/90 passed, zero skipped; includes actual-tarball privacy/resource gate
npm run test:current (Node 22)	10/10 across SkillRegistry 0.2.1-rc.2 and rc.3
npm run test:native (Node 24)	9/9 across native MCP 0.2.0-rc.2, 0.2.1-rc.2 and rc.3
Actual tarball installed into an isolated temporary prefix	Source bytes match; packaged entry/bundled skill/CLI help load successfully
Commit/packaging hygiene	Canonical registry locks, no private paths/credential literals/runtime inventories/private adaptation bundle; public noreply Git identity

All service fixtures are synthetic/offline. No personal profile or Codex configuration was used for these upstream tests. Linux/Windows remote CI and full Desktop GUI acceptance are not claimed by these local results; GitHub's checks/approval status remains authoritative.

GitHub CI for this commit is currently action_required and needs maintainer approval before it can run: https://github.com/Walvez/dsh-codex-sync/actions/runs/40079416399 . This is not a remote CI pass.

Package identity/version remains [email protected]; this is a PR follow-up, not an npm release. The compatibility range is candidate admission plus runtime guardrails, not certification of every future runtime's implementation semantics.