feat(dsh): add shared Harness analysis (#110)

* feat(dsh): add shared harness analysis

Implements #104 using docs/specs/2026-08-24-104-deepseek-harness-shared-analysis-evidence-bundle.md. Qualify DSH for shared Asset Practices, Harness evidence, and Evidence Bundle collection with one frozen canonical cwd while keeping rendering and Checkup out of scope.

Validate the change with Node 22.20.0 and Node 24.15.0 focused suites, native DSH smokes, and a clean npm run check. Existing DSH Session and configured-assets semantics remain unchanged.

Co-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

* fix(harness): canonicalize Windows workspace identity

Keeps #104 configured and practice analysis on one filesystem identity using docs/specs/2026-08-24-104-deepseek-harness-shared-analysis-evidence-bundle.md. Qoder Memory lookup, workspace-relative locators, topology, Git-root resolution, and Baseline compaction now share the same canonical path owner; the Windows-safe privacy assertion no longer constructs a RegExp from a raw path.

Validated with Node 22.20.0 and Node 24.18.0 focused suites, DSH 0.1.1-rc.2 native smokes, and a clean Node 22.20.0 npm run check.

Co-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

* fix(harness): sanitize nested baseline errors

Fixes #104 using docs/specs/2026-08-24-104-deepseek-harness-shared-analysis-evidence-bundle.md AC-11 and AC-12. Serialized Bundle regressions and focused Node 22/24 suites validate nested Baseline stage-error path redaction.

Co-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

---------

Co-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

Author: Cobb04

docs/adapters/README.md

@@ -3,7 +3,8 @@
 This is the single entry point for Claude Code, Codex, Qoder, Cursor, Qwen,
 GitHub Copilot, Pi, Kimi Code, WorkBuddy, and Grok host boundaries, plus the
 DeepSeek Harness (DSH) verified install/discovery, developer-preview
-configured-assets, and developer-preview session slices. Do not
+configured-assets, session, Asset Practices, neutral Harness analysis, and
+Evidence Bundle slices. Do not
 create `docs/adapters/claude-code.md`, `docs/adapters/codex.md`,
 `docs/adapters/qoder.md`, `docs/adapters/cursor.md`, `docs/adapters/qwen.md`,
 `docs/adapters/copilot.md`, `docs/adapters/pi.md`,
@@ -45,7 +46,7 @@ project `.kimi-code/skills/`), then runs `/skill:better-harness`.
 | Kimi Code | Analysis-capable source-local host | `.kimi-plugin/plugin.json` | `scripts/agent-customize/providers/kimi.mjs` | `scripts/session-analysis/platforms/kimi.mjs` | self-contained HTML + Markdown | `AGENTS.md` + `~/.kimi-code/skills` + project `.kimi-code/skills`/`.kimi/skills` + `~/.kimi-code/mcp.json` | `harness evidence-bundle --platform kimi` -> validated `html` render |
 | WorkBuddy | Analysis-capable source-local host | none (skills install into `~/.workbuddy/skills`) | `scripts/agent-customize/providers/workbuddy.mjs` | `scripts/session-analysis/platforms/workbuddy.mjs` | self-contained HTML + Markdown | `~/.workbuddy` `AGENTS.md` + identity files + `.agents` + `AGENTS.md` | `session-analysis --platform workbuddy sources` -> validated `html` render |
 | Grok | Analysis-capable source-local host | none (skills install into `~/.grok/skills`) | `scripts/agent-customize/providers/grok.mjs` | `scripts/session-analysis/platforms/grok.mjs` | self-contained HTML + Markdown | `~/.grok` + `.grok` + `.agents` + `AGENTS.md` | `session-analysis --platform grok sources` -> skill symlink -> validated `html` render |
-| DeepSeek Harness (DSH) | Verified install/discovery for headless/base and Web `standard`/`code`/`cordis`; partial configured assets and session evidence (developer preview) | local DSH Cordis policy at `scripts/dsh-skill-discovery/index.mjs`; no lifecycle shell | `scripts/agent-customize/providers/dsh.mjs`; filesystem Skills and cwd-sensitive Instructions, configured-not-observed | `scripts/session-analysis/platforms/dsh.mjs`; `dsh-v1` for the audited format-0 session-evidence slice from DSH `dsh-v0.1.0-rc.7` and `dsh-v0.1.0-rc.8`, raw `.jsonl` and feature-detected `.jsonl.zstd` | unavailable; no report route | canonical Skill from the complete root; model Skill calls rejected | `npm run test:dsh-native`; `npm run test:dsh-configured-assets-native`; read-only session `sources`/`facts` commands remain separate |
+| DeepSeek Harness (DSH) | Verified install/discovery for headless/base and Web `standard`/`code`/`cordis`; shared read-only analysis over developer-preview configured and Session evidence | local DSH Cordis policy at `scripts/dsh-skill-discovery/index.mjs`; no lifecycle shell | `scripts/agent-customize/providers/dsh.mjs`; filesystem Skills and cwd-sensitive Instructions, configured-not-observed | `scripts/session-analysis/platforms/dsh.mjs`; `dsh-v1` for the audited format-0 session-evidence slice from DSH `dsh-v0.1.0-rc.7` and `dsh-v0.1.0-rc.8`, raw `.jsonl` and feature-detected `.jsonl.zstd` | unavailable; neutral `harness analyze` and Evidence Bundle only | canonical Skill from the complete root; model Skill calls rejected | `npm run test:dsh-native`; `npm run test:dsh-configured-assets-native`; shared analysis remains inline/no-files |
 
 ## Read-only Plugin Lifecycle
 
@@ -220,8 +221,9 @@ edit host settings, or register an `apply` path.
   `--include-user-home` is supplied. The evidence is
   `configured-not-observed`: runtime/in-process Skills and active Cordis,
   Profile, and Preset composition remain unresolved. DSH advertises exactly
-  `sessionAnalysis` and `agentCustomize`; it does not gain asset-practices,
-  checkup, evidence-bundle, report, rendering, or output support. See
+  `sessionAnalysis`, `agentCustomize`, `assetPractices`, `harnessReport`, and
+  `evidenceBundle`. Shared analysis accepts a canonical contained `--cwd` and
+  remains inline/no-files because checkup, rendering, and output are unsupported. See
   [DeepSeek Harness Configured Assets](../../references/agent-customize/platforms/dsh.md)
   and run the credential-free owner smoke with
   `npm run test:dsh-configured-assets-native`.
@@ -250,7 +252,7 @@ edit host settings, or register an `apply` path.
   remains readable. There is no fallback dependency or shell.
   The combined DSH boundary does not provide live PTY or process state,
   complete runtime configured-asset resolution, plugin lifecycle, a managed
-  shell, manifest or package integration, report/output routing, README
+  shell, manifest or package integration, rendered report/output routing, README
   Quickstart, SQLite or custom
   persistence, automatic optimization, plugin fault or causality attribution,
   or artifact repair or writes. See
@@ -269,9 +271,9 @@ Canonical templates live under `templates/reporting/`.
   `findings.json`, `report.md`, and `report.html`.
 - Markdown-only output has no visual companion.
 
-DSH is intentionally absent from these output-mode host lists. Its
-`sessionAnalysis` capability does not grant report routing, HTML, Canvas, or
-Markdown output support.
+DSH is intentionally absent from these output-mode host lists. Its neutral
+`harnessReport` capability does not grant rendering, HTML, Canvas, or Markdown
+output support.
 
 ## Split Triggers
 

docs/docs/hosts/adapter-matrix.md

@@ -20,7 +20,8 @@ Quickstart paths. Pi, Kimi Code, WorkBuddy, and Grok are visible as adapter
 support because their installation and end-to-end evidence boundaries differ
 from that six-host set. DSH has Verified install/discovery for a qualified
 runtime/preset boundary plus developer-preview configured-assets and
-session-evidence contracts; it is not a runnable report adapter. The
+session-evidence contracts. It supports shared read-only Asset Practices,
+neutral Harness analysis, and Evidence Bundles, but is not an output adapter. The
 [canonical adapter matrix](https://github.com/QoderAI/better-harness/blob/main/docs/adapters/README.md)
 remains the complete capability-level source of truth.
 
@@ -38,7 +39,7 @@ remains the complete capability-level source of truth.
 | Kimi Code | Adapter support | Analysis-capable source-local host | `.kimi-plugin/plugin.json` | Workspace-matching Kimi wire transcripts | Self-contained HTML + Markdown |
 | WorkBuddy | Adapter support | Analysis-capable source-local host | None; skills use WorkBuddy-owned paths | Workspace-matching WorkBuddy JSONL transcripts | Self-contained HTML + Markdown |
 | Grok | Adapter support | Analysis-capable source-local host | None; skills use Grok-owned paths | Workspace-matching Grok session dirs (`updates.jsonl`) | Self-contained HTML + Markdown |
-| DeepSeek Harness (DSH) | Verified install/discovery | Qualified headless/base and Web `standard`/`code`/`cordis`; partial configured-assets and session evidence | Local DSH Cordis policy; no lifecycle shell | DSH JSONL backend session format `0`: raw `.jsonl` and feature-detected `.jsonl.zstd` | Unavailable |
+| DeepSeek Harness (DSH) | Verified install/discovery | Qualified headless/base and Web `standard`/`code`/`cordis`; shared read-only analysis over partial configured-assets and session evidence | Local DSH Cordis policy; no lifecycle shell | DSH JSONL backend session format `0`: raw `.jsonl` and feature-detected `.jsonl.zstd` | Unavailable; inline/no-files analysis only |
 
 The `@qoder-ai/better-harness` npm package includes all seven plugin metadata
 roots. Pi reuses install metadata in the existing `package.json`, so it does
@@ -82,8 +83,8 @@ lifecycle target.
   (see the [sample report](pathname:///demo/better-harness-report/)).
 - **Markdown-only** — no visual companion.
 
-DSH is not an output-mode host. Session-analysis evidence does not grant HTML,
-Canvas, Markdown, or any report route.
+DSH is not an output-mode host. Neutral Harness analysis and Evidence Bundle
+support do not grant HTML, Canvas, Markdown, or durable report routing.
 
 ## Adapter support boundaries
 
@@ -157,8 +158,11 @@ better-harness agent-customize inventory --provider dsh --workspace <path> [--cw
 
 User-home Skills and Instructions are not read by default. Runtime/in-process
 Skills and active Cordis, Profile, and Preset composition remain unresolved.
-The host advertises exactly `sessionAnalysis` and `agentCustomize`; this does
-not add asset-practices, evidence-bundle, report, rendering, or output support.
+The host advertises exactly `sessionAnalysis`, `agentCustomize`,
+`assetPractices`, `harnessReport`, and `evidenceBundle`. Shared analysis freezes
+canonical `--cwd` for current configured practice while leaving historical
+Session scope unchanged. Rendering, output routing, Checkup, and Quickstart
+remain unsupported.
 Repository contributors can run the pinned credential-free comparison with
 `npm run test:dsh-configured-assets-native`. See
 [DeepSeek Harness Configured Assets](https://github.com/QoderAI/better-harness/blob/main/references/agent-customize/platforms/dsh.md).
@@ -192,9 +196,9 @@ The implemented source-checkout smoke boundary is read-only:
 node scripts/session-analysis.mjs sources --platform dsh --workspace <path> [--dsh-home <dir>]
 ```
 
-Verified discovery does not imply a complete report loop. DSH has no live
+Shared analysis does not imply a complete report loop. DSH has no live
 PTY/process integration, complete runtime configured-asset resolution, plugin
-lifecycle, managed shell, manifest, package integration, report/output route,
+lifecycle, managed shell, manifest, package integration, rendered report/output route,
 public Quickstart, SQLite or custom persistence support, automatic
 optimization, plugin-fault attribution, or artifact mutation/recovery. See the
 [canonical source matrix](https://github.com/QoderAI/better-harness/blob/main/docs/adapters/README.md)

docs/docs/installation.mdx

@@ -153,10 +153,12 @@ comparison with `npm run test:dsh-configured-assets-native`. The complete
 configured-assets boundary is documented in the
 [adapter matrix](./hosts/adapter-matrix#deepseek-harness-dsh).
 
-This maturity level does not provide complete runtime configured-asset
-resolution, evidence-bundle or report registration, output routing, rendering,
-lifecycle management, MCP/profile product support, Web `minimal`, or a full
-report workflow. The
+Shared read-only analysis is available through `harness evidence-bundle` and
+`harness analyze`; pass `--workspace <path> --cwd <effective-cwd> --platform dsh`.
+The configured cwd must resolve inside the workspace. DSH still does not provide
+complete runtime configured-asset resolution, output routing, rendering,
+Checkup, lifecycle management, MCP/profile product support, Web `minimal`, a
+public Quickstart, or a full durable report workflow. The
 [adapter matrix](./hosts/adapter-matrix#deepseek-harness-dsh) tracks the exact
 boundary.