# DSH Harness on your project host

Tvijo's ordinary engine remains the default. This release requires a **Linux local or Remote SSH extension host**. Its quality
supervisor uses Linux process-tree controls; macOS/Windows hosts should use a
Linux Remote SSH host or the ordinary engine. After host setup, enable **Tvijo ›
Orchestration: Enabled** in Settings and select a worker policy. No private path
entry is needed: the extension discovers the owner's private
`~/.config/tvijo/orchestrator.json`. Advanced path overrides are available.
Enabling the setting never installs packages.

Execution happens on the local or Remote SSH extension host containing the
selected directory. New non-Git folders and monorepo subfolders are supported;
the sandbox and working directory remain that exact selected folder. Git-specific
commit checks can remain pending when the selected scope has no usable repository.
A browser account cannot execute the operator's shell or use their subscription.

The fixed coordinator is **ds41f**, through the existing managed AIOS route and
its daily caps. The default subscription worker is **GPT-6.1 Sol**. Additional
policies permit **GPT-6 Astra/high** advice and **Claude Opus 5.5** read-only advice.
No paid API fallback exists for subscription quota or login failures. Chat model
choices do not override this engine.

## Explicit host setup

Prerequisites: Linux with `/proc` and subreaper support, Python with the AIOS runtime dependencies, Node, tmux, the existing
managed AIOS transport, and Codex signed in with ChatGPT on this host. Optional
Claude must be signed in with Claude.ai. API-key authentication is refused.
Keep state, dependency installs, caches, logs and temporary files on the data
volume. The state directory must be private (0700) and outside every selected project.
The owner manifest also anchors one host-wide project registry in that directory
(`host-project-locks.sqlite`). Advanced state overrides share this registry;
without the trusted manifest execution fails closed. During an upgrade, stop or
reconcile older writers before activating this runtime.

The observed Linux host verified Harness `0.1.7-rc.2` with the official native
providers `@deepseek-ai/dsh-subagent-codex@0.0.1-rc.1` and
`@deepseek-ai/dsh-subagent-claude-code@0.0.1-rc.1`. The Claude provider required
`@anthropic-ai/claude-agent-sdk@0.3.220` and `@anthropic-ai/sdk@0.93.0` in an isolated
dependency tree. An administrator installs compatible pinned dependencies after
an explicit setup action. This is not a global DSH profile change or upstream
plugin fork. Native registration and lifecycle use those published packages;
task-specific launcher adapters bind the exact model, project and subscription
login and save model receipts.

Run the installed controller locally, with actual installed paths supplied by
the host administrator. This setup action writes the private host profile and
discovery manifest; it does not install dependencies or rewrite editor settings:

```sh
python3 /installed/ai-os/scripts/tvijo_orchestrator.py --state /private/volume/tvijo setup <<'JSON'
{"nativeCodex":"/isolated/node_modules/@deepseek-ai/dsh-subagent-codex","codex":"/absolute/path/to/codex","transportDb":"/private/volume/transport.db","home":"/home/project-owner","write_manifest":true}
JSON
```

Add `nativeClaude` and `claude` absolute paths only for a configured Claude
provider. Existing profiles/manifests are never overwritten by setup. The
managed transport belongs to the authenticated host owner; setup does not
provision transport, buy credits, change services or authorize other projects.
Run **Tvijo: Orchestration doctor**. It distinguishes installed prerequisites
from models with actual successful runtime receipts. Claude selection requires
such a receipt on this host; a configured package alone is not a verified run.

## Durable task controls

**Orchestration status**, **Resume**, **Stop**, **Open tmux** and **Repair queue**
are available from Settings or the command palette. Tasks run in owned tmux
sessions. Editor disconnection or a lost status response preserves the original
job, authority and budget. Resume reads that job and never reruns a completed
provider call. Explicit cancellation, account/root changes and trust revocation
stop attached delegated work. Lost/stale provider calls remain blocked for
reconciliation rather than being replayed. Repair requires the original scoped
authority and remaining lifetime USD/turn/child limits; it never refills them.

Codex runs with the native workspace-write sandbox and network disabled, or
read-only for Plan/Astra. Claude advice exposes only Read/Glob/Grep and a bounded
turn count. These native CLI boundaries differ from Tvijo's ordinary direct-tool
command classifier. Project-rule changes are quarantined by the extension host.
Auto-commit uses only observed matching file-write receipts and preserves user
staging; unobserved command side effects are excluded. It never pushes.

## Completion and quality

Actual Tvijo finish creates a durable completion signal. A private `quality`
object in the host setup profile can specify bounded `checks` (argv arrays),
`source_commit`, `artifacts` (path/sha256/version/article_date) and `publication`
(name/HTTPS URL/sha256/optional JSON version_field and version). Completion and
opt-in external hooks automatically run deterministic reconciliation using this
private profile, never commands supplied in browser events. The controller
fetches publication bytes itself. The project writer lease stays held through quality subprocess termination.
Cancellation stops and reaps the check process tree, including detached child
sessions, before releasing that lease. Duplicate quality runs are serialized.
Missing tests, commit, version, checksum,
GitHub or Marketplace receipts stay pending. An explicitly operator-deferred
publication uses private profile fields `status: deferred_by_operator` and
`operator_ref`; it is shown as deferred, never as published, and is not an
acceptance blocker. The 2026-10-24 operator release decision defers Marketplace
and requires direct VSIX and GitHub instead. Model completion alone is never
quality or publication completion. The default empty profile deliberately
leaves those obligations pending; configure actual acceptance criteria.

`deploy/dshrem/orchestrator-hooks.json` provides opt-in Codex Stop, Claude Stop
and Copilot CLI agentStop templates. Use a task-specific private
`hook-binding.json` with `orchestrator-signal.py`. These external hook formats
have fixture coverage; they are not claims of a live Copilot run. VS Code
Copilot preview schemas may differ. Git/CI adapters are also supported.
SessionEnd is not treated as task completion. Hooks return an empty object and
never request model continuation. No global configuration is rewritten and no
private conversation is inspected. There is no scheduled model loop.

Public capabilities and the dated acceptance receipt are available at
`/api/dshrem/v1/public/orchestration-capabilities` and
`/api/dshrem/v1/public/orchestration-verification`. A tested host does not imply
that every client host is configured. Browser endpoints accept only bounded,
authenticated tenant metadata tied to an administratively assigned host; they
do not launch server-side project commands.


## Team size and report appearance (runtime 0.10.11)

`agent_count` selects 3–6 participants **including ds41f**. The host executes
ordered slots, not simultaneous writers. The first Sol slot implements the task;
remaining Sol slots review it read-only. The Sol + Astra policy ends with Astra;
Sol + Astra + Claude ends with those two reviewers and requires at least four
participants. Repeating Sol creates separate calls, not different models or a
proof of independent judgement. The ledger refuses skipped/repeated slots and
stops after a failed or uncertain call. Missing slots keep acceptance pending.
Custom OpenRouter workers are not supported by this host controller; the managed
service catalog independently advertises available paid workflows. There is no
silent subscription-to-API fallback.

`report_format` accepts `light`, `dark`, `rainbow`, or `both` (light and dark).
Private HTML reports live under the selected host's state directory in
`reports/<job-id>/`. They show actual slot receipts, root costs and quality
findings. A score is left unassigned without a calibrated rubric and evidence.
The root API limit is a ceiling, not an invoice. The managed customer service
quote applies its 8% tariff once and clamps its ceiling to prepaid credit, daily
allowance and key limits. Native subscription calls do not debit that API ledger.

Setup can discover installed executables, provider packages and the transport
location. Run the existing controller's `setup` action with `{}` when the
prerequisites are installed; an existing profile is preserved. `doctor` reports
which fields it found, actual policy prerequisites, prior verified models and
`quota_checked: false`. An installed binary or login file does not prove a live
subscription quota. Setup does not purchase credits, install packages, or claim
that a missing prerequisite is ready. Directory permission 0700 means only the
host's OS account can read/list/write that directory; ordinary users need not
change it. Python/controller paths come from the installed host manifest.