docs(operations): clarify DSH transport and live continuation acceptance

docs/architecture/rfcs/human-confirmed-domain-operations-v0.md

@@ -542,18 +542,22 @@ required acceptance condition using the existing scheduling/session owner.
 The backend slice's focused native/normalization tests do not certify that the
 companion UI ships in its commit or that source delivery is connected.
 
-### Automatic continuation and original-audience return: remaining work
+### Automatic continuation and original-audience return: qualification frontier
 
-An authenticated confirmation callback currently records the claim and projects
-the managed handoff; it does not launch the original host. Native `report`
+The default-off callback continuation described above can request the original
+managed Codex host through an operator-granted delegation. Its synthetic
+File/SQLite qualification does not establish a genuine confirmation, installed
+host acceptance or financial execution. Without that grant, confirmation only
+records the claim and projects the managed handoff. Native `report`
 commits an outcome and returns on the tool connection, while delivery recovery
 updates the original Lark card. Neither is delivery to a selected source
 conversation. An `outcome_observed` operation is absent from the pending-work
 Inbox, so exhausting that Inbox cannot certify original-audience return.
 
-The same implementation Todo and capability owner retain both gaps. The next
-bounded deliveries must prove the following in order; these are planned work,
-not qualified features of the preparation/readback slice:
+The existing implementation Todo and capability owner retain the live
+continuation and source-return acceptance gaps. The next bounded deliveries
+must prove the following in order; the synthetic continuation slice above
+does not satisfy these live acceptance conditions:
 
 | Delivery | Reused owner and required boundary | Exit evidence |
 | --- | --- | --- |
@@ -576,3 +580,39 @@ Any new automatic launch configuration must reuse the existing configuration
 owner and expose its effective state in the affected product entry points.
 Keep the original consumer Todo open until these receipts are observed; do not
 convert a cancelled test card or synthetic receipt into genuine approval.
+
+### DSH model availability and operation transport are separate
+
+The current [`projectManagedOperationTransport`](../../../loopx/control_plane/work_items/operation_agent_handoff.ts)
+accepts only `codex-cli`. A configured `dsh` executor can pass the existing
+runtime, credential and model-profile checks while a request for operation
+tools returns `operation_transport_host_unsupported`. The
+[`DSH Turn adapter`](../../../loopx/dsh_goal_mode/turn_host_adapter.py) runs the
+model through the SDK; it does not install the owned `loopx_operation`
+connection described above. SDK built-in tools, a successful model response,
+`unrestricted` permission mode, or a registered source thread cannot replace
+that identity producer. Enabling more shell tools does not supply it.
+
+The current binding's generic `correct_execution_profile` remediation for this
+transport refusal is insufficient: changing a supported model or configuring
+the same credential again cannot make an unsupported host transport supported.
+The shared typed transport owner must expose that distinction; the requested
+host remains selected and must not silently fall back to Codex.
+
+The DSH transport delivery must reuse the existing operation and Turn owners:
+
+1. Read back transport support independently of ordinary DSH launchability.
+   Keep operation tools opt-in and public CLI consumption fail-closed.
+2. Qualify an owned DSH connection's real session/Turn metadata and effective
+   profile, including source audience selection and revocation. A caller's
+   session string or injected actor is not native identity evidence.
+3. Carry prepare, confirmation, first consumption and outcome on that bound
+   connection, retaining the canonical action store and existing locks. Prove
+   duplicate, profile/session drift, disabled transport and lost-response cases.
+4. Qualify genuine non-financial confirmation and native consumer adoption
+   before a financial probe. Original-card recovery and source-audience return
+   need their own authenticated readbacks; a tool response proves neither.
+
+This is a required adapter frontier, not a shipped DSH execution grant. Finance
+continues to own financial preflight and venue evidence; its read-only checkers
+do not authenticate an operation actor, reserve funds or submit an order.

docs/architecture/rfcs/human-confirmed-domain-operations-v0.zh-CN.md

@@ -416,15 +416,17 @@ action list，按范围隔离查询并取消旧请求，限制
 和 session owner。
 后台切片的聚焦原生/规范化测试不证明其提交包含配套 UI，也不证明源投递已经接通。
 
-### 自动续接与原受众返回：剩余交付
+### 自动续接与原受众返回：待验收前沿
 
-当前经过认证的确认回调会登记 claim 并投影受管交接，但不会启动原宿主。
+上文默认关闭的 callback 续接已可通过 operator 授予的 delegation 请求原受管
+Codex 宿主。其合成 File/SQLite 验证不证明真实确认、本机宿主接受或金融执行。
+没有该启动 grant 时，确认只登记 claim 并投影受管交接。
 原生 `report` 将结果写回规范存储并在工具连接上返回；投递恢复更新原 Lark 卡片。
 两者都不等于已向选定的源会话投递。`outcome_observed` 操作不在待办 Inbox 中，
 因此读完 Inbox 也不能证明已返回原受众。
 
-这两个缺口继续由同一个实现 Todo 和 capability owner 负责。后续有界交付按以下
-顺序验收；这是规划，不是准备/读回切片已经具备或验证的功能：
+真实续接与源返回的验收缺口继续由既有实现 Todo 和 capability owner 负责。
+后续有界交付按以下顺序验收；上文合成续接切片不满足这些真实调用验收条件：
 
 | 交付 | 复用的权威与必需边界 | 退出证据 |
 | --- | --- | --- |
@@ -442,3 +444,33 @@ action list，按范围隔离查询并取消旧请求，限制
 已合格；无关的 BotMux 绑定或附着 Desktop 身份不能替代。新增自动启动配置必须
 复用既有配置 owner，并在受影响的产品入口展示生效状态。看到上述回执前保留原
 消费者 Todo 为开放状态，不把已取消测试卡或合成回执当成真实批准。
+
+### DSH 模型可用与操作传输分别验收
+
+当前 [`projectManagedOperationTransport`](../../../loopx/control_plane/work_items/operation_agent_handoff.ts)
+只接受 `codex-cli`。已配置的 `dsh` 执行器可以通过既有 runtime、凭据和模型
+profile 检查，同时在请求 operation tools 时返回
+`operation_transport_host_unsupported`。
+[`DSH Turn adapter`](../../../loopx/dsh_goal_mode/turn_host_adapter.py) 通过 SDK
+运行模型，没有安装上述受管 `loopx_operation` 连接。SDK 内置工具、模型回复
+成功、`unrestricted` 权限模式或已登记源线程不能代替原生身份 producer；开放
+更多 shell 工具也不会提供它。
+
+当前 binding 对这类传输拒绝给出的通用 `correct_execution_profile` 修复建议
+不足以指导恢复：更换已支持的模型或重复配置同一凭据，不能使尚未支持的宿主
+传输可用。共享 typed transport owner 须明确读回这一区别；保持用户选定的
+宿主，不静默回退到 Codex。
+
+DSH 传输交付须复用既有 operation 和 Turn owner：
+
+1. 独立于普通 DSH 可启动性，读回操作传输支持范围。保持 operation tools
+   显式启用和公共 CLI 消费入口关闭。
+2. 验证受管 DSH 连接的真实 session/Turn 元数据和生效 profile，包含源受众
+   选择与撤销。caller 提供的 session 字符串或注入 actor 不是原生身份证据。
+3. 在该绑定连接上完成准备、确认、首次消费及结果，保留规范 action store 和
+   既有锁。验证重复、profile/session 漂移、传输关闭及响应丢失。
+4. 金融探针之前先验收真实非金融确认与原生 consumer 采用。原卡恢复和源受众
+   返回各需认证读回；工具响应不能证明这两种投递。
+
+这是必需的 adapter 前沿，不是已交付的 DSH 执行 grant。金融预检和场所证据
+继续由 Finance 拥有；其只读 checker 不认证操作 actor、不预留资金或提交订单。