feat(dsh): integrate owned operations with managed CLI and callback recovery

docs/architecture/rfcs/human-confirmed-domain-operations-v0.md

@@ -453,6 +453,61 @@ and packaged presentation. The live context probe creates a new managed GPT
 session in its owning home; it performs no proposals, group clicks or financial
 effects. Synthetic approval fixtures are not genuine user approval.
 
+The optional [DSH native context module](../../../packages/dsh-loopx-plugin/README.md#optional-native-operation-context-sdk-prerequisite)
+adds a separately loaded, read-only SDK prerequisite. A real SDK/bundled runtime
+`0.1.5rc1` tool call returned its calling session, open native Turn and whitelisted
+agent options. This observation is neither a Core actor nor effective wire-profile
+attestation; the read-only module always reports `execution_allowed: false`.
+
+The separate optional `native-operation` module and internal
+`OwnedDshOperationHost` now connect the real SDK/bundled runtime `0.1.5rc1`
+to the existing Core handler. Two separately admitted Turns on one retained
+SDK connection qualify native session/Turn/call pairing, observed profile,
+canonical preparation, refusal before confirmation, fixture confirmation,
+one-shot consumption, rejected repetition and canonical `not_executed` outcome.
+File/SQLite Goal authority consumers retain the original action-store owner.
+Kernel peer PID and exact SDK-native tool arguments must match the private
+bounded Unix connection; there is no bearer, caller actor, second approval store
+or effect retry. Legacy Codex executor encoding and default/off behavior remain.
+
+This stage is a backend integration with a scripted loopback provider, not
+genuine user approval, original-card delivery or financial utility. SDK
+`0.1.5rc1` still refuses cross-process resume before launch; its observed
+`session already exists` failure is retained. An isolated Python SDK `0.2.1a3`
+wheel built from upstream `2fbf4359`, with explicit npm runtime
+`@deepseek-ai/dsh@0.2.1-alpha.3`, uses public `resume_session` instead of
+replacing identity. SDK files, Node/entry bytes and the entire npm closure join
+the frozen profile. File/SQLite restart cases recover the original operation;
+missing/unreadable history refuses without provider input or a reusable failed
+client. This is candidate-source qualification, not a published Python runtime
+or whole-plugin compatibility claim.
+
+The explicit `turn run-once --host dsh --dsh-operation-module /absolute/native-operation.js`
+entry now shares this owner, the existing Todo session planner and the
+operator-granted delegation callback. The module flag is default-off and
+cannot be combined with `--dsh-runner` or another host. Configuration readback
+identifies `owned_native_sdk` but retains `runtime_qualified: false`.
+File/SQLite qualification uses the actual CLI, SDK and detached callback to
+resume the original persisted session/profile, consume once, reject repetition
+and record `not_executed`; the typed wait remains a rejected delegation rather
+than validated domain completion. Provider endpoint bytes join the immutable
+profile without serializing credentials. The generic `--confirmed-operation-id`
+and `--operation-source-route-json` flags retain their Codex aliases.
+The CLI fixture does not certify original-card delivery or genuine approval.
+
+A subsequent bounded live qualification used the real model, an actual Lark
+card and authenticated human confirmation. Normal native CLI continuation
+restored the original DSH session/profile, consumed once, recorded canonical
+`not_executed` and patched the same original card; independent provider
+readback verified the result. This involved zero financial action. The
+continuation was manually invoked after the callback: unattended wakeup was
+not configured, and the approximately 246-second confirmation-to-host-start
+observation does not meet the 60-second healthy automatic-path target below.
+Other runtimes, global installation, account effects and financial utility
+remain unqualified. An older globally installed Core rejects the new DSH
+executor during inbox projection; the candidate-source entry reads it, so
+rollback must retain those pins rather than assume old-reader compatibility.
+
 Public `goal-channel inspect-operation/consume-operation/report-operation`
 remain fail-closed before private reads or writes, even with matching
 `CODEX_THREAD_ID`, route flags, self-signed proof or an older runtime's actor

docs/architecture/rfcs/human-confirmed-domain-operations-v0.zh-CN.md

@@ -354,6 +354,46 @@ context 调用，结果均由既有 typed result validator 接受）、规范
 真实 context 探针只在当前拥有的 home 创建新的受管 GPT session，不建提案、
 不造群确认、不执行金融副作用；合成批准夹具不是真实用户批准。
 
+可选的 [DSH 原生上下文模块](../../../packages/dsh-loopx-plugin/README.md#optional-native-operation-context-sdk-prerequisite)
+交付独立加载的只读 SDK 前置组件。真实 SDK/内置 runtime `0.1.5rc1` 的工具调用
+已返回当前调用 session、开放的原生 Turn 和白名单 agent options；该观察不是 Core
+actor，也不证明 HTTP wire 实际配置；该只读模块始终返回 `execution_allowed: false`。
+
+独立可选的 `native-operation` 模块和内部 `OwnedDshOperationHost` 现将真实
+SDK/内置 runtime `0.1.5rc1` 接到既有 Core handler。同一活 SDK 连接的两个独立
+已准入 Turn 覆盖原生 session/Turn/call 配对、实际观察的 profile、规范准备、
+确认前拒绝、夹具确认、首次消费、重复拒绝与规范 `not_executed` 结果。
+File/SQLite Goal authority 消费者继续使用原 action-store owner。内核 peer PID
+及精确原生工具参数必须匹配私有有界 Unix 连接；不新增 bearer、调用者 actor、
+批准账本或副作用重试，旧 Codex executor 编码和默认关闭行为保持兼容。
+
+该阶段是使用本地合成响应源的后端集成，不是真实用户批准、原卡送达或金融效用。
+SDK `0.1.5rc1` 的跨进程恢复仍在启动前拒绝，原 `session already exists` 失败保留。
+隔离候选使用上游 `2fbf4359` 官方脚本构建的 Python SDK `0.2.1a3` wheel，配合
+显式 npm runtime `@deepseek-ai/dsh@0.2.1-alpha.3`，通过公开 `resume_session`
+恢复原身份。SDK 文件、Node/入口原字节及完整 npm closure 纳入冻结 profile。
+File/SQLite 重启用例恢复同一操作；历史丢失/不可读时拒绝，不向模型发送输入，
+不替换绑定，失败 client 不可复用。这只是候选源码资格，不能当作已发布 Python
+runtime 或整个插件的兼容性证明。
+
+显式 `turn run-once --host dsh --dsh-operation-module /absolute/native-operation.js`
+入口现复用该 owner、原 Todo session planner 和 operator 授权的 delegation
+callback。模块开关默认关闭，不能与 `--dsh-runner` 或其它 host 混用。配置读回
+标明 `owned_native_sdk`，仍保持 `runtime_qualified: false`。File/SQLite 使用
+真实 CLI、SDK 和独立 callback 进程恢复原持久 session/profile，首次消费、重复
+拒绝并记录 `not_executed`；typed wait 仍是 rejected delegation，不是业务完成。
+endpoint 原字节的哈希纳入不可变 profile，不序列化凭据。通用
+`--confirmed-operation-id`、`--operation-source-route-json` 保留旧 Codex 别名。
+CLI 夹具不证明原卡送达或真实用户批准。
+
+后续有界真实验收使用实际模型、真实 Lark 卡片及经过认证的人类确认。正常原生
+CLI 续接恢复原 DSH session/profile，首次消费一次，登记规范 `not_executed`，
+并更新同一原卡；独立 provider 读回验证结果，金融动作是零。此续接由角色在
+callback 后手动调用：无人值守唤醒尚未配置，实际确认至宿主启动约 246 秒，
+不满足下文健康自动路径 60 秒目标。其它 runtime、全局安装、账户副作用和金融
+效用仍未验。本机较旧 Core 在 inbox 投影时拒绝新的 DSH executor，候选源码
+入口可读；回滚须保留这些 pin，不能假定旧 reader 兼容。
+
 公开 `goal-channel inspect-operation/consume-operation/report-operation` 仍在
 私有读写前拒绝，即使 `CODEX_THREAD_ID`、路由、自签 proof 完全匹配或旧运行时
 意外返回 actor 成功，也没有 proof-import 捷径。

docs/reference/local-delegation.md

@@ -1258,11 +1258,41 @@ This is a fragment, not a complete collector configuration. `execution_config`
 is project-relative, without traversal or symlinks, and remains outside the
 member workspace. The selected binding must grant that registered requester
 the operation's exact Agent/Todo. Use `codex-cli`, `--codex-operation-tools`
-and the original pinned model/effort. Do not select `fresh`, change the owning
+and the original pinned model/effort, or the explicit DSH entry described below.
+Do not select `fresh`, change the owning
 home, binary, sandbox or effective MCP configuration, or retarget the Todo.
 Prepare the operation in this same managed session/profile. Existing delegation
 inspection and ordinary Turn admission still determine whether it can run.
 
+For the candidate DSH transport, prepare through the normal CLI with
+`--host dsh --dsh-operation-module /absolute/native-operation.js` and retain
+those exact options in the original delegation binding. Also pin the original
+`--dsh-runtime-bin`, `--dsh-home`, `--dsh-cordis`, provider/model/effort and token
+budget. The supported restart candidate is Python SDK `0.2.1a3` built from
+official source `2fbf4359` plus explicit npm runtime
+`@deepseek-ai/dsh@0.2.1-alpha.3`; it is not a published Python runtime release.
+SDK/bundled runtime `0.1.5rc1` cannot resume across processes. Do not substitute
+`--dsh-runner`, a replacement home/session, or a changed provider endpoint.
+The native module, SDK/runtime closure, effective profile, patch and endpoint
+hash are compared again before model input. Missing/corrupt history refuses.
+
+`--operation-source-route-json '{"host_surface":"registered-surface","thread_id":"registered-thread"}'`
+selects an already registered return audience when required. The original
+source is not executor authentication. `--confirmed-operation-id` is the
+callback-owned exact locator; both flags retain their old Codex aliases.
+Do not supply a locator as proof of confirmation. Removing
+`--dsh-operation-module` disables this transport for subsequent Turns; it does
+not cancel an existing operation or reconcile an uncertain result. Keep the
+old pinned SDK/runtime/profile available for rollback and original recovery.
+Ordinary DSH and legacy Codex paths retain their existing behavior.
+
+中文：DSH 候选通过正常 CLI 显式加载绝对路径原生模块，并把相同参数保留在原
+delegation binding。保持原 runtime/home/patch、provider、模型/深度、token
+预算及 endpoint；不能换 session 绕过恢复失败。缺失/损坏历史在模型输入前拒绝。
+配置可用不等于运行资格；夹具确认、派发、规范结果、原卡回传和真实交易分别验收。
+移除模块开关只关闭后续 Turn 的该 transport，不取消旧操作或解除未知结果；保留
+旧 pin 供回滚与原操作恢复，不改全局安装。
+
 If the original standalone operation Session was prepared **without** a
 delegation MCP server, its profile includes `mcp_server: null`. Preserve that
 exact profile using the existing operator-owned binding option:

examples/personal-workspace-browser/goal-workspace-m2.mjs

@@ -76,11 +76,19 @@ export const goalWorkspaceM2Scenario = {
       await now.locator('.work-map').waitFor();
       await now.getByRole('button',{name:'按负责人',exact:true}).click();
       await now.locator('[data-todo-id="showcase-reconcile"]').click();
+      await page.waitForURL(value => value.searchParams.get("todo") === "showcase-reconcile");
       await page.locator('.personal-drawer-close').click();
+      await page.waitForURL(value => !value.searchParams.has("todo"));
+      await page.locator('.personal-context-drawer').waitFor({state:"hidden"});
       await page.goBack({waitUntil:"domcontentloaded"});
+      // Back restores the task just closed, not a selection from an earlier view.
+      await page.waitForURL(value => value.searchParams.get("todo") === "showcase-reconcile");
       await page.locator('.personal-context-drawer').waitFor();
-      assert.equal(new URL(page.url()).searchParams.get("todo"), "showcase-map-columns");
-      await page.locator('.personal-drawer-close').click();
+      await now.locator('[data-todo-id="showcase-reconcile"][aria-pressed="true"]').waitFor();
+      assert.equal(await now.locator('[data-todo-id="showcase-reconcile"]').getAttribute('aria-pressed'),'true');
+      await page.goForward({waitUntil:"domcontentloaded"});
+      await page.waitForURL(value => !value.searchParams.has("todo"));
+      await page.locator('.personal-context-drawer').waitFor({state:"hidden"});
       assert.equal(writes.length,0,`Read-only navigation made an effect request: ${writes}`);
       await page.screenshot({path:resolve(outputDir,'goal-workspace-m2-desktop.png'),animations:'disabled'});
       await page.setViewportSize({width:390,height:844});

loopx/cli_commands/turn.py

@@ -89,18 +89,24 @@ def handle_turn_command(
         strict_goal_admission = goal_admission if goal_admission.enabled else None
         if getattr(args, "codex_operation_tools", False) and args.host != "codex-cli":
             raise ValueError("--codex-operation-tools requires the codex-cli host")
-        if getattr(args, "codex_confirmed_operation_id", None) and not getattr(
-            args, "codex_operation_tools", False
+        dsh_operation_module = getattr(args, "dsh_operation_module", None)
+        if dsh_operation_module and (
+            args.host != "dsh" or getattr(args, "dsh_runner", None)
         ):
+            raise ValueError("--dsh-operation-module requires the dsh SDK host without --dsh-runner")
+        if dsh_operation_module and not Path(dsh_operation_module).is_absolute():
+            raise ValueError("--dsh-operation-module must be an absolute compiled module path")
+        operation_tools = bool(getattr(args, "codex_operation_tools", False) or dsh_operation_module)
+        if getattr(args, "codex_confirmed_operation_id", None) and not operation_tools:
             raise ValueError(
                 "confirmed operation continuation requires the owned operation transport"
             )
         if (
             getattr(args, "codex_operation_source_route_json", None) is not None
-            and not getattr(args, "codex_operation_tools", False)
+            and not operation_tools
         ):
             raise ValueError(
-                "--codex-operation-source-route-json requires --codex-operation-tools"
+                "--operation-source-route-json requires --codex-operation-tools for codex-cli or --dsh-operation-module for dsh"
             )
         # Planning and dry-run execution inspect existing admitted intents.
         # Only an executing wake may sync inboxes or reserve a calendar window.
@@ -164,7 +170,7 @@ def handle_turn_command(
                          and not getattr(args, "codex_operation_tools", False) else "todo")
         if (
             args.turn_command == "run-once"
-            and args.host == "codex-cli"
+            and (args.host == "codex-cli" or dsh_operation_module)
             and not resume_requested
             and not args.resume_turn_key
             and args.iteration_context != "fresh"
@@ -178,9 +184,10 @@ def handle_turn_command(
                     turn_envelope,
                     goal_admission=strict_goal_admission,
                     session_scope=session_scope,
+                    host=args.host,
                 )
                 if strict_goal_admission is not None
-                else codex_cli_session_binding(runtime_root, turn_envelope, session_scope=session_scope)
+                else codex_cli_session_binding(runtime_root, turn_envelope, session_scope=session_scope, host=args.host)
             )
         payload = build_loopx_turn_plan(
             turn_envelope,

loopx/cli_commands/turn_dsh_host.py

@@ -6,6 +6,10 @@
 from typing import Any
 
 from ..dsh_goal_mode.turn_host_adapter import DshHostConfig, run_dsh_host
+from ..control_plane.goals.first_party_host_admission import FirstPartyHostGoalAdmission
+from ..control_plane.turn_driver.execution_profile import managed_execution_profile
+from ..control_plane.turn_driver.host_binding import dsh_output_token_budget
+from ..dsh_goal_mode.turn_host_adapter import resolve_dsh_home
 from ..control_plane.operator_credential import (
     OPERATOR_CREDENTIAL_ENV_VARS,
     OPERATOR_ENDPOINT_ENV_VAR,
@@ -54,3 +58,46 @@ def run(request: Mapping[str, Any]) -> dict[str, Any]:
         return run_dsh_host(request, config=config)
 
     return run
+
+
+def build_dsh_operation_host_runner(
+    args: argparse.Namespace,
+    *,
+    runtime_root: Path,
+    registry_path: Path,
+    workspace: Path,
+    environ: Mapping[str, str],
+    goal_admission: FirstPartyHostGoalAdmission | None,
+) -> DshHostRunner:
+    """Bind explicit native transport options; no runner or ambient actor hook."""
+    from ..control_plane.turn_driver.dsh_operation_host import run_dsh_operation_host
+
+    profile = managed_execution_profile(
+        environ, provider=args.dsh_provider, model=args.dsh_model,
+        reasoning_effort=args.dsh_reasoning_effort,
+    )
+    credential = {
+        name: str(environ[name])
+        for name in (*OPERATOR_CREDENTIAL_ENV_VARS, OPERATOR_ENDPOINT_ENV_VAR)
+        if environ.get(name)
+    }
+    options = {
+        "runtime_root": runtime_root, "registry_path": registry_path,
+        "project": workspace,
+        "dsh_home": resolve_dsh_home(workspace, Path(args.dsh_home) if args.dsh_home else None),
+        "operation_module": Path(args.dsh_operation_module),
+        "provider": profile["provider"], "model": profile["model"],
+        "reasoning_effort": profile["reasoning_effort"],
+        "max_tokens": dsh_output_token_budget(args.dsh_max_tokens)["max_tokens"],
+        "timeout_seconds": 120 if args.timeout_seconds is None else max(1.0, args.timeout_seconds - 5.0),
+        "runtime_bin": Path(args.dsh_runtime_bin) if args.dsh_runtime_bin else None,
+        "cordis": Path(args.dsh_cordis) if args.dsh_cordis else None,
+        "source_route": args.codex_operation_source_route_json,
+        "confirmed_operation_id": args.codex_confirmed_operation_id,
+        "goal_admission": goal_admission, "env": credential,
+    }
+
+    def run(request: Mapping[str, Any]) -> dict[str, Any]:
+        return run_dsh_operation_host(request, **options)
+
+    return run

loopx/cli_commands/turn_registration.py

@@ -241,11 +241,15 @@ def register_turn_commands(
         help="Opt in to the owned app-server operation transport for this admitted codex-cli Turn. Reuses the original Todo/session; does not authenticate an attached Desktop or grant domain effects.",
     )
     run_once.add_argument(
+        "--confirmed-operation-id",
         "--codex-confirmed-operation-id",
+        dest="codex_confirmed_operation_id",
         help="Internal exact-operation resume fence for an operator-granted callback continuation. Requires operation tools; does not authenticate a caller or permit a domain effect.",
     )
     run_once.add_argument(
+        "--operation-source-route-json",
         "--codex-operation-source-route-json",
+        dest="codex_operation_source_route_json",
         type=json.loads,
         help="Registered return audience {host_surface,thread_id} for operation proposals. Required when this Agent has several source routes; not executor authentication or execution permission.",
     )
@@ -318,6 +322,10 @@ def register_turn_commands(
         help="cordis.yml used by the built-in dsh host runtime.",
     )
     run_once.add_argument("--dsh-runtime-bin")
+    run_once.add_argument(
+        "--dsh-operation-module",
+        help="Opt in to the owned DSH operation transport with this absolute compiled native-operation module. Requires the real SDK, not --dsh-runner; installation grants no execution permission.",
+    )
     run_once.add_argument(
         "--dsh-runner",
         help=(