feat(dsh): qualify portable report rendering

[Cobb04]

Summary

Qualifies DeepSeek Harness for Better Harness's existing portable durable report pipeline. DSH gains REPORT_RENDERING and routes through the shared HTML/Markdown renderer to publish findings.json, report.md, and report.html under the Better Harness-owned <target>/.dsh/better-harness root.

Why

• Issue/Story: Closes [Feature]: Qualify DeepSeek Harness for portable HTML report rendering #112. This builds on the shared DSH Harness analysis delivered by [Feature]: Add DSH shared Harness analysis with frozen-cwd Evidence Bundle support #104 / feat(dsh): add shared Harness analysis #110.
• User or maintainer outcome: DSH users can retain the normal portable Better Harness report artifacts instead of being limited to inline/no-files analysis, while explicit no-files operation remains write-free.

Traceability and Scope

• Spec/ADR, if applicable: DeepSeek Harness Portable Report Rendering, AC-1 through AC-16.
• Acceptance criteria addressed: DSH gains exactly REPORT_RENDERING; durable DSH selects portable html; the standard three-artifact set uses <target>/.dsh/better-harness; explicit no-files remains write-free; privacy, temporal, rollback, native inertness, cross-platform, shared-host, docs, and packaging boundaries are qualified.
• Canonical owners changed: scripts/host-support/index.mjs, skills/better-harness/SKILL.md, templates/reporting/routing.md, the existing DSH native smoke owner, focused tests, and the three canonical DSH adapter/reference docs.
• Explicit non-goals: no CHECKUP, Canvas, Studio, DSH-specific renderer/schema/transform, Evidence Bundle or Asset Baseline changes, Session/configured-assets semantic changes, native DSH changes, dependency changes, Quickstart/P0 launch work, or claim of full DSH support.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
volta run --node 22.20.0 npx vitest run <10 focused #112/DSH suites>	PASS: 10 files, 188 passed, 1 Windows-only skipped
npx vitest run <10 focused #112/DSH suites> on Node 24.15.0	PASS: 10 files, 188 passed, 1 Windows-only skipped
npx vitest run <8 existing DSH regression suites>	PASS: 8 files, 190 passed
npm run test:dsh-native	PASS against DSH 0.1.1-rc.2 / b150a551b8d465e31e418e1b2eaf5e79bbb7d28e; no credential required
npm run test:dsh-configured-assets-native	PASS; credentialUsed:false; Skills, Instructions, Presets, Profiles, Sessions, and configured roots remain inert to the report subtree
literal default npm run check in a clean exact-commit worktree, Node 24.15.0 / npm 11.12.1	PASS: root 1542 passed / 2 skipped; Harness 167; Harness UI 30; Harness Studio 266; pack verification passed
npx vitest run test/skills-docs/doc-link-graph.test.mjs test/skills-docs/dsh-portable-report-rendering-contract.test.mjs	PASS: 2 files, 12 passed
npm run build in docs/	PASS: optimized English and zh-Hans builds
npm run pack:verify	PASS: npm 586 entries, runtime zip 848 entries
git diff upstream/main...HEAD --check	PASS
GitHub CI run 32832129687 at f49ba0d	PASS: macOS Node 22, Ubuntu Node 22, Windows Node 22, and Ubuntu Node 24; Windows executed and passed the drive/UNC resolver, publication failure, rollback-failure, and DSH artifact/root receipts

Manual or visual evidence: no visual surface changed. Structured routing confirms DSH/Grok/Kimi/WorkBuddy/Codex remain portable HTML and Qoder/Cursor remain Canvas. The Windows / Node 22 job executed and passed the actual Better Harness drive/UNC resolver receipt plus the publication, rollback-failure, and DSH artifact/root tests; CI run 32832129687 completed the full four-job matrix successfully.

Risk and Recovery

• Compatibility and cross-platform impact: durable output persists reviewed analysis that was previously inline-only for DSH; DSH joins a shared portable-routing surface; Windows drive/UNC behavior requires the native Windows CI receipt. The Better Harness-owned .dsh/better-harness subtree is semantically inert to the qualified native DSH rc.2 baseline.
• Package, plugin, schema, or generated-file impact: the existing report-data contract, HTML/Markdown renderers, publication machinery, package roots, and dependencies are reused unchanged. No schema, dependency, renderer asset, Canvas, Studio, Evidence Bundle, or Asset Baseline owner changes.
• Rollback or recovery path: revert the commits introduced by this PR. DSH then returns to shared analysis plus inline/no-files while retaining its existing Session, configured-assets, Asset Practices, Harness Report, and Evidence Bundle support.
• Residual risk or unverified boundary: model-authored lead reconciliation remains intentionally non-deterministic; [Feature]: Qualify DeepSeek Harness for portable HTML report rendering #112 qualifies the executable privacy boundaries before and after it. Native Windows drive/UNC qualification executed and passed in the Windows / Node 22 lane of CI run 32832129687.

AI Involvement

• Level: Assisted
• Human review and validation: Cobb04 owned product scope, Issue definition, architecture decisions, Spec review/correction, acceptance interpretation, finding review, and validation/merge decisions. AI assistance covered source research, Spec drafting, RED design, implementation assistance, skeptical review, regression/test work, and validation; Cobb04 reviewed the resulting scope, contracts, diff, and evidence.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md. Not applicable: the approved [Feature]: Qualify DeepSeek Harness for portable HTML report rendering #112 Spec explicitly excludes changelog/release work, and AGENTS.md prohibits task-external changelog edits without an explicit requirement.
• I have the right to contribute this work under the repository's MIT License.

[phodal]

Thanks — the capability slice here is tight, and I like that DSH joins the existing portable route without a DSH-specific renderer, schema, or output root: the only production change is one REPORT_RENDERING entry in scripts/host-support/index.mjs, and the rest is docs plus tests. The Portable HTML report row, the RENDER_REPORT_PLATFORMS/hostIdsFor(REPORT_RENDERING) equality check, and the write-free no-files test give the boundary real teeth.

Windows CI

Confirmed resolved by f49ba0d. For the record, the failure on 0d8d69f was not a flaky runner:

• The two Unexpected end of JSON input failures came from --import receiving a native Windows path. Node treats that value as a specifier, so D:\a\... parses as a d: scheme and the child exits before printing JSON. pathToFileURL is the right fix.
• The deepEqual failure was a comparison between a process.cwd()-derived path (C:\Users\RUNNER~1\...) and a realpath()-derived path (C:\Users\runneradmin\...). macOS hid it because getcwd there already returns the resolved path. Comparing by realpath identity matches the AGENTS.md guidance about not depending on raw absolute-path string equality.

All four lanes are green on f49ba0d (run 32832129687), so this is no longer blocking. Two small follow-ups:

1. The evidence table in the PR body still describes the pre-fix state. Worth refreshing it so the Windows row points at the run that actually passed.
2. Optional, and genuinely a question rather than a request: since resolveReportOutputLocation builds outDir with path.resolve only, outputLocation.resolvedOutDir now carries whatever spelling the caller used — including an 8.3 alias on Windows. Publication and rollback stay correct because renames happen within one directory, but the receipt a user reads can differ between two invocations of the same physical target. If that is intentional, no change needed; if not, canonicalizing at the resolver seems better than tolerating it at the assertion.

Could we attach a rendered report.html?

The PR body says no visual surface changed, and that is accurate at the renderer level. Still, this is the first time DSH produces a report.html at all, so from a reviewer's seat the interesting question is not "did the renderer change" but "does the portable report actually look right when it lands under <target>/.dsh/better-harness".

Would you mind attaching one screenshot of the generated report.html opened from disk — ideally the DSH run from the focused suite, showing the report header and a finding or two? Nothing elaborate; a single image is enough. It gives the qualification a visual receipt alongside the structural ones, and it is the artifact future readers of #112 will most want to see. Entirely fine to say the render is byte-identical to the existing portable hosts and skip it if you would rather keep the PR text-only.

Minor, non-blocking

• test/skills-docs/dsh-portable-report-rendering-contract.test.mjs: the parsed-table assertions are good and will survive rewording. The prose checks next to them are not — assert.equal(source.includes("or artifact repair or writes"), false) and document.includes("native DSH") lock exact sentences in docs/adapters/README.md, so an unrelated copy edit breaks the suite without any behavior changing. AGENTS.md asks for behavior over implementation text here; the routing table and capability checks already cover the contract. The privacy-canary doesNotMatch-style checks in assertDurableProjection are the legitimate exception and should stay.
• The Windows drive/UNC test opens with assert.equal(out, current.expectedOut), which asserts path.join's own behavior rather than the resolver's. Since the whole block is skipIf-gated to one lane, dropping that line keeps the test focused on resolveReportOutputLocation.
• docs/docs/hosts/adapter-matrix.md: the intro now wraps as ... durable\noutput. The with a two-word line. Cosmetic reflow.

[Cobb04]

Refreshed the evidence table to the passing Windows run 32832129687 at f49ba0d, including the four Windows-specific receipts.

On resolvedOutDir: for #112 I’m treating the current generic lexical spelling as intentional. The qualified contract is filesystem/output semantics rather than 8.3 ↔ long-name presentation canonicalization, so I left the resolver unchanged. If a stable canonical user-facing receipt is desirable, I think that is better handled as a generic routing concern rather than a DSH-specific change.

I also removed the prose-coupled documentation assertions, dropped the redundant path.join self-check while retaining the actual resolver coverage, and reflowed the adapter-matrix paragraph. The polish is in 7724abe; CI run 32834115330 is green across macOS Node 22, Ubuntu Node 22, Windows Node 22, and Ubuntu Node 24.

[phodal]

Approved after the follow-up at 7724abe. The Issue #112 capability slice remains bounded to DSH REPORT_RENDERING, the shared portable renderer and no-files boundary are executable, and the native inertness, privacy, rollback, packaging, and Windows receipts are green. No blocking findings.