[DeepSeek Harness 1/8] Accept product scope, ownership, threat model, and compatibility matrix

## Summary

Define and accept the product contract that permits DeepSeek Harness to become a supported NemoClaw agent runtime.

Parent epic: #9328

Coordination epic: #7744 for compute-runtime activation beyond the launch matrix accepted here.

This issue blocks implementation approval for the remaining DeepSeek Harness gates.

## Open-source product scope

This decision governs upstream open-source NemoClaw support. NVIDIA-internal or other organization-specific deployment approvals are downstream concerns and are not prerequisites for accepting or implementing this issue.

The supported path must run the complete DeepSeek Harness process inside a NemoClaw-managed sandbox. It must not install or run the harness directly on the user host.

Changes to `deepseek-ai/deepseek-harness` and development of a separate external sandbox backend are outside this decision.

## Current candidate baseline

The initial artifact under review is:

- npm package: `@deepseek-ai/dsh@0.1.0-rc.7`;
- npm integrity: `sha512-ZceDCJ8FAywih+USW/OMk9jEhunlvJBGEz4kqrhau23hPzbciOazZrywH0nBRsaalSeAJ1JGBmjtw4OSjToStw==`;
- upstream source commit: `99f6f02fecdb7dff40c3fbc9470f5907c29f74ca`;
- license: MIT;
- upstream status: prerelease software with compatibility-breaking changes expected.

This is an investigation baseline, not an accepted release pin. The final decision may select a newer exact package after dependency, behavior, and compatibility review.

The package exposes two relevant surfaces:

- `dsh web`, a long-running loopback browser application;
- `dsh --profile headless ""`, a one-shot persisted session that prints a final result and exits.

The shipped package has no built-in terminal UI. Its Host and Origin checks are reachability controls, not user authentication. Its default Web server has no TLS or authentication.

## Problem Statement

DeepSeek Harness is a complete agent runtime, but NemoClaw has no accepted product contract for it.

Implementation cannot decide product ownership, Web exposure, headless dispatch, package stability, inference authority, tool scope, state portability, or upgrade compatibility by accident.

Several upstream defaults are unsafe to adopt as implicit NemoClaw policy:

- the standard preset includes skills, background jobs, subagents, workflows, and Web search;
- the minimal preset replaces the sandboxed filesystem provider with a bare local filesystem provider;
- home and profile patches override shipped bundle configuration;
- the Web models page can write provider settings;
- provider credentials may be read from the inherited environment, project `.env`, `$DSH_HOME/.env`, or `$DSH_HOME/.credentials.yaml`;
- Web and headless modes are separate processes, while some upstream JSON state has no cross-process write locking;
- prerelease state formats do not carry a general migration promise.

## Desired Behavior

Maintainers accept one versioned v1 decision before implementation makes DeepSeek Harness a supported surface.

The decision names owners and records one exact launch, runtime, inference, trust, state, qualification, and upgrade contract. Every later gate consumes that contract and fails closed when an implementation would exceed it.

## Draft v1 decision record

**Status:** Proposed. Maintainers must accept or amend every section below.

### Ownership and identity

- Product owner and scope approval authority: TBD.
- Engineering owner: TBD.
- Canonical agent ID: `deepseek-harness`.
- Display name: `DeepSeek Harness`.
- Runtime binary: `/usr/local/bin/dsh`.
- Release target and support owner: TBD.

### Runtime and managed image

- Select one exact npm package version, integrity value, complete lockfile closure, source commit, and license inventory.
- Each supported release binds that closure to exact managed-image digests.
- Runtime self-update, floating versions, first-boot package installation, and unreviewed plugin installation are unsupported.
- Stock onboarding consumes an immutable managed-image digest and never builds a repository Dockerfile on the user host.
- Gate 2 must prove the accepted Node.js runtime and every required native addon or lifecycle script on each launch architecture.

### Launch matrix

Proposed v1:

- compute runtime: Docker;
- platforms: `linux/amd64` and `linux/arm64`;
- Podman deferred to #7744.

DeepSeek Harness-specific code must not branch on Docker or Podman. Compute-runtime provider code must not branch on `deepseek-harness`.

### User surfaces and browser boundary

Select one v1 surface contract:

1. Web plus headless, with an accepted authenticated reverse-proxy or upstream authentication boundary; or
2. Web plus headless with an explicit loopback-only `auth: none` limitation; or
3. headless-only until an acceptable browser boundary exists.

Do not label Host/Origin validation or `dashboard.auth: session` as authentication. NemoClaw dashboard metadata describes an existing agent authentication mechanism; it does not create one.

If authenticated Web access requires a new generic proxy, name that work as an explicit prerequisite of Gate 3. If `auth: none` is accepted, record the local-user threat model, bind and host-forward limits, remote-access limitations, and user-facing warning.

For headless use, select either:

- a generic gateway-runtime-with-headless dispatch contract; or
- a documented existing `nemoclaw ... exec -- dsh --profile headless` contract.

The current agent passthrough dispatch accepts terminal runtimes, not an arbitrary gateway runtime with `headless_command`; a manifest field alone does not establish the public command.

### Process model

Select whether Web and headless processes:

- share one `$DSH_HOME` under a proven concurrency and snapshot contract; or
- use isolated homes with explicit session, attachment, settings, and workspace behavior.

Do not assume concurrent safety. The decision must cover profile auto-initialization, installation symlink repair, session and attachment writes, Web `storages/`, settings hot reload, process shutdown, and snapshot quiescence.

### Managed inference

Select:

- the DSH adapter and API family;
- provider-catalog and model-capability validation;
- context-window, output-token, reasoning, streaming, image, and structured-tool-call requirements;
- one or more release qualification models;
- the route placeholder or sandbox credential contract;
- the root-owned final configuration layer that outranks writable home and profile patches.

The current `llm-pi-ai` adapter, `openai-completions`, `https://inference.local/v1`, and `nvidia/nemotron-3-super-120b-a12b` are proposed starting candidates. They are not accepted until evidence proves the required DSH behavior.

The upstream provider credential must remain outside the sandbox. Direct provider fallback must fail closed.

### Preset, tools, and trust

Select one exact reviewed preset and tool roster. Do not call the upstream standard preset accepted while deferring capabilities it includes.

Record explicit decisions for:

- Bash, filesystem tools, filesystem search, persistent shells, and background jobs;
- skills and repository instruction discovery;
- subagents, forks, workflows, Ralph, and Code/PTC mode;
- Web search, Web fetch, MCP, external plugins, project profiles, and package installation;
- user approvals and the relationship between DSH permissions and the outer sandbox policy;
- settings, profile patches, dynamic Cordis composition, and executable project trust;
- telemetry, feedback export, anonymous identity, update checks, and direct-provider traffic.

The outer NemoClaw sandbox policy remains the execution authority. An inner DSH filesystem boundary may provide defense in depth only after its exact failure behavior is qualified.

### Lifecycle and state

Classify every observed runtime path as persistent, allowlist-restored, reconstructed, prohibited, or ephemeral. At minimum, decide the treatment of:

- `$DSH_HOME/sessions/`;
- `$DSH_HOME/attachments/`;
- `$DSH_HOME/storages/` when Web is accepted;
- `settings.yaml`;
- profile manifests and `cordis.patch.yml` layers;
- `$DSH_AGENTS_HOME`, bundled skills, user skills, and project resources;
- the invoking workspace;
- `.credentials.yaml`, project and home `.env` files;
- `.anonymous-user-id`;
- generated profile package symlinks, `node_modules`, caches, indexes, logs, and temporary files.

Proposed baseline:

- sessions and accepted attachments are confidential persistent state;
- accepted workspace data follows the shared NemoClaw workspace contract;
- only an explicit allowlist of non-security user preferences may restore;
- managed settings, route and policy overlays, shipped profiles, package trees, caches, and indexes reconstruct;
- credentials, anonymous telemetry identity, direct-provider settings, executable plugin/profile state, and project trust do not restore.

Same-version restart, rebuild, snapshot, restore, recovery, and destroy must be defined. A later package upgrade requires explicit format-compatibility evidence or must fail before mutation with a rollback path. This decision does not promise arbitrary RC-to-RC migration.

### Qualification and evidence

Define a deterministic keyless task and independent oracle for Web and/or headless surfaces. Define the exact live matrix for every accepted architecture and surface.

Evidence must bind:

- NemoClaw candidate commit;
- DSH package version and integrity;
- lockfile and dependency-review digest;
- managed-image digest and architecture;
- OpenShell and compute-runtime identities;
- effective final configuration and policy digests;
- model, provider, and API family;
- browser bind/auth mode and public/internal ports when Web is accepted;
- task version, oracle result, timestamps, and sanitized logs.

## Explicit v1 non-goals

- Running DSH directly on the host.
- An upstream DeepSeek/OpenShell backend.
- Podman unless this decision explicitly adds it.
- A terminal UI that upstream does not ship.
- Floating packages, runtime self-update, first-boot installs, or automatic plugin installation.
- Direct upstream provider credentials in the sandbox.
- Treating Host/Origin checks as authentication.
- Product qualification of unreviewed plugins, profiles, skills, MCP servers, or project executables.
- Arbitrary prerelease state migration.
- A DeepSeek Harness-specific compute-runtime, snapshot, recovery, or destroy implementation.

## Acceptance evidence

Before closure, attach or link one review packet containing:

- exact npm metadata, integrity, source commit, license, Node.js range, dependency closure, install-script/native-addon inventory, and Web artifact inventory;
- sanitized outputs from the exact package for `dsh --version`, Web help, and effective Web/headless configuration dumps;
- an observed filesystem-write inventory for one bounded Web and headless smoke run;
- the exact built-in preset/tool inventory and the proposed NemoClaw roster diff;
- evidence that the Web server has no authentication and a maintainer decision selecting the v1 browser boundary;
- evidence for the selected public headless command and current dispatch gap, if any;
- a concurrency/state experiment or an explicit isolated-home decision;
- the managed-inference compatibility experiment and effective final-layer precedence;
- the versioned deterministic task, independent oracle, timeout/retry limits, and live qualification matrix.

The accepted decision must be recorded in this issue or a repository-owned decision document linked from it. Later implementation issues must cite the accepted revision.

## Acceptance Criteria

- [ ] Product owner, engineering owner, release target, and support owner are named.
- [ ] Maintainers explicitly accept the canonical identity and open-source scope.
- [ ] One exact package candidate, source, integrity, dependency-review requirement, image ownership, and update cadence are selected.
- [ ] The launch platform, architecture, and compute-runtime matrix is accepted, including the Podman decision.
- [ ] The accepted Web/headless surface matrix and public command for each surface are recorded.
- [ ] The browser contract selects authenticated access, explicit loopback-only unauthenticated access, or headless-only; Host/Origin checks are not mislabeled as authentication.
- [ ] Any required generic authentication prerequisite is named and sequenced before Gate 3.
- [ ] Shared or isolated Web/headless process state is selected with explicit concurrency semantics.
- [ ] The managed-inference adapter, API family, model-validation rules, qualification model, credential boundary, and final configuration authority are accepted.
- [ ] One exact preset and tool roster is accepted; every omitted or enabled dynamic capability is explicit.
- [ ] Tool, plugin, profile, browser, filesystem, process, network, telemetry, and feedback boundaries are recorded.
- [ ] Every known DSH state path is classified as persistent, allowlist-restored, reconstructed, prohibited, or ephemeral.
- [ ] Same-version lifecycle behavior and later-version compatibility, refusal, rollback, and requalification rules are recorded.
- [ ] The deterministic task, independent oracle, live matrix, and exact evidence schema are accepted.
- [ ] The acceptance evidence packet is complete and contains no credential.
- [ ] The remaining seven issue bodies match the accepted decision.

## Category

Feature

## Checklist

- [x] I searched existing issues and this is not a duplicate.
- [x] I described the problem and desired behavior.

No source file or test is named. Start by reading the draft v1 decision and the acceptance criteria, then review parent epic #9328 and coordination epic #7744; done means maintainers have recorded owners and one accepted, versioned product, runtime, trust, state, inference, qualification, and upgrade contract with the required evidence linked.

Written by the indexing model from the issue text.