# DeepSeek Harness plugin: a bounded runner replay

Recorded September 8, 2026 against plugin commit
`201ccc563bcbccac6f5a0b88fc2b138495dc6e08`. Source files are unchanged copies
from the public repository. `source-manifest.json` gives exact commit URLs
and SHA-256 values. The upstream MIT license is preserved in `upstream/LICENSE`.

## What ran

Six original tests from `upstream/test/command-runner.test.js` execute the
real `createTimelineCommandRunner` implementation:

1. Forward an inspection command and its canonical project path.
2. Reject a project outside `allowedRoots`.
3. Reject a plan whose output is outside the allowed roots.
4. Reject an imported asset outside the allowed roots.
5. Reject an output symlink.
6. Convert a deliberate child-CLI `ok:false` result into an error.

The tool-registration test is explicitly excluded because it loads
`@deepseek-ai/dsh-tools`. This run does not install or mock that package.
It does not mount Cordis or the plugin, execute Timeline Studio's command
engine, import real media, call a model or render a video. The original
upstream tests create a synthetic `timeline-command.mjs` child process
that echoes command arguments, or deliberately returns `INVALID_PROJECT`.
Passing these tests verifies the runner boundary against those fixtures.

The recorded run is in `results/report.json`, with unaltered TAP stdout in
`results/stdout.tap` and stderr in `results/stderr.txt`. It executed and passed
six tests; the name filter omitted the registration test. No API key, account,
network request, package installation
or model is needed. The recorded Node version is 22.14.0. The full plugin
declares Node 22.20+ or 24+; this isolated runner result does not establish
compatibility of the full plugin on the older runtime.

## Reproduce

Download and extract `deepseek-harness-runner-kit.zip`. With Node installed,
run these commands inside the extracted directory:

```sh
shasum -a 256 -c SHA256SUMS
node reproduce.mjs ./my-run
```

The verifier checks pinned source hashes before running the unchanged
test file. The test-name filter excludes only the package-dependent
registration test. New logs are written to `my-run/`; use a new output
directory to retain earlier results. The upstream tests also create small
fixture directories under the operating-system temporary directory.

## Historical report, not independently recovered

At this same commit, `upstream/docs/testing.md` reports seven unit tests,
one real Harness/Cordis end-to-end test and a 180x320 render on August 15,
2026, with Node 24.11.1, rc.6 Harness packages, Cordis 4.0.1 and FFmpeg 8.0.1.
It explicitly states that media and projects were written to the OS
temporary directory and no test media were retained in the repository.
No original run log or MP4 was available in the checked public snapshot.
This kit therefore does not present those historical counts as a current
or independently verified execution result.

The preserved E2E test definition uses a one-second synthetic blue image
and expects `hasAudio: false`. Its external ffprobe check asserts positive
duration and 180x320 video dimensions; it does not fully decode the video
or test an audio stream. Merely finding that test file does not establish
that it passed in a particular environment.

The separate September 7 editorial-workflows case publishes a six-second
180x320 slate-and-tone MP4, command responses and a full-decode check at
Timeline Studio commit `68980d142cce421eab86cd4ef26a4475a6affd56`. That is a
CLI-only case, not this plugin's Harness/Cordis E2E run. Its materials live
at `/resources/evidence/2026-09-07/editorial-workflows/`.