Six-role DSH swarm: evidence contracts are not independent execution receipts
Reviewed September6,2026 UTC

Primary source
https://github.com/joekytc/dsh-swarm/tree/8c304b8e947a7c31950866e102c76df6a4b5a30e
247 current files. Bare Git clone preserved. Reviewed delivery-evidence.ts, review-evidence.ts, event-store.ts and review-evidence.test.ts, plus call sites in kanban-service.ts. No investigated code or tests executed.

What the checks establish
hasDeliveryEvidence requires nonempty changed_files and either a nonempty commit string or an affirmative/descriptive push field. This function does not resolve that commit or inspect files.
validateReviewEvidence checks handoff structure and selected values: pass requires a supplied test exit0; the applicable test-first branch requires runner vitest and test_first true. Its inputs are metadata, with no command execution or Git-history inspection in this function. Unit tests use constructed metadata, including a placeholder commit. Other reviewers/merge stages may perform work; these helpers alone do not prove it occurred. No bypass experiment was run against any service.

Event-store limits
FileEventStore appends JSON to events.jsonl and supports replay. It also exposes purge(), which rewrites retained events with reassigned sequence numbers. Thus an exported sequence is not necessarily an immutable complete history. readAllSync catches errors and returns an empty array; a malformed file may therefore be indistinguishable from empty at this layer. These observations qualify audit claims; they do not prove any observed record was removed or corrupted.

Archive coverage
No .log/.jsonl/.ndjson files in current tree or history path search across retained branch commits. Other formats, embedded fixtures, releases and private workspaces are outside that negative. No real task run recovered. The README's six roles and pipeline are source-described architecture, not six authenticated active agents.

Next useful evidence
A public events.jsonl export paired with matching repository commits and actual test output could establish a task chain. Inspect actor/session bindings and hashes, not just completed labels or schema-valid fields. No private wiki-vault service, credentials or workspace was accessed. Existing Git access worked.

Preservation
269-private/swarm.git, tree.json, four reviewed source/test files, SHA256SUMS. Chinese and English repository page was previously captured268-private/dsh-swarm.html. Search returned catalog mirrors, not an independent work-result join. Chinese-lab escape remains unconfirmed; continue searching independent surfaces and recorded runs.