Lee-take · Lee-take · Jul 19, 2026 · Jul 19, 2026 · Jul 19, 2026 · Jul 19, 2026
diff --git a/.cargo/config.toml b/.cargo/config.toml
@@ -0,0 +1,2 @@
+[target.x86_64-pc-windows-gnu]
+rustflags = ["-C", "link-arg=-Wl,--no-insert-timestamp"]
diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md
@@ -4,7 +4,7 @@ Last updated: 2026-07-19
 
 ## Current status
 
-DS Agent `v1.2.0` is intentionally published unsigned. Both `ds-agent.exe` and
+DS Agent `v1.3.0` is intentionally published unsigned. Both `ds-agent.exe` and
 the Windows x64 NSIS installer are expected to report Authenticode `NotSigned`.
 Windows may therefore display `Unknown publisher` or a Microsoft Defender
 SmartScreen warning. Users should download only over HTTPS from the official
@@ -13,7 +13,7 @@ GitHub Release and verify the published SHA-256 before running the installer.
 The SignPath Foundation application is submitted and approval is pending. No
 DS Agent binary may be represented as SignPath-signed until the application is
 approved and a later-version artifact independently verifies as Authenticode
-`Valid`. The project will not replace the immutable `v1.1.0` or `v1.2.0` tag,
+`Valid`. The project will not replace the immutable `v1.1.0`, `v1.2.0`, or `v1.3.0` tag,
 Release, or asset if signing becomes available later.
 
 For releases accepted into that program: **Free code signing provided by
@@ -57,7 +57,7 @@ them; guessed or placeholder identifiers are forbidden.
 
 ## Release verification
 
-For the unsigned `v1.1.0` and `v1.2.0` exceptions, maintainers verify and disclose the actual
+For the unsigned `v1.1.0`, `v1.2.0`, and `v1.3.0` exceptions, maintainers verify and disclose the actual
 `NotSigned` status of both the application executable and installer. Evidence
 must bind the exact source commit, file name, product version, byte size, and
 SHA-256. The installer downloaded back from GitHub must match the reviewed

diff --git a/PRIVACY.md b/PRIVACY.md
@@ -14,19 +14,22 @@ User-selected workspaces hold approved evidence, exports, reports, work
 packages, screenshots, and other artifacts. This information is not silently
 synced to a DS Agent-operated server.
 
-The current stable `v1.2.0` accepts one user-supplied DeepSeek API key through
+The current stable `v1.3.0` accepts one user-supplied DeepSeek API key through
 the onboarding screen and stores it in a dedicated Windows DPAPI-protected
 local vault. A process-environment key remains an explicit compatibility
 fallback and is never silently copied into that vault. The project does not
 provide a shared key. The raw key exists in frontend memory only while it is
 being entered and submitted; it must not be retained in UI state, events, logs,
 exports, screenshots, work packages, or verification receipts.
 
-Goal contracts, lifecycle events, and UI projections are bounded and designed
+Goal contracts, exact-task grouped authorizations, lifecycle events, and UI
+projections are bounded and designed
 to exclude raw secrets, provider bodies, absolute app-data or vault paths,
 local authority material, and internal claim tokens. The read-only UI receives
 stable status/reason codes, bounded goal text, revision/fingerprint values, and
-coverage counts; it does not receive a local completion writer.
+coverage counts plus a redacted authorization intent; it does not receive the
+private capability proposal, a preparation/compiler command, or a local
+completion writer.
 
 Uninstalling the application may not delete a user-selected workspace or every
 application-data file. Review and remove those local locations separately when
@@ -64,7 +67,7 @@ the user or person operating the application:
 The optional local desktop bridge accepts only loopback addresses and is
 started and controlled by the user. DS Agent does not install or supervise that
 service. Production Microsoft and Google account registration and live
-mail/calendar writes are disabled in `v1.2.0`; offline connector contracts do
+mail/calendar writes are disabled in `v1.3.0`; offline connector contracts do
 not authorize a production account or external write.
 
 ## What can be included in a model request

diff --git a/README.md b/README.md
@@ -11,8 +11,8 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.2.0">v1.2.0 stable</a> ·
-  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe">Download for Windows</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.3.0">v1.3.0 stable</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.3.0/DS.Agent_1.3.0_x64-setup.exe">Download for Windows</a> ·
   <a href="LICENSE">Apache-2.0</a>
 </p>
 
@@ -132,10 +132,13 @@ does not claim completion from model confidence alone. Local files, browser
 actions, Office artifacts, and Computer Use are complete only when observable
 evidence satisfies the task's completion criteria.
 
-In v1.2.0, DeepSeek may propose a bounded `GoalEnvelope`, but only the local
-Kernel can validate and freeze it. The chat UI shows a read-only projection;
-completion remains blocked until locally authoritative verifier evidence covers
-every frozen `done_when` condition and required artifact identity.
+In v1.3.0, DeepSeek may propose a bounded `GoalEnvelope`, but only the local
+Kernel can validate and freeze it. For the same queued task, the Kernel alone
+derives the capability manifest, risk, and preview shown in one exact-task
+authorization card. Approval creates only exact authority; it does not execute
+a Tool, resume the task, or mark the Goal complete. Completion remains blocked
+until locally authoritative verifier evidence covers every frozen `done_when`
+condition and required artifact identity.
 
 ## DeepSeek and DS Agent boundary
 
@@ -160,7 +163,7 @@ high-risk action. See the full [model boundary](docs/AGENT_MODEL_BOUNDARY.md).
   reconciliation contracts validated with offline adversarial fake providers.
 
 Production Microsoft/Google account registration and live external-write
-authority remain disabled in v1.2.0. The release does not sign in to real
+authority remain disabled in v1.3.0. The release does not sign in to real
 accounts, send real email, or create, change, or cancel real calendar events.
 
 ## Why Rust
@@ -173,7 +176,7 @@ remain thin; the Kernel and persistent projections own business state.
 
 ## Quick start
 
-1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe).
+1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.3.0/DS.Agent_1.3.0_x64-setup.exe).
 2. Enter your own valid DeepSeek API key in onboarding and run the explicit
    balance/model verification. The key is stored locally with Windows DPAPI.
 3. Choose one local workspace and let the readiness doctor verify its managed
@@ -185,18 +188,18 @@ A user-supplied DeepSeek API key is a required prerequisite. DS Agent does not
 bundle a shared key or bypass DeepSeek access requirements; use remains subject
 to DeepSeek's terms and account policies.
 
-The v1.2.0 application executable and installer are Authenticode `NotSigned`.
+The v1.3.0 application executable and installer are Authenticode `NotSigned`.
 Windows may display `Unknown publisher` or a Microsoft Defender SmartScreen
 warning. Download only over HTTPS from this repository, verify the SHA-256 in
 the GitHub Release, and read the [installation guide](docs/INSTALLATION.md)
 before running the installer.
 
 ## Code signing policy
 
-DS Agent `v1.2.0` is intentionally unsigned. The SignPath Foundation application
+DS Agent `v1.3.0` is intentionally unsigned. The SignPath Foundation application
 is submitted and approval is pending; no release is represented as signed.
 If the project is accepted, signing starts with a later new version and does not
-replace the immutable v1.1.0 or v1.2.0 tag or asset. For releases accepted into the program:
+replace the immutable v1.1.0, v1.2.0, or v1.3.0 tag or asset. For releases accepted into the program:
 **Free code signing provided by SignPath.io, certificate by SignPath
 Foundation.** See the full [code signing policy](CODE_SIGNING_POLICY.md) and
 [privacy policy](PRIVACY.md).
@@ -214,8 +217,8 @@ example `D:\build-target\ds-agent-v1-release`.
 
 ## Stable release
 
-- Release: [DS Agent v1.2.0](https://github.com/Lee-take/dsagent/releases/tag/v1.2.0)
-- Installer: `DS.Agent_1.2.0_x64-setup.exe`
+- Release: [DS Agent v1.3.0](https://github.com/Lee-take/dsagent/releases/tag/v1.3.0)
+- Installer: `DS.Agent_1.3.0_x64-setup.exe`
 - Integrity: verify the final byte size and SHA-256 published in the GitHub
   Release before running the installer.
 - Onboarding: one user-supplied Key, Windows DPAPI storage, explicit DeepSeek
@@ -226,12 +229,16 @@ example `D:\build-target\ds-agent-v1-release`.
 - Goal contract: bounded model proposal, Kernel validation/freeze, read-only UI
   state, and fail-closed evidence coverage for every completion condition and
   required artifact.
+- Task authorization: one Kernel-derived exact-task card with manifest/risk/
+  preview binding, one user decision, per-capability audit, and exact revocation;
+  approval does not execute or resume the task.
 
 ## Documentation
 
 - [Installation](docs/INSTALLATION.md)
 - [DS Agent and DeepSeek boundary](docs/AGENT_MODEL_BOUNDARY.md)
 - [v1 architecture](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md)
+- [v1.3.0 release notes](docs/RELEASE_NOTES_v1.3.0.md)
 - [v1.2.0 release notes](docs/RELEASE_NOTES_v1.2.0.md)
 - [v1.1.0 release notes](docs/RELEASE_NOTES_v1.1.0.md)
 - [v1 completion audit](docs/DS_AGENT_V1_COMPLETION_AUDIT.md)

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -11,8 +11,8 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.2.0">v1.2.0 正式稳定版</a> ·
-  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe">下载 Windows 安装包</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.3.0">v1.3.0 正式稳定版</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.3.0/DS.Agent_1.3.0_x64-setup.exe">下载 Windows 安装包</a> ·
   <a href="LICENSE">Apache-2.0</a>
 </p>
 
@@ -118,9 +118,11 @@ Kernel 会持久保存任务和审核状态，只对失败步骤进行有边界
 宣告完成。本地文件、浏览器操作、Office 产物和 Computer Use，只有在可观察证据满足任务
 完成条件后才算真正完成。
 
-在 v1.2.0 中，DeepSeek 可以提出有界 `GoalEnvelope`，但只有本地 Kernel 能校验并冻结它。
-聊天界面只显示只读投影；只有本地权威 verifier 证据覆盖冻结目标的全部 `done_when` 和
-必需产物身份后，任务才可能进入完成状态。
+在 v1.3.0 中，DeepSeek 可以提出有界 `GoalEnvelope`，但只有本地 Kernel 能校验并冻结它。
+对于同一个排队任务，也只有 Kernel 能派生 capability manifest、风险和 preview，并显示为
+一张 exact-task 授权卡。批准只产生精确权限，不会执行 Tool、恢复任务或把 Goal 标记为完成；
+只有本地权威 verifier 证据覆盖冻结目标的全部 `done_when` 和必需产物身份后，任务才可能
+进入完成状态。
 
 ## DeepSeek 与 DS Agent 的工作边界
 
@@ -142,7 +144,7 @@ DeepSeek 可以提出动作，DS Agent 决定动作是否安全、是否允许
 - 已通过离线对抗性 fake provider 验证的 Microsoft/Google 形态邮件、日历、同步、草稿、
   外部变更和对账契约。
 
-v1.2.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限。当前正式版不会登录
+v1.3.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限。当前正式版不会登录
 真实账号、发送真实邮件，也不会创建、修改或取消真实日历事件。
 
 ## 为什么使用 Rust
@@ -153,7 +155,7 @@ command 与 React UI 保持薄层，业务状态由 Kernel 和持久投影统一
 
 ## 快速开始
 
-1. 下载 [Windows x64 安装包](https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe)。
+1. 下载 [Windows x64 安装包](https://github.com/Lee-take/dsagent/releases/download/v1.3.0/DS.Agent_1.3.0_x64-setup.exe)。
 2. 在首次设置中输入你自己的有效 DeepSeek API Key，并显式验证余额和模型；Key 使用
    Windows DPAPI 保存在本机。
 3. 选择一个本地工作目录，由 readiness doctor 检查受管目录和可写状态。
@@ -163,16 +165,16 @@ command 与 React UI 保持薄层，业务状态由 Kernel 和持久投影统一
 用户自行提供有效的 DeepSeek API Key 是必备前提。DS Agent 不内置共享 Key，也不会
 绕过 DeepSeek 的访问条件；实际使用仍须遵守 DeepSeek 的服务条款和账号规则。
 
-v1.2.0 应用程序和安装包的 Authenticode 状态均为 `NotSigned`。Windows 可能显示
+v1.3.0 应用程序和安装包的 Authenticode 状态均为 `NotSigned`。Windows 可能显示
 `Unknown publisher`（未知发布者）或 Microsoft Defender SmartScreen 警告。请只通过
 本仓库的 HTTPS 链接下载，运行前核对 GitHub Release 中的 SHA-256，并阅读
 [安装指南](docs/INSTALLATION.md)。
 
 ## Code signing policy（代码签名政策）
 
-DS Agent `v1.2.0` 是如实披露的未签名版本。SignPath Foundation 申请已经提交、仍在等待
+DS Agent `v1.3.0` 是如实披露的未签名版本。SignPath Foundation 申请已经提交、仍在等待
 审批，本版本不会被描述为已签名。若以后获批，只从后续新版本开始签名，不替换本版本不可
-移动的 tag 或资产，也不改写 v1.1.0。获准加入该计划的 Release 将遵循：**Free code signing provided by
+移动的 tag 或资产，也不改写 v1.1.0 或 v1.2.0。获准加入该计划的 Release 将遵循：**Free code signing provided by
 SignPath.io, certificate by SignPath Foundation.** 完整说明见
 [代码签名政策](CODE_SIGNING_POLICY.md)和[隐私政策](PRIVACY.md)。
 
@@ -189,21 +191,24 @@ npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop tauri:dev
 
 ## 正式稳定版
 
-- Release：[DS Agent v1.2.0](https://github.com/Lee-take/dsagent/releases/tag/v1.2.0)
-- 安装包：`DS.Agent_1.2.0_x64-setup.exe`
+- Release：[DS Agent v1.3.0](https://github.com/Lee-take/dsagent/releases/tag/v1.3.0)
+- 安装包：`DS.Agent_1.3.0_x64-setup.exe`
 - 完整性：运行安装包前，核对 GitHub Release 中发布的最终字节数和 SHA-256。
 - 首次设置：单一用户 Key、Windows DPAPI 本机存储、显式 DeepSeek 余额/V4 模型验证、
   无密 readiness 和 workspace doctor。
 - 兼容性：既有 workspace 设置继续可读；环境 Key 需要显式验证；不会重写历史会话或
   connector vault。
 - 目标契约：有界模型提议、Kernel 校验/冻结、只读 UI 状态，以及覆盖全部完成条件和
   必需产物身份的 fail-closed 证据门。
+- 任务授权：一张由 Kernel 派生并绑定 manifest/risk/preview 的 exact-task 卡片、一次用户
+  决策、逐能力审计和精确撤销；批准不会执行或恢复任务。
 
 ## 文档
 
 - [安装指南](docs/INSTALLATION.md)
 - [DS Agent 与 DeepSeek 的工作边界](docs/AGENT_MODEL_BOUNDARY.md)
 - [v1 架构计划](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md)
+- [v1.3.0 发布说明](docs/RELEASE_NOTES_v1.3.0.md)
 - [v1.2.0 发布说明](docs/RELEASE_NOTES_v1.2.0.md)
 - [v1.1.0 发布说明](docs/RELEASE_NOTES_v1.1.0.md)
 - [v1 完成审计](docs/DS_AGENT_V1_COMPLETION_AUDIT.md)

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,6 +1,6 @@
 # Security Policy
 
-DS Agent is a local-first Windows desktop agent. DS Agent v1.2.0 is the current
+DS Agent is a local-first Windows desktop agent. DS Agent v1.3.0 is the current
 published stable release and is not an official DeepSeek product. Security
 reports are welcome, especially around local credentials, permission gates,
 audit records, Computer Use boundaries, update integrity, code signing, and
@@ -10,6 +10,7 @@ package import/export behavior.
 
 | Version | Supported |
 | --- | --- |
+| 1.3.0 | Supported |
 | 1.2.0 | Supported |
 | 1.1.0 | Supported |
 | 1.0.2 | Supported |
@@ -31,7 +32,7 @@ Include:
 
 ## Security Boundaries
 
-- Current stable v1.2.0 stores one user-supplied DeepSeek API key in a dedicated
+- Current stable v1.3.0 stores one user-supplied DeepSeek API key in a dedicated
   Windows DPAPI vault. A process-environment key is an explicit compatibility
   fallback and is not copied into the vault. Presence alone is never treated as
   verified readiness; balance and required V4 model checks produce only a
@@ -43,6 +44,12 @@ Include:
   text, frontend state, approval state, or artifact existence cannot directly
   mark a goal complete; stale, unknown, failed, duplicate, mismatched, or
   incomplete evidence fails closed.
+- A model-returned capability proposal is descriptive only. The Kernel binds it
+  to the exact frozen task/Goal, derives the manifest/risk/preview, and persists
+  one grouped authorization. Approval/rejection/revocation bind the exact task,
+  group, projection, manifest, preview, revision, fingerprint, hash, scopes,
+  targets, and expiry. Approval grants only exact authority; it does not execute
+  a Tool, resume a task, or mark a Goal complete.
 - `pnpm test:secrets` scans tracked and unignored repository files for live
   `sk-` style keys and non-empty `DEEPSEEK_API_KEY` assignments without printing
   candidate values.
@@ -57,7 +64,7 @@ Include:
   memory.
 - Release identity must follow the [code signing policy](CODE_SIGNING_POLICY.md).
   An unsigned or invalidly signed artifact must not be represented as a signed
-  release. DS Agent v1.2.0 is explicitly disclosed as Authenticode `NotSigned`;
+  release. DS Agent v1.3.0 is explicitly disclosed as Authenticode `NotSigned`;
   Windows may show `Unknown publisher` or a Microsoft Defender SmartScreen
   warning. See also the [privacy policy](PRIVACY.md).
 

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-agent-os/desktop",
   "private": true,
-  "version": "1.2.0",
+  "version": "1.3.0",
   "author": "Lee take",
   "license": "Apache-2.0",
   "type": "module",

diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
@@ -1,11 +1,14 @@
 [package]
 name = "deepseek-agent-os-desktop"
-version = "1.2.0"
+version = "1.3.0"
 description = "Local-first DeepSeek AI work platform"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Lee take"]
 
+[profile.release]
+strip = "symbols"
+
 [build-dependencies]
 tauri-build = { version = "2.2.0", features = [] }
 

diff --git a/apps/desktop/src-tauri/nsis/shortcut-icons.nsh b/apps/desktop/src-tauri/nsis/shortcut-icons.nsh
@@ -1,3 +1,9 @@
+!macro NSIS_HOOK_PREINSTALL
+  ; Do not embed source-file mtimes in the NSIS data block. The application PE
+  ; and checked-in resources are content-bound; timestamps are not identity.
+  SetDateSave off
+!macroend
+
 !macro NSIS_HOOK_POSTINSTALL
   !if "${STARTMENUFOLDER}" != ""
     Delete "$SMPROGRAMS\$AppStartMenuFolder\${PRODUCTNAME}.lnk"
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		[target.x86_64-pc-windows-gnu]
		rustflags = ["-C", "link-arg=-Wl,--no-insert-timestamp"]