dsh-proof

Independent read-only acceptance layer for the DeepSeek Harness.

Before each top-level turn closes, dsh-proof spawns a read-only verifier subagent, collects its structured verdict, and steers any non-pass gaps back into the driving agent. It is the harness's missing "is the agent actually done" gate — no other plugin can substitute for it.

Install

dsh plugin --profile <name> add github:EvilIrving/dsh-proof

Or, from a checkout:

dsh plugin --profile <name> add ./dsh-proof

The bundle patch inserts one plugin row (dsh-proof); it needs the subagents service (the official dsh-subagent providers), which the base profile already mounts.

How it works

Step	Mechanism
Intercept "about to close"	agent/turn-stopping (serial, awaited before the turn commits)
Spawn a read-only verifier	ctx.subagents.start('spawn', …) with toolFilter.deny + outputSchema
Block recursion	delegationDepthOf(agent) > 0 filter + maxDepth: 0
Steer gaps back	agent.inject(gap details) + agent.steer(followup) on fail / insufficient-evidence

The verifier inherits the parent's tool set and is narrowed by the deny list (see deny list); it never sees a whitelist that could accidentally hide a newly added read-only tool. A verifier that ends with stopReason !== 'completed' or a missing structured result is treated as "no objection", so a failed proof never fails the user's turn.

Config

export interface Config {
  providerName: string          // default 'spawn'
  maxAttemptsPerTurn: number    // default 3
  denyTools: string[]           // default mutating-tool deny list
  verifierPrompt: string        // read-only acceptance instruction
  followupInstruction: string   // steering text after a failed verdict
}

Set any field from cordis.yml:

plugins:
  dsh-proof:
    config:
      maxAttemptsPerTurn: 2
      denyTools: [write, edit, str_replace_editor, bash, run_code, subagent]

Deny list

toolFilter.deny removes tools from the verifier's inherited full set. tools.restrict validates every name loudly, so denyTools must name tools the deployment actually registers. The default is write, edit, str_replace_editor, bash, run_code, subagent, which keeps read-only discovery tools (read, read_image, glob, grep) available. A deployment that adds its own mutating tools must extend the list; a deployment that forbids even shell/read access should switch to an explicit allow whitelist (set denyTools and verifierPrompt to match, or extend the plugin for an allowTools field).

Model Experience

Request context and condition

What the model sees

The top-level agent receives an injected user message listing the verifier's gaps and evidence, followed by the configured followupInstruction. Only a non-pass verdict injects anything; a passing turn adds nothing.

Token effect

Zero-direct effect on passing turns. A failing turn adds one bounded injected message (gaps + evidence) plus the short follow-up line.

KV Cache effect

Append-only: the injected context and follow-up are appended as new user messages, never rewriting earlier request tokens.

Known Limitations and Deferred Work

• Deny list must match the deployment's tools — tools.restrict fails loud on unknown names, so a mismatched default blocks verifier startup. The exact mutating-tool set is deployment-specific and is resolved at first install.
• No evidence normalization — the verifier gathers evidence itself; this plugin does not re-implement diff/test/typecheck/lint. A deployment wanting specific evidence channels should extend verifierPrompt.
• Best-effort spawn — a provider that is absent or rejects the request degrades to a no-op (logged), rather than failing the user's turn.