DSH SUPREME v1.2

Seven host-side policy plugins for DeepSeek Harness (DSH), composed through DSH's vendored Cordis runtime — installable as a dsh bundle since v1.1, with deterministic enforcement features (unicode-taint denial, RM0-first routing, surgical path scope, note ledger, reasoning-trace audit) since v1.2.

DSH Supreme adds governance — cost/risk policy, observability, benchmark evidence, model routing, deterministic verification, memory selection policy, and workflow limits — without modifying a single line of the pinned upstream. Every Supreme plugin is an ordinary Cordis plugin (name / inject / Config / apply(ctx, config)) that mounts next to the DSH core and consumes official DSH services and event seams.

Authoritative record: SOURCE-OF-TRUTH.md records the build's upstream basis. The historical "upstream absent" gate recorded there was unblocked during Task 2: the real upstream was located, cloned, and pinned. See Pinned upstream below — this README documents only behavior verified against that pin.

Pinned upstream

Item	Value
Repository	`https://github.com/deepseek-ai/deepseek-harness`
Pinned commit	`d347e703908d0406b7a7ef80e3a0e594d86b2215` (master, tag `dsh-v0.1.3-alpha.1`)
DSH version	`0.1.3-alpha.1`
Vendored Cordis	`4.0.2` (`vendor/cordis`)
Upstream worktree	kept pristine — `UPSTREAM_CORE_MODIFIED = NO`, patch count `0`
Toolchain	Node v24 (v24.19.0), pnpm 11.7.0, Bun 1.3.14 (bundler)

The pinned upstream checkout is read-only for this project. It is resolved at runtime: DSH_UPSTREAM_ROOT env override → sibling ../deepseek-harness → in-project node_modules/.upstream/deepseek-harness. Prefer the sibling location: some upstream builds (pnpm + declaration emit) reject checkouts nested under a node_modules directory. All Supreme code lives in project-owned paths.

Frozen plugin scope

Exactly seven Supreme policy plugins. This scope is frozen (see AGENTS.md); no new Supreme plugins may be added without a proven blocker.

#	Plugin (directory)	Provided service	Purpose
1	`supreme-policy`	`supremePolicy`	Cost-class / risk / delegation admission. UNKNOWN cost ⇒ DENY, hard rule. Paid/trial overrides are LAB-only.
2	`supreme-observability`	`supremeObservability`	Append-only JSONL metadata log over official DSH event seams. Allowlisted fields, secret-sentinel scrub, fail-open.
3	`supreme-benchmark`	`supremeBenchmark`	Reproducible task/run/score evidence as JSONL; per-model aggregation consumed by the router.
4	`supreme-router`	`supremeRouter`	Deterministic route selection: 8 hard gates → normalized weighted scoring. No paid fallback.
5	`supreme-verifier`	`supremeVerifier`	Deterministic validator registry (exact-text, regex, JSON, file, command). Evidence > model self-confidence.
6	`supreme-memory-policy`	`supremeMemoryPolicy`	Memory selection policy only. DSH `ctx.sessions` stays canonical; NOOP long-term provider is a legitimate state.
7	`supreme-workflow-policy`	`supremeWorkflowPolicy`	When/how `ctx.subagents` / `ctx.workflowEngine` may be used: limits, degradation ladder, `DENY_ALL` secret policy.

Four support plugins (not part of the frozen seven, fixture-classified, no model-facing tools):

Plugin	Role
`supreme-minimal-probe`	Task 2 real-loader gate: writes `MINIMAL_PLUGIN_LOAD` / `MINIMAL_PLUGIN_OBSERVABLE_EFFECT` / `MINIMAL_PLUGIN_DISPOSE` markers.
`supreme-boot-probe`	Writes a `BOOT_PROBE` marker ~600 ms after activation listing which services exist in the real booted context.
`supreme-gate-driver`	Runs the keyless synthetic end-to-end scenario and writes the 9 `SUPREME_GATES` results (supreme/lab compositions).
`supreme-fake-llm`	LAB-only scripted LLM adapter (`synthetic-free`) registered through the official `ctx.llm.registerAdapter()` seam.

Verified status

Claims below are backed by executable gates. Re-run them with the suite (next section); do not trust prose.

Level A unit checks      61/61 PASS   (policy 9 · observability 6 · benchmark 6 · router 13
                                       verifier 7 · memory 9 · workflow 11)
Real-loader boots        5/5 PASS     (supreme-minimal, core, standard, supreme, lab)
  boot times             supreme-minimal ~55 ms · core/standard/supreme/lab ~750–1000 ms
  dispose                ~20–30 ms, clean root-fiber unwind
Keyless scenario         9/9 gates PASS in supreme + lab (real DSH session created;
                         router selects synthetic free route; PAID candidate rejected
                         by policy_cost)
Security                 sentinel leaks = 0 · paid automatic fallback = DISABLED ·
                         production configs never set allowPaid
v1.2 audit gates         config-key hygiene PASS · pinned-ref scan PASS ·
                         six-surface audit PASS (prompts/hooks/mcp/permissions/secrets/
                         agent_files) · schema contract PASS (3 published schemas)
Bundle E2E               BUNDLE_E2E_COMPLETE (real CLI install, 13 services,
                         user-patch override wins, upstream untouched)
Compositions E2E         COMPOSITIONS_E2E_COMPLETE (4 fragments, presence+absence,
                         relative dataDir write-through)
Config-surface E2E       V3_CONFIG_REVIEW_EVIDENCE + V12_E2E_COMPLETE (every v1.2
                         config key arrives at its service — no silent strip)
Upstream integrity       commit unchanged, worktree clean, patches = 0
Performance              router decision ~0.02 ms / 1k iterations ·
                         observability serialize ~0.003 ms / 1k
VERDICT                  COMPLETE (suite runner, per Spec §34)

Important honesty rule: the real-loader path via real/boot.mjs is the only real-integration evidence. The Level-A lifecycle harness under src/harness/cordis-mini is a fixture that exercises plugin lifecycles; it never proves DSH compatibility and is never cited as such.

Quick start

Prerequisites: Node ≥ 24, pnpm 11.7.0 (upstream build), Bun ≥ 1.3. Commands below assume the repo root (dsh-supreme/ as published; inside the companion Next.js workspace the suite auto-detects both layouts).

# 1. Install dependencies
bun install

# 2. Clone the pinned DSH upstream (default lookup: sibling ../deepseek-harness;
#    any location works via DSH_UPSTREAM_ROOT — avoid nesting it under node_modules)
git clone https://github.com/deepseek-ai/deepseek-harness.git ../deepseek-harness
git -C ../deepseek-harness checkout d347e703908d0406b7a7ef80e3a0e594d86b2215

# 3. Build the pinned upstream libraries — official tsconfig graph, memory-batched
#    per reference (one tsc -b over the 217-ref host graph needs ~4 GB headroom;
#    the batched runner keeps each invocation under 2 GB)
npm run build:upstream

# 4. Bundle every Supreme plugin to dist/ (one ESM file per plugin; zod external)
PLUGINS="supreme-policy supreme-observability supreme-benchmark supreme-router \
supreme-verifier supreme-memory-policy supreme-workflow-policy \
supreme-minimal-probe supreme-boot-probe supreme-gate-driver supreme-fake-llm"
for p in $PLUGINS; do
  bun build src/plugins/$p/index.ts \
    --outfile dist/plugins/$p/index.mjs \
    --format esm --target node --external zod
done

Each dist bundle externalizes only zod and Node builtins; @deepseek-ai/cordis appears solely as erased type imports. This exact command was verified to reproduce the committed dist/plugins/supreme-policy/index.mjs byte-for-byte.

Real boot (the only real-integration evidence)

# Boot any composition through the REAL pinned DSH Loader and dispose cleanly.
# --setup installs the profile under $DSH_HOME/profiles// from config/.
node real/boot.mjs --profile supreme-minimal --setup
node real/boot.mjs --profile core         --setup
node real/boot.mjs --profile standard     --setup
node real/boot.mjs --profile supreme      --setup
node real/boot.mjs --profile lab          --setup

Each run prints one JSON result (bootMs, disposeMs, services presence map, gate results) and exits non-zero on any failure. Gate markers are appended under data/real/ — see the runbooks for expected markers per profile.

Suite execution

bun run suite            # full suite incl. 5 real boots (needs the built upstream)
bun run suite:json       # machine-readable SuiteReport
bun run suite:keyless    # Level A only — runs without the upstream; verdict stays
                         # PARTIAL (REAL_BOOT_SKIPPED, UPSTREAM_CHECKOUT_UNAVAILABLE)

The suite exits 0 only when every mandatory gate passes (verdict: COMPLETE). Any failure prints the exact blocking gates.

v1.2 governance features (deterministic, no ML, no new deps)

Every feature binds to a REAL pinned upstream seam and ships with engine checks plus boot-level proof (bun run v12:verify).

supreme-policy — unicode taint denial + chain-of-thought presence gate

Upstream freezes tool arguments after logging (wrappers may change only exec.signal), so the enforceable host-side posture is detect → audit → deny through the official tools/pre-execute seam ({ kind: 'deny', reason } materializes an upstream error result — policy never fabricates tool output):

Config key	Default	Meaning
`enableUnicodeSanitization`	`true`	scan tool arguments for zero-width / bidi-isolate / bidi-override / tag codepoints (U+200B–200F, U+2060–206F, U+202A–202E, U+FEFF, U+E0000–E007F)
`logTaintAttempts`	`true`	record `taint_detected` observability events — class names only, values are NEVER echoed
`taintPolicy`	`LOG_ONLY`	`DENY` refuses the call before dispatch
`reasoningTracePolicy`	`OFF`	`AUDIT` records `cot_missing` when an assistant message carried no reasoning trace; `ENFORCE` additionally denies that session's tool calls (evidence source: pinned `assistant/message` reasoning blocks + reasoning-chunks stream records; `ENFORCE` is refused on the CORE floor)

supreme-router — RM0-first + deterministic effort pacing

Config key	Default	Meaning
`costFirst`	`true`	among eligible candidates, score only the cheapest cost class (`FREE_CONFIRMED` beats a rate-limited peer with better benchmark history). Hard-gate evidence for ALL candidates is preserved; set `false` for pure weighted scoring
`effortPacing.enabled`	`false`	deterministic `costClass → reasoningEffort` mapping over the pinned `agent/request` seam (`LlmCallConfig.reasoningEffort` may be overridden upstream). Levels are the pinned DeepSeek adapter set: `off / low / high / max`
`effortPacing.escalateOnVerifierFail`	`true`	one-step escalation (`low → high`) driven ONLY by verifier FAIL evidence via `reportVerifierOutcome()` — never model self-confidence; a PASS recovers

supreme-workflow-policy — surgical path scope + verifier-gated close

Config key	Default	Meaning
`allowedPaths` / `blockedPaths`	`[]` / `[]`	zero-dependency glob scope for delegations (`*` crosses segments, ``/`?` stay in-segment); `blockedPaths` always win; empty allowlist = unrestricted
`requireVerifierPassOnClose`	`false`	HIGH-risk tasks may only close with recorded verifier PASS evidence — the honest posture for STANDARD (where the verifier cannot execute commands)

supreme-memory-policy — bounded note ledger + instinct-style injection gates

Config key	Default	Meaning
`ledgerEnabled`	`false`	opt-in bounded, append-only JSONL note ledger (`ledgerDir`, `ledgerFileName`, `ledgerMaxEntries`) — credential-bearing notes are rejected at admission
`minConfidence`	`0.7`	notes below this confidence never inject (ECC instincts analogue — recorded evidence quality, not model self-assessment)
`maxInjected`	`6`	hard cap on injected notes per selection
`relevanceRanking`	`true`	deterministic task-token-overlap ranking before priority (no ML, no ANN — counting)

supreme-benchmark — provenance binding

Run records accept commitHash (40-hex sha or UNAVAILABLE) and irVersion — malformed values are rejected by record validation, so routing evidence stays bound to the code that produced it.

Published schemas + six-surface audit

schemas/suite-report.schema.json, schemas/benchmark-record.schema.json, schemas/ledger-note.schema.json — third parties can validate reports/records; a suite check keeps the schemas and the code from drifting.
The suite now also runs a config-key hygiene scan (every shipped YAML row validated against the plugin's real zod schema — the silent-strip trap stays closed), a pinned-ref scan (external references must be pinned), and the six-surface security audit (prompts · hooks · mcp · permissions · secrets · agent_files — the offline AgentShield analogue).
v1.2 fix: running bun run suite from INSIDE dsh-supreme/ no longer fakes UPSTREAM_CHECKOUT_UNAVAILABLE (root resolution order fixed).

Install as a dsh bundle (v1.1)

The repository IS the bundle: package.json declares dsh.bundle.patch → cordis.patch.yml, which inserts the seven frozen plugins as profile rows. Any profile can adopt Supreme through the official plugin flow:

# from a local checkout…
dsh plugin --profile  add /path/to/dsh-supreme
# …or straight from GitHub
dsh plugin --profile  add github:stadeummwt/dsh-supreme

# prove an install end-to-end (runs the real CLI install + boot + layering checks)
bun run bundle:verify
# prove the v1.2 config surface end-to-end (real CLI install + every v1.2 key + functional probes)
bun run v12:verify

The bundle mounts the seven plugins with safe production defaults (PAID/TRIAL denied, commands/network off, zero router candidates). Extend candidates, project knowledge, and workflow limits from YOUR profile patch layer — the composer applies last write wins per row id, so user config always beats bundle defaults. The four support/fixture plugins (supreme-minimal-probe, supreme-boot-probe, supreme-gate-driver, supreme-fake-llm) are NOT part of the bundle: they are test fixtures for the suite and never ship into user profiles.

Composition fragments (pick a profile in one line)

The four v1 compositions ship as ready-made overlay fragments under config/compositions/ — the bundle-world analogue of manifest-driven install profiles. Each fragment UPDATE-patches the bundle rows by id (whole-config replacement, disabled: true for rows outside the composition) and carries no name restatement, so it stays install-location-independent:

Fragment	Rows active
`core.patch.yml`	policy only (governance floor)
`standard.patch.yml`	policy · observability · memory-policy · verifier
`supreme.patch.yml`	all seven (+ synthetic keyless router candidates)
`lab.patch.yml`

dsh-supreme

AI 分析

安装

说明文档