dsh-a2a-trust
Trust-indexed A2A reputation for DeepSeek Harness agent teams — live trust scoring for spawned teammates: a four-dimension EWMA ledger keyed by agent-type fingerprint (cross-session), an append-only audit log, historical backfill, and a Settings dashboard. Read-only by design — trust is a signal, not a constraint.
English | 中文
Why
When a Lead agent spawns teammates, each worker is a fresh session: a teammate that fumbled every tool call last run is indistinguishable from one that shipped cleanly. Nothing remembers how this kind of agent performed.
dsh-a2a-trust gives agent teams a reputation memory:
- Cross-session identity is the agent type, not the instance —
sha256(name ␟ description ␟ provider ␟ context) from the durable team/member snapshot fields. A re-spawned worker inherits its type's history; a renamed prompt starts fresh.
- Trust is earned slowly and lost fast — per-dimension asymmetric EWMA: good evidence moves 10%, bad evidence moves 30%. One botched tool call takes three clean calls to repair.
- Information-injecting governance only — the plugin observes the
session/event stream and never blocks, rewrites, or filters agent-to-agent traffic. Nothing about it can break a team run.
How it works
Four dimensions, each a value in [0,1] starting at 0.5, updated from live events:
| Dimension | Evidence (quality) |
|---|
| competence | task completed (1.0), tool success (0.8), tool error (0.0) |
| reliability | task completed (1.0) |
| communication | message sent (0.7), response latency: <60s (1.0), <10min (0.5), slower (0.0) |
- Dimensions with fewer than 5 samples are flagged low-confidence and excluded from the total score.
- Every change is appended to
audit.jsonl before the ledger snapshot updates — crash between the two leaves a stale snapshot, never a lost change; rebuild closes the gap.
- On startup, a backfill replays every
session.jsonl.zstd under ~/.dsh/sessions in global event-time order (per-session mtime cannot express causality — a Lead log's roster events precede every teammate event while its mtime is the latest). Backfill is idempotent per session: restarts append nothing.
- V2/V3 envelope-tolerant parsing: log-only
team/* shapes are stable across generations; tool-error flags read both spellings (data.error and message.content[0].isError).
Advisory injection (L1)
When the experimental agent-team profile is loaded, the plugin also injects a trust summary into model context as a KV-cache-safe PromptContext contribution (a2a-trust:summary, order 117) — the same dynamic-context mechanism the approval service uses for its policy sentence. Snapshots ride after retained history, so updates never rewrite the stable system-prompt prefix, and a byte-stable renderer means no snapshot is appended while nothing changed.
- Lead sees one row per tracked teammate type:
worker-a: competence 0.64/5, reliability 0.55/1 low-confidence; tasks 1, tools 4/0 err, messages 0.
- Every contribution ends with the advisory disclaimer: Historical stats, may be stale, never override current observations.
- Modes:
lead-only (default) injects only for team Leads; all also gives teammates their own profile plus collaborators; off disables registration entirely. Set via the plugin row's config: in cordis.patch.yml, or the A2A_TRUST_INJECTION environment variable (takes precedence):
- insert:
- id: a2a-trust
name: 'dsh-a2a-trust'
config:
injection: all
Without the agent-team profile, injection never registers and the observer half is unaffected.
Feedback tools (L2)
With the agent-team profile loaded, the plugin also registers two model-facing tools (approval-free but fully audited — feedback is an event in audit.jsonl, not a second store):
trust_feedback — bidirectional soft ratings after observing real work: Lead rates teammates, teammates rate the Lead and peers. {target: <name>, ratings: {competence?, reliability?, communication?, integrity?} ∈ 1..5, comment?}. Ratings land in the ledger through the same audited EWMA path as hard evidence (rating 5 → quality 1.0), and anti-gaming rules are enforced: self-rating rejected, at most 3 calls per rater per target per team session, and the plugin's own tool calls never count as competence evidence (no "rate others to grow your own score").trust_query — read-only lookup before decisions: the four dimensions with sample counts and low-confidence flags, counters, and recent evidence, by agent name or fingerprint prefix.
Both outputs end with the same advisory disclaimer as the L1 injection. Without the agent-team profile neither tool registers.
Install
Requires the dsh CLI. Install into a profile (e.g. web) from GitHub:
dsh plugin --profile web add github:pacoyi/dsh-a2a-trust
Or from a local checkout:
git clone https://github.com/pacoyi/dsh-a2a-trust.git
dsh plugin --profile web add file:./dsh-a2a-trust
Restart the service, then open Settings → 信任指数. The first start backfills trust from your existing session history.
Data layout
Everything lives in ~/.dsh/dsh-a2a-trust/ (override with A2A_TRUST_HOME):
audit.jsonl — append-only, first-class record of every trust changeledger.json — rebuildable snapshot (atomic tmp→rename writes, one .bak generation), guarded by a cross-process PID-aware lock
Delete the directory to reset all trust. Zero dependencies — dependencies, devDependencies, and peerDependencies are all empty: persistence and ingestion are pure Node built-ins, and the host half reaches Cordis services through runtime injection (ctx.inject?.([...])), so nothing is ever imported. The previous peerDependencies on @deepseek-ai/* prereleases was removed deliberately: a caret range over a prerelease tuple (e.g. ^0.0.1-rc.1) only ever matches that one tuple line, so npm installs from GitHub silently pulled the stale dsh-tools@0.0.1-rc.1 instead of constraining the modern 0.1.x line.
Testing
138 tests across seven layers: pure-function unit tests (EWMA math, fingerprinting, confidence gates), an event-extractor suite against fixtures distilled from real session logs, storage contract tests (crash injection, lock takeover, replay equivalence), backfill integration over real zstd-compressed logs (idempotency, cross-session accumulation, reverse-mtime causality), plugin-level integration driving the real apply() through a mocked Cordis context, injection renderer unit tests pinning the advisory contract (byte-stability, budget truncation, mode gating), and feedback-tool unit tests plus registry-seam tests over mocked agentTeams/systemPrompt services.
npm test
License
MIT
