dsh-freeze
Hermetic composition lock for
DeepSeek Harness (dsh).
"Today's agent composition is byte-identical to the one you reviewed."
Fingerprints the booted profile — installed dependencies (name-sorted), the
ordered bundle composition, the pnpm lockfile hash, the user patch layer —
baselines it, and compares on every boot. A session running on a drifted
composition says so loudly; strict: true fails the boot entirely (the
--frozen posture for CI). Zero LLM calls in the trust path.
Family: ... mcp-test (what agents can call) · prompt-drift (what they are
told) · freeze (what exactly they are running).
Why now (checked 2026-10-12)
The supply-chain lane has seven install-time scanners and one read-only
plugin ledger (dsh-harbor) — all answer "is this package ok to install?"
Nobody answers "is the composition I'm running today the one that was
audited?" Spike-verified: dsh --dump-config is byte-stable across runs,
and profile files (package.json / pnpm-lock.yaml / cordis.patch.yml) are the
complete composition truth — a deterministic fingerprint is sound.
What moves the alarm
| field | meaning |
|---|
dependencies | a package was added/removed/retargeted |
bundles | the ordered composition changed |
pnpm-lock | resolved versions moved (upgrade!) |
cordis.patch.yml | the user layer changed |
Install
dsh plugin --profile default add github:zhengqiuyang/dsh-freeze
Prebuilt lib/ ships in the repo — git installs need no build step and no
allowBuilds authorization.
Configure
- id: dsh-freeze
name: dsh-freeze
config:
baselinePath: .dsh-freeze/baseline.json
strict: false # true: drift fails the boot (CI posture)
profile: "" # '' auto-detects from argv (--profile, else 'web')
Note: the baseline is written into the working directory of the session by
default; for CI, point it somewhere durable and commit it.
Develop
npm install && npm test
Kill criteria
If dsh ships first-party profile pinning (--frozen boot flag or
equivalent), this freezes at its last working version with a postmortem
here.
