Seven host-side policy plugins for DeepSeek Harness, composed through DSH's vendored Cordis runtime. Installable as a dsh bundle: dsh plugin --profile <name> add <this package>. Pinned upstream: deepseek-ai/deepseek-harness @ d347e703908d0406b7a7ef80e3a0e594d86b2215.
The plugin will be installed here. Keep web if you are unsure.
npx -y @deepseek-ai/dsh plugin --profile web add github:stadeummwt/dsh-supreme#08ebd146a733168a55856699843ffc2a53adaaeb
Compatibility and provenance
Supreme is published as dsh-supreme and currently resolves to version 1.3.3. The Hub verifies its manifest and preserves the exact installation source for reproducible installs.
DSH's plugin ecosystem (3,421 catalog entries reviewed, 2026-09) is rich in
single-domain tools — a router here, a memory store there, a verifier
somewhere else. Each solves one slice of governance and asks you to trust its
output.
Supreme is the opposite design. It is a full governance stack — cost
policy, observability, routing, verification, memory policy, workflow limits,
security audit — that treats proof as a product feature: every claim in
this README maps to a command you can run, and every hard rule (deny paths,
cost gates, secret scrubbing) is deterministic code, not model judgment.
The usual DSH plugin
DSH Supreme
Solves one domain
Seven governance domains, one install
"Trust the output"
Verdict gates — COMPLETE only when every check passes
Config verified by vibes
Config-key hygiene scan against real zod schemas (silent-strip trap closed)
Markdown evidence
Published JSON Schemas + append-only JSONL evidence stores
Touches core or monkey-patches
Zero upstream patches — pinned upstream, worktree clean, verified every run
Security as a README paragraph
Six-surface security audit (prompts · hooks · MCP · permissions · secrets · agent files) in CI
No ML dependency
Also no ML — deterministic counting, globs and comparisons only. Speed is a feature: router decision ≈ 0.02–0.03 ms / 1k iterations
The core rule of this repo:bukti sebenar > klaim — real evidence over
claims. If a statement here can't be re-run by you, it's marked as a claim,
not a fact.
⚡ 60-second install
The repository is a dsh bundle — no build
step needed (dist/ is committed):
That mounts all seven plugins with safe production defaults:
PAID / TRIAL routes → DENIED (hard rule, LAB-only override)
UNKNOWN cost class → DENIED
commands / network → OFF by default
router candidates → you add yours in your own patch layer (last write wins)
Zero-thought path: one command does everything
Don't want to think about environments, builds, or profiles at all? The
built-in operator CLI (zero dependencies) diagnoses, installs, composes and
boot-proves your setup:
node real/supreme.mjs doctor # what's missing? (prints a fix line per check)
node real/supreme.mjs setup # EVERYTHING: builds what's missing, runs the real
# `dsh plugin add`, applies the composition,
# boot-probes it → "SUPREME READY"
node real/supreme.mjs verify # full verification ladder, PASS/FAIL per gate
node real/supreme.mjs setup --composition standard # core|standard|supreme|lab
setup is idempotent and never modifies the upstream checkout. It will
clone + pin + build the pinned DSH upstream only if it is missing (skip with
--no-upstream-build).
v1.3.2 note (Windows): if an earlier version showed
bundle:verify … obs stats 0 or a composition:verify dataDir failure —
root cause found and fixed (store engines created their parent directory
with a POSIX-only separator check; on Windows every record write was
silently dropped). Re-run setup (rebuilds dist/), then re-run the
verifiers — they now also print full writer stats + an exact diagnosis
instead of a bare zero.
Pick a composition in one more line if you don't need all seven:
flowchart TB
subgraph SUP["Supreme plugin layer — project-owned, frozen 7"]
P["supreme-policy"]
O["supreme-observability"]
BM["supreme-benchmark"]
R["supreme-router"]
V["supreme-verifier"]
M["supreme-memory-policy"]
W["supreme-workflow-policy"]
end
subgraph CORE["DSH core — pinned upstream · never modified"]
C["ctx.llm · ctx.sessions · ctx.systemPrompt · ctx.tokenMeter · ctx.credentials · ctx.subagents · ctx.workflowEngine"]
end
P --> C
O --> C
BM --> C
R --> C
V --> C
M --> C
W --> C
P -. consults .-> V
P -. consults .-> R
P -. consults .-> W
O -. optional .-> V
O -. optional .-> W
BM -. history .-> R
V -. evidence .-> W
Four support plugins (supreme-minimal-probe, supreme-boot-probe,
supreme-gate-driver, supreme-fake-llm) exist only as test fixtures for
the suite — they never ship in the bundle.
Honesty rule: the real-loader path (real/boot.mjs) is the only
real-integration evidence. The Level-A harness under src/harness/cordis-mini
is a lifecycle fixture — it is never cited as DSH proof.
🔐 Security guarantees
Guarantee
Mechanism
Proof
Secrets never leak through observability
Secret-sentinel scrub on allowlisted fields, fail-open write path
suite: sentinelLeaks = 0 every run
Tainted tool arguments can't dispatch
Unicode class scan (zero-width / bidi / BOM / tag) + taintPolicy: DENY via upstream tools/pre-execute
V12_E2E_COMPLETE functional probe
Denying a command actually stops it
Deny-circumvention guard: same-shape retry of a denied call refused (deny_retry) — signature carries names/types, never values
V13_POLICY_E2E_COMPLETE probes
Hidden payloads can't ride in tool args
Encoding-blob scan (≥256-char base64/hex runs), class names + lengths only
Response to an external v1.3.0 review: 5 findings reproduced → fixed → proven
(each with a failing test on the original code), plus outcome-based routing,
evidence-bound verification, fast path/recovery, and a failure-injection
harness. Full per-issue evidence — reproduction commands, root causes, before/
after outputs, remaining limits, and rollback steps (bash + PowerShell) — lives
in docs/REVIEW-FIXES-v1.3.1.md.
#
Severity
Finding (v1.3.0)
Fix (v1.3.1)
A
P1
Paid/unknown-model LLM requests dispatched with no cost check
Pre-dispatch deny at agent/request + llm/stream backstop; zero adapter calls on deny; UNKNOWN denied in production RM0; LAB exception contract kept
B
P1
Symlink inside allowedRoots escaped the file-hash verifier
Native realpath validation of roots AND targets before any read; traversal/sibling-prefix/missing-file rejected; race reduced (not race-proof — documented)
C
P1
latestSelection shared across sessions/tasks (memory contamination)
Selections bound to (session, task); unknown identity → empty; bounded LRU + cleanup on end/cancel/dispose
D
P2
copy_file {target: b.txt} misclassified as agent-to-agent contact
Re-run yourself: bun real/bench-v131.mjs --label C --reps 1 → BENCH_C_THRESHOLDS_PASS
Astra (GPT-6): NOT_RUN — no verified public evaluation data; never
fabricated (research note). This is a
policy-enforcement benchmark, not a model-quality ranking.
🧬 v1.3 ASTRA-hardening features
Seven deterministic hardening features from the ASTRA-1 backlog
(research/gpt6-astra-2026-09.md §7).
No ML, no new deps — every feature is engine-checked in the keyless suite and
proven end-to-end by bun run v13:verify (real engines + real pinned-cordis
adapters). The shared label contract CapabilitySignal { capabilityClass?, cotVisibility? } is exported by supreme-policy and
carried (never enforced) by the router.
supreme-policy — four features (config table)
Config key
Default
Meaning
cotVisibilityProfiles
{}
routeId → expected CoT visibility. A route declared nonenever denies on cot_missing — ENFORCE downgrades to audit-only (empty-CoT models can't be coerced into producing a trace). Resolution: explicit signal > profile > verbose.
riskGatedCoT
false
ENFORCE applies only to HIGH-risk tools (deterministic command/network/write name classifier); non-HIGH tools keep AUDIT.
denyCircumventionGuard
true
A same-shape retry of an already-denied call is refused with reason code deny_retry. The signature encodes argument NAMES + TYPES only — values can never enter it. First calls unaffected; resetDenyCircumvention(sessionId) is the escape hatch.
enableEncodingScan
false
Audit/deny ≥256-char base64/hex runs in tool arguments (encoding_blob; argument NAME + run LENGTH only). Extends the v1.2 taint surface: same event, same taintPolicy.
Sanction lists; the LAB allowlist is additive and binds ONLY on the LAB floor. No implicit ROUTINE exemption — a self-declared label can only RESTRICT, never grant.
supreme-workflow-policy — two features (config table)
Config key
Default
Meaning
agentContactPolicy / allowedContacts
'LOG_ONLY' / []
A2A contact graph: directed { from, to } edges of agent ids/roles (empty = inert). Out-of-graph spawn/message contacts are audited as a2a_contact; under 'DENY' the pre-fact tools/pre-execute waterfall refuses with a2a_contact_denied. Emit-mode seams are DETECT-only.
maxRiskLevel / approvalRequiredFor
'HIGH' / []
Overreach audit: delegations above the risk ceiling, listed task classes without an approval flag, or paths outside the v1.2 scope are audited as overreach_suspected (labels, levels, flags, config globs — never content).
Score claims without verifier-PASS evidence are flagged evidenceBacked: false on the score + run (flag only — scores never rewritten; re-evaluated when verification lands late).
unscoredEvidenceWeight
router
1
FIXED multiplicative downweight for unevidenced benchmark claims (e.g. 0.5 halves such scores); ids + factors recorded on the decision + unscored_evidence events (ids only). 1 = off, back-compat.
—
router
—
Carries capabilityClass / cotVisibility labels from candidates onto the selected RouteDecision (carrier, not enforcer).
Composition fragments (v1.3 posture)
Fragment
v1.3 keys
core
denyCircumventionGuard: true pinned (the one default-ON); everything else inherits OFF defaults
Deterministic. No ML. No new runtime deps. Every feature binds to a real
pinned upstream seam and ships with engine checks + boot-level proof
(bun run v12:verify).
Upstream freezes tool arguments after logging (wrappers may change only
exec.signal), so the enforceable host-side posture is detect → audit →
deny through the official tools/pre-execute seam ({ kind: 'deny', reason } — upstream materializes the error result; Supreme never fabricates
tool output):
Config key
Default
Meaning
enableUnicodeSanitization
true
scan tool arguments for zero-width / bidi-isolate / bidi-override / tag codepoints (U+200B–200F, U+2060–206F, U+202A–202E, U+FEFF, U+E0000–E007F)
logTaintAttempts
true
record taint_detected events — class names only, values are NEVER echoed
taintPolicy
LOG_ONLY
DENY refuses the call before dispatch
reasoningTracePolicy
OFF
AUDIT records cot_missing when an assistant message carried no reasoning trace; ENFORCE additionally denies that session's tool calls (ENFORCE refused on the CORE floor)
supreme-router — RM0-first + effort pacing
Config key
Default
Meaning
costFirst
true
score only the cheapest eligible cost class — FREE_CONFIRMED beats a rate-limited peer with better history; hard-gate evidence for ALL candidates preserved
effortPacing.enabled
false
deterministic costClass → reasoningEffort mapping over the pinned agent/request seam (pinned DeepSeek levels: off / low / high / max)
effortPacing.escalateOnVerifierFail
true
one-step escalation (low → high) driven only by verifier FAIL evidence via reportVerifierOutcome() — never model self-confidence; PASS recovers
supreme-workflow-policy — surgical path scope + verifier-gated close
notes below this confidence never inject (ECC instincts analogue — recorded evidence quality, not self-assessment)
maxInjected
6
hard cap per selection
relevanceRanking
true
deterministic task-token-overlap ranking before priority (counting, not ANN)
supreme-benchmark — provenance binding + published schemas
Run records accept commitHash (40-hex sha or UNAVAILABLE) and irVersion
— malformed values are rejected by validation, so routing evidence stays bound
to the code that produced it.
Suite also runs config-key hygiene (every shipped YAML row validated
against the plugin's real zod schema — the silent-strip trap stays closed),
pinned-ref scan, and the six-surface security audit.
📦 Install as a dsh bundle
The repository IS the bundle: package.json declares dsh.bundle.patch →
cordis.patch.yml, which inserts the seven frozen
plugins as profile rows. Any profile can adopt Supreme through the official
plugin flow:
# from a local checkout…
dsh plugin --profile <your-profile> add /path/to/dsh-supreme
# …or straight from GitHub
dsh plugin --profile <your-profile> add github:stadeummwt/dsh-supreme
# prove an install end-to-end (real CLI install + boot + layering checks)
bun run bundle:verify
# prove the v1.2 config surface end-to-end
bun run v12:verify
# prove the v1.3 ASTRA-hardening features end-to-end (all three verifiers)
bun run v13:verify
The bundle mounts the seven plugins with safe production defaults (PAID /
TRIAL denied, commands/network off, zero router candidates). Extend
candidates, project knowledge, and workflow limits from YOUR profile patch
layer — the composer applies last write wins per row id, so user config
always beats bundle defaults. The four support/fixture plugins are NOT part of
the bundle: they never ship into user profiles.
Composition fragments ship under
config/compositions/ — the bundle-world analogue
of manifest-driven install profiles. Each fragment UPDATE-patches the bundle
rows by id (whole-config replacement, disabled: true for rows outside the
composition) and carries no name restatement, so it stays
install-location-independent. Prove all four end-to-end:
bun run composition:verify → COMPOSITIONS_E2E_COMPLETE.
Notes: dsh plugin add requires pnpm on PATH; installing from GitHub works
without a prepare build because dist/ is committed. Fragment paths are
relative to the dsh process working directory — override any row from your
own patch layer.
d347e703908d0406b7a7ef80e3a0e594d86b2215 (master, tag dsh-v0.1.3-alpha.1)
DSH version
0.1.3-alpha.1
Vendored Cordis
4.0.2 (vendor/cordis)
Upstream worktree
kept pristine — UPSTREAM_CORE_MODIFIED = NO, patch count 0
Toolchain
Node v24 (v24.19.0), pnpm 11.7.0, Bun 1.3.14 (bundler)
The pinned upstream checkout is read-only for this project. It is resolved
at runtime: DSH_UPSTREAM_ROOT env override → sibling ../deepseek-harness →
in-project node_modules/.upstream/deepseek-harness. Prefer the sibling
location: some upstream builds (pnpm + declaration emit) reject checkouts
nested under a node_modules directory. All Supreme code lives in
project-owned paths.
Prerequisites: Node ≥ 24, pnpm 11.7.0 (upstream build), Bun ≥ 1.3. Commands
assume the repo root (dsh-supreme/ as published; inside the companion
Next.js workspace the suite auto-detects both layouts).
# 1. Install dependencies
bun install
# 2. Clone the pinned DSH upstream (default lookup: sibling ../deepseek-harness;
# any location works via DSH_UPSTREAM_ROOT — avoid nesting it under node_modules)
git clone https://github.com/deepseek-ai/deepseek-harness.git ../deepseek-harness
git -C ../deepseek-harness checkout d347e703908d0406b7a7ef80e3a0e594d86b2215
# 3. Build the pinned upstream libraries — official tsconfig graph, memory-batched
# (one tsc -b over the 217-ref host graph needs ~4 GB headroom; the batched
# runner keeps each invocation under 2 GB)
npm run build:upstream
# 4. Bundle every Supreme plugin to dist/ (one ESM file per plugin; zod external)
PLUGINS="supreme-policy supreme-observability supreme-benchmark supreme-router \
supreme-verifier supreme-memory-policy supreme-workflow-policy \
supreme-minimal-probe supreme-boot-probe supreme-gate-driver supreme-fake-llm"
for p in $PLUGINS; do
bun build src/plugins/$p/index.ts \
--outfile dist/plugins/$p/index.mjs \
--format esm --target node --external zod
done
Each dist bundle externalizes only zod and Node builtins; @deepseek-ai/cordis
appears solely as erased type imports. This exact command was verified to
reproduce the committed dist/plugins/supreme-policy/index.mjs byte-for-byte.
Real boot (the only real-integration evidence)
# Boot any composition through the REAL pinned DSH Loader and dispose cleanly.
# --setup installs the profile under $DSH_HOME/profiles/<name>/ from config/.
node real/boot.mjs --profile supreme-minimal --setup
node real/boot.mjs --profile core --setup
node real/boot.mjs --profile standard --setup
node real/boot.mjs --profile supreme --setup
node real/boot.mjs --profile lab --setup
Each run prints one JSON result (bootMs, disposeMs, services presence
map, gate results) and exits non-zero on any failure. Gate markers are
appended under data/real/ — see the runbooks for
expected markers per profile.
Suite execution
bun run suite # full suite incl. 5 real boots (needs the built upstream)
bun run suite:json # machine-readable SuiteReport
bun run suite:keyless # Level A only — runs without the upstream; verdict stays
# PARTIAL (REAL_BOOT_SKIPPED, UPSTREAM_CHECKOUT_UNAVAILABLE)
bun run suite:keyless:ci # keyless with CI-friendly exit code: 0 iff verdict is PARTIAL
# with only the documented keyless blockers — any real
# failure (UNIT/leaks/hygiene/audit/schema) still fails
The suite exits 0 only when every mandatory gate passes (verdict: COMPLETE). Any failure prints the exact blocking gates.
HTTP API (dashboard projection — dev/LAB only)
The Next.js app exposes a thin, read-mostly projection over the suite. It owns
no runtime state; runs live in an in-memory store (latest 20 runs) and
suite execution is disabled in production (NODE_ENV=production returns 403
unless SUPREME_ENABLE_SUITE=1).
SUBMISSION-GUIDE.md — how listing on dsh-market actually works (it
auto-feeds from the awesome-dsh-plugin catalog), the pre-flight gate
checklist, the exact manual submission commands, and the npm-publish note.
The GitHub repo already carries the dsh-plugin topic and a dsh.bundle
manifest, so the only remaining step for listing is the manual one-file PR the
owner chooses to make.
No. The pinned upstream worktree stays pristine — UPSTREAM_CORE_MODIFIED = NO, patch count 0, re-verified on every suite run. Supreme is an ordinary
Cordis plugin layer that consumes official services and event seams.
Is any of this AI-powered?
None. Every gate is deterministic code — counting, glob matching, string
comparison, zod validation. That's why the router decides in ~0.02–0.03 ms and why
results are reproducible on your machine, today.
Why does UNKNOWN cost deny the model?
Because an unclassified route is an unaudited spend path. supreme-policy
treats it as a hard DENY; paid/trial classes require an explicit LAB-only
override. RM0-first routing then prefers FREE_CONFIRMED candidates
deterministically.
Can I use just the policy plugin?
Yes — that's the core fragment. Or
standard for the daily-driver
four. Fragments are one-line overlays on your own profile.
What if my config has a typo or an unknown key?
The v1.2 suite runs a config-key hygiene scan: every shipped YAML row is
validated against the plugin's real zod schema, so the "boot passes but your
governance keys were silently stripped" trap (proven live in
V3_CONFIG_REVIEW_EVIDENCE) stays closed.
Does it work offline / air-gapped?
The six-surface audit, taint scanning, ledger and all suite checks are fully
offline and deterministic. Real boots need the pinned upstream checked out
locally — no network calls at runtime.
Why isn't Supreme listed in the dsh-market yet?
Listing requires a one-file PR to the catalog, and this repo's policy is that
such PRs are made by the owner, manually (see
distribution/SUBMISSION-GUIDE.md).
Everything else is already prepared.
📜 Honest limitations
The real-loader path via real/boot.mjs is the only real-integration
evidence; the Level-A lifecycle harness (src/harness/cordis-mini) is a
fixture and is never cited as DSH proof.
Keyless suite verdict is honestly PARTIAL (REAL_BOOT_SKIPPED) without a
built pinned upstream — it does not fake completeness.
The benchmark measures policy enforcement (bypass/escape counts), not
model quality or intelligence; the Astra label is NOT_RUN by design until
verified public data exists.
Deferred items (documented, not forgotten): HNSW-style memory indexing and
Archify-style schema migration stay out of scope for the frozen seven.
Router candidates ship empty (zero-by-default): you add models from your own
patch layer. Supreme governs choices; it does not preselect providers.
