dsh-execution-fidelity-guard
用于 DeepSeek Harness 的执行保真防护包
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:rrrrrredy/dsh-execution-fidelity-guard#2a7f726637c38125a0629dda2da3ad7635bfaa4fExecution Fidelity Guard 以 dsh-execution-fidelity-guard 发布，当前版本为 0.1.0-alpha.2。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
An unofficial, buildless DeepSeek Harness bundle that checks a pending tool call against a small task contract and checks completion claims against current tool evidence.
It is deliberately narrower than a second agent loop. Planning, sandboxing, permissions, tool execution, conversation state, and the final user interaction remain owned by DeepSeek Harness.
Alpha compatibility target: DeepSeek Harness
v0.1.2-alpha.2. DeepSeek Harness is currently a developer preview and may make breaking changes.
| Situation | Result |
|---|---|
| Low-cost, reversible read | Continues silently |
| Weak or natural-language risk signal | Adds a model-visible reminder |
| Structured rule says the user must decide | Returns Harness-native ask |
| Structured rule deterministically forbids the action | Denies the current call in balanced mode |
| Assistant claims completion without required evidence | Steers one more verification step, at most twice |
No model call, network request, transcript upload, hidden-reasoning access, or telemetry is added by this package. Arguments are hashed in receipts rather than retained verbatim.
You can inspect the core policy and package without installing this bundle or DeepSeek Harness:
git clone https://github.com/rrrrrredy/dsh-execution-fidelity-guard.git
cd dsh-execution-fidelity-guard
npm test
npm run validate
npm run verify:pack
Those commands use the checked-in source and Node's standard library. They do not run npm install or change a Harness profile. The real ToolRuntime and AgentLoop integration suite runs in the six-job GitHub Actions matrix against the exact pinned Harness packages.
Pin the release or an exact commit:
dsh plugin --profile <profile> add github:rrrrrredy/dsh-execution-fidelity-guard#v0.1.0-alpha.2
dsh --profile <profile> --dump-config
The package ships JavaScript directly and has no prepare, install, or postinstall script. A Git install therefore needs no package build permission.
The bundled default is shadow. It observes deterministic conflicts and reminds the model without stopping the action. After reviewing shadow behavior, override the row in the profile's cordis.patch.yml to enable enforcement:
- insert:
- id: execution-fidelity-guard
name: dsh-execution-fidelity-guard
config:
mode: balanced
contractPath: .execution-fidelity/contract.json
maxContinuationAttempts: 2
Harness applies the profile patch after installed bundles. A later row with the same id replaces the whole configuration, so keep all three fields.
Remove it with:
dsh plugin --profile <profile> remove dsh-execution-fidelity-guard
Copy examples/contracts/no-local-install.json to .execution-fidelity/contract.json in the agent workspace and edit its seven fields:
objectiveprimary_objectdelivery_surfacescopemust_and_must_notauthorizationcompletion_evidenceDeterministic enforcement uses structured rules:
action:install_localaction:publishaction:destructivetool:<exact-tool-name>command-prefix:<exact-prefix>Natural-language constraints remain advisory. They never create a hard block by themselves.
authorization.allowed records a positive match; it is not an exhaustive allowlist. An unlisted action continues unless a matching rule also appears in authorization.forbidden, authorization.requires_user, or must_and_must_not.must_not. For example, allowed: ["action:read"] alone does not block workspace writes.
Completion evidence requirements use evidence:<kind> with one of file, command, test, api, real_page, or release. A current successful tools/result must match the requirement; a newer failure replaces an older pass for that requirement. Release evidence is intentionally narrow: only a direct successful gh release create or gh release view command satisfies evidence:release; git push, pull-request creation, and package publication do not.
| Field | Default | Meaning |
|---|---|---|
mode | shadow | off, shadow, or balanced |
contractPath | .execution-fidelity/contract.json | Absolute path or workspace-relative contract path |
maxContinuationAttempts | 2 | Completion-verification steering budget, from 0 to 2 |
Invalid configuration fails while the plugin loads. An absent or invalid contract leaves the Guard advisory; it does not invent authorization. Guard receipts remain bounded in memory in this alpha. Disk receipt persistence is disabled; a non-empty legacy receiptPath is rejected during plugin load.
tools/pre-execute: classifies bash on Linux/macOS and pwsh on Windows, then returns allow, deny, or native ask.ctx.tools.guard(): holds the deterministic owner veto after the extensible pre-execute waterfall.tools/result: observes the frozen authoritative outcome and records current evidence.agent/turn-stopping: inspects the current assistant message and can steer bounded verification.See integration contract, compatibility, and known limitations.
The repository has two test layers:
npm test # zero-dependency core tests
npm run test:integration # real DeepSeek Harness ToolRuntime and AgentLoop
npm run validate
npm run verify:pack
CI executes all layers on Windows, Ubuntu, and macOS with Node 22.19 and Node 24. Local installation is not required to inspect or run the core tests.
This alpha proves package shape, deterministic behavior for the covered action forms, real Harness composition, bounded continuation, privacy properties, and cross-platform execution when its CI is green. It does not yet prove the PRD's 100-task shadow or 800-task controlled efficacy targets. Those require real traffic and cannot be replaced by synthetic tests or another model's score.
Apache-2.0. DeepSeek Harness is a separate project with its own license and trademarks. This repository is not affiliated with or endorsed by DeepSeek.