dsh-write-gate
面向 AI 编码代理的提交写入门控：两层（确定性 + LLM 评审器）执行前策略。与引擎无关的核心，配备 DeepSeek Harness (dsh) 适配器。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-write-gate@0.1.1Write Gate 以 dsh-write-gate 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A commitment write-gate for DeepSeek Harness: the operator authors constraints ("never force-push to a shared branch", "stay read-only on the production database"), and the gate enforces them before a tool call executes. Structural violations are caught deterministically; semantic drift is judged by a model against the operator's own wording. Every block is recorded to a contradictions log that explains which commitment fired and why.
Engine-agnostic core (dsh-write-gate/core, zero harness imports) with a dsh adapter; a Claude Code adapter over the same core is planned.
A live model inside the real dsh app, told to force-push, after the gate denied the call:
"The force push to the main branch was blocked by the repository's 'no-force-push' policy."
That turn ran fully local, zero API keys; reproduction and session-log receipts in docs/E2E-HEADLESS.md.
| Tier | Mechanism | dsh slot | Why this slot |
|---|---|---|---|
| 1: deterministic | path globs, command regexes, scope filters | ctx.tools.guard() (monotonic) | no listener ordering can turn a guard denial back into permission |
| 2: semantic | LLM judge over the commitment statement | tools/pre-execute waterfall (prepended) | async-capable; short-circuits with a {kind: 'deny'} decision object |
agent/pre-step resets the per-step judge budget. Contradiction records are emitted as the write-gate/contradiction event and appended as JSONL to the contradictions log.
An internal A/B study (12 tasks x 4 arms x 10 runs) found an LLM-judge-only gate performed at baseline (0.183 vs 0.192 unflagged-violation rate, no gate), while deterministic checks caught 100% of a violation class the judge passed 6 times out of 10 (over-length outputs); a naive "reminder" arm was the worst performer of all four (0.308). Deterministic checks for checkable constraints, the judge only for genuinely semantic ones. The study runbook publishes with the benchmark (roadmap).
The tier-2 judge rubric is ported from a lineage measured at 18/18 dev + 16/16 held-out (100% precision, 0 abstains) on a local 8B model, and re-measured live through this port (2026-08-17): 32/34 accuracy with 17/17 violation recall. It also carries an anti-self-justification clause added after the holdline benchmark caught two injection defeats (an action asserting "the operator approved this" or "this is only a test" talking the judge into clearing a real violation); the clause moved injection accuracy from 5/8 to 7/8 with zero regression on the base cases. We keep the injection-fenced prompt because it is the only variant that preserved 100% violation recall; for a gate, a missed violation is worse than an over-block. The 34 cases ship in test/fixtures/judge-cases.json with their honesty notes intact: they are hand-authored; the meaningful signals are the paraphrase-miss rate, the trap false-positive rate, and held-out generalization, not the headline percentage.
allow without delegating still cannot get a structural violation through — test/dsh-plugin.test.ts ("cannot be bypassed by a listener that short-circuits allow").test/gate.test.ts.test/gate.test.ts.test/judge-llm.test.ts.test/dsh-plugin.test.ts.Context + ToolRuntime from the published rc packages and drives ctx.tools.execute — no mocked harness.docs/E2E-HEADLESS.md.Run everything: pnpm install && pnpm test and pnpm typecheck — the suite prints its own count; every guarantee above names its test file.
Watch the drift story: pnpm demo — deterministic, no model required. In-scope work passes, a prod-config edit and a force-push block, and a rogue allow-everything listener fails to bypass the monotonic guard; the contradictions log prints at the end.
Measure the judge yourself: pnpm build && node scripts/judge-eval.mjs --url <openai-compatible-endpoint> --model <model> runs all 34 fixture cases live and reports per-set accuracy, abstains, and misses.
version: 1
defaults:
failMode: closed # judge unreachable => block-severity commitments block
judgeBudgetPerStep: 8
commitments:
- id: no-force-push
statement: Never force-push to a shared branch.
match:
kinds: [shell]
commands: ["git\\s+push\\s+[^\\n]*(-f\\b|--force)"]
- id: stay-on-task
statement: Do not modify files unrelated to the assigned task.
severity: warn
semantic: true # escalates to the tier-2 judge
match:
kinds: [fs-write]
Semantics: kinds/tools are scope filters; paths/commands are structural evidence. A non-semantic commitment with scope but no evidence fires on every in-scope action; a non-semantic commitment with neither is rejected at load as unenforceable. Command regexes are case-insensitive by default. One foot-gun to know: command patterns execute inside the synchronous guard, so a catastrophically backtracking regex can stall the tool pipeline — commitments are operator-authored (trusted), but keep patterns simple. Full example: commitments.example.yaml (itself under test).
The package declares the ecosystem convention (dsh.bundle.patch → cordis.patch.yml) and mounts with:
dsh plugin --profile <profile> add dsh-write-gate
Config keys: commitmentsFile (default COMMITMENTS.yaml, resolved from cwd), contradictionsLog (JSONL, default write-gate.contradictions.jsonl), judgeTimeoutMs, and judge: { provider, model, maxTokens } — omit judge to run tier 1 only (escalations then follow failMode).
bash, read/write/edit, web tools); unrecognized tools degrade to kind other with a full summary — visible to semantic commitments, but path/command rules do not apply to them.<0.2.0.pnpm build emits dist/, prepublishOnly gates every publish on build + tests.Runtime: zod, yaml, picomatch (mainstream, actively maintained), @deepseek-ai/schemastery (dsh's own config-schema library, Koishi lineage). Harness peers: @deepseek-ai/cordis + @deepseek-ai/dsh-* rc packages, pinned. Dev: vitest, typescript.
MIT.