Foreword¶

When running Agents in DeepSeek Harness (DSH), the common approach is to rely on system prompts to constrain behavior, or to switch between spec/react modes at the conversation level. Such methods can influence how the model “speaks,” but they struggle to create a closed loop around real tool event streams: after a write, whether there’s a readback, whether performance changes have a complete benchmark, whether repeated calls bring new information, often still depends on the model’s own discipline.

dsh-trajectory-governor (maintainer chunsi-w) takes a different path: maintaining task stages, verification debt, and completion thresholds on the Harness event stream, turning trajectory policies into a configurable control plane. It’s a clean-sheet rewrite of dsh-mode-boost, not dependent on preset forks or super-injectors. The project has about 9 stars on GitHub and is categorized as a “Workflow” in SkillHub.

What It Is¶

In one sentence: A closed-loop trajectory policy plane for DeepSeek Harness.

The plugin listens to inbox messages, tool calls, and Code Mode sub-calls, appending reconstructable near-field policy messages within the same request, and maintaining:

• Task Episodes and continuity relations (new / continuation / extension / correction / review, etc.);
• Current work stage and structured information gain;
• Workspace revisions and Verification Debt;
• Benchmark evidence and spec-compliant, tolerance-aware performance regression judgments;
• Scoped tool capability surfaces (temporarily hiding write / edit when necessary);
• Explicit finish and natural-end completion gates;
• Optional adaptive reasoning effort;
• A local, model-invisible decision ledger.

How the Closed Loop Works¶

The main path given in the README is as follows:

Real-world message claimed by inbox
  -> Establish Task Contract before first prompt assembly
  -> Determine new / continuation / extension / correction / review / conversation
  -> Optionally hide write/edit via agent.ctx.tools.restrict() if needed
  -> agent/pre-step appends reconstructable near-field policy message within the same request
  -> Native tool or Code Mode SDK sub-call produces durable events
  -> Calculate observation novelty / mutation / verification
  -> Modification creates Verification Debt
  -> readback + test/build/check pays off current revision's debt
  -> Optional benchmark gate only accepts complete, parsable results for current revision
  -> Compare QPS only with same query count / concurrency / warmup; no false positives within tolerance
  -> finish guard and turn-stopping prevent ending without evidence
  -> After limited continuation steps exhausted, require model to explicitly report blockers

Below, we explain what each module does.

Task Episode and Relation Judgment¶

Current deterministic relations include: new-objective, continuation, extension, correction, clarification, review, conversation. Judgment considers pronouns, filename and artifact overlap, literal similarity to the previous objective, and fix/build/review semantics. If the first message is small talk, it won’t permanently disable the plugin; the next real task will establish a new objective.

Capability Surface Control¶

In the current version, explicit write and edit are treated as dedicated mutation tools. str_replace_editor is a read-write hybrid tool; it will only be temporarily hidden if there is still an independent read, to avoid losing observation capabilities in the Minimal preset. In Code Mode, restrictions alter the generated TypeScript SDK but do not remove the run_code transport.

bash / pwsh remain read-write hybrid tools. For common write signatures like apply_patch, redirections, sed -i, git apply, and package manager installs, the Governor will conservatively mark them as mutation risks: upon success, it increments the workspace revision and creates debt requiring command verification. It’s important to note: the Governor is a trajectory policy, not a security boundary; real permissions are still enforced by the official sandbox / approval.

Verification Debt¶

Successful write / edit / str_replace_editor mutations or high-risk shell writes create verification debt, tied to the workspace revision at creation time; subsequent modifications invalidate older readback / test evidence.

• Source code: requires readback + test / build / check;
• Documentation: requires readback;
• Unknown artifacts: require executable verification.

The following shell commands are recognized as verifications:

npm/pnpm/yarn/bun test|build|lint|typecheck|check
pytest / vitest / jest / mocha / tsc
cargo test / go test / dotnet test / mvn test / gradle test / make test

A non-zero [exit code: N] in bash text is also considered a failure. When debt is unpaid, the Governor will append a limited number of verification steps according to configuration; after reaching the limit, it appends one step solely to report the blocker, avoiding infinite loops or silent pass-throughs.

Benchmark-aware Stop Controller¶

Experimental performance tasks can explicitly enable the benchmark gate without affecting normal development tasks. The rules are deterministic:

• Only when total_queries >= fullBenchmarkMinQueries and recall >= fullBenchmarkMinRecall can the current revision pass; unparsable results explicitly become blockers.
• QPS is compared only with the best record of the same total_queries, concurrency, and warmup.
• A decline within the same spec not exceeding benchmarkScoreTolerancePercent is retained as acceptable noise.
• Each identified mutation or high-risk shell write invalidates prior benchmarks.

Benchmark tools should return fully named metrics in meta or model-visible text, with JSON being the most reliable, e.g.:

{
  "total_queries": 10000,
  "recall": 0.98,
  "qps": 1250.5,
  "concurrency": 8,
  "warmup": 500
}

The Governor only retains benchmark best records and state, not writing directly to the user’s workspace, thus avoiding fake “auto rollbacks.”

Native and Code Mode¶

The Governor observes both Native’s tool/call / tool/result and Code Mode’s tool/code-dispatch-start / tool/code-dispatch. Read / write / edit within run_code also update information gain, release restrictions, and create and pay off verification debt.

Status Tool and Decision Ledger¶

The read-only tool trajectory_policy_status returns the current Agent’s episode, relation / phase / risk, artifacts, restrictions, verification debt, benchmark status, ledger state, and assembly hash, etc. Implementation strictly uses exec.agent, without reading other sessions.

The decision ledger writes by default to:

$DSH_HOME/trajectory-governor/decisions.jsonl

The ledger saves session / message id, original message SHA-256 (without saving the original text), relation / phase / risk, tool effects, open verification debt, request assembly hash, turn stop reason, etc. Ledger failures do not change the official Agent execution flow but expose the cause via console.error and trajectory_policy_status.

Installation and Enabling¶

Environment Requirements¶

• Node.js ^22.19.0 || >=24.0.0;
• DeepSeek Harness 0.1.0-rc.7 (development and integration test baseline); peer range compatible from 0.1.0-rc.5 to <0.2.0.

Install from npm (Recommended)¶

Current package name is @chunsi-m/dsh-trajectory-governor, version 0.2.0, MIT license. Install command:

dsh plugin --profile web add @chunsi-m/dsh-trajectory-governor
dsh --profile web --dump-config

To pin a version:

dsh plugin --profile web add @chunsi-m/dsh-trajectory-governor@0.2.0

The package declares a cordis.patch.yml bundle patch; dsh plugin --profile web add ... will add it to the web profile’s bundle layer, rather than just installing it as a normal dependency.

Install from Source or Tarball¶

From the current directory:

npm run build
dsh plugin --profile web add .
dsh --profile web --dump-config

Install tarball:

npm run pack:release
dsh plugin --profile web add ./chunsi-m-dsh-trajectory-governor-0.2.0.tgz

Configuration and Recommended Rollout Order¶

Excerpt from the default configuration in cordis.patch.yml:

- insert:
    - id: trajectory-governor
      name: '@chunsi-m/dsh-trajectory-governor'
      config:
        mode: active
        adaptiveReasoning: false
        restrictBeforeEvidence: true
        autoVerify: true
        maxAutomaticContinuations: 1
        exposeStatusTool: true
        ledger: true
        maxLedgerBytes: 10485760
        benchmarkRequired: false
        benchmarkToolNames: [run_benchmark]
        verificationToolNames: [build_project, run_correctness_test]
        finishToolNames: [finish]
        fullBenchmarkMinQueries: 10000
        fullBenchmarkMinRecall: 0.95
        benchmarkScoreTolerancePercent: 2
        maxActionsWithoutBenchmark: 8
        maxStagnantFullBenchmarks: 2
        stopRetryOnDeterministicErrors: true

Meaning of common fields:

First, use shadow mode to observe whether decisions match real conversations:

mode: shadow
ledger: true

After confirming that relation / phase judgments are reasonable, switch to active. adaptiveReasoning is disabled by default because changing reasoning effort alters request headers and cache shapes; enable it only after calibration on specific provider / models.

Example configuration for performance tasks:

benchmarkRequired: true
benchmarkToolNames: [run_benchmark]
verificationToolNames: [build_project, run_correctness_test]
finishToolNames: [finish]
fullBenchmarkMinQueries: 10000
fullBenchmarkMinRecall: 0.95
benchmarkScoreTolerancePercent: 2

Use Cases and Notes¶

Who It’s For

• Teams already running long-chain Agents on DSH, hoping to use event streams rather than pure prompt constraints to enforce “observe before modifying, verify after modifying, and require complete benchmarks for performance changes”;
• Workflow scenarios needing Task Episode continuity judgment, verification debt, and finish gates;
• Users of Native tools or Code Mode where tool names can be configured per harness (benchmarkToolNames, verificationToolNames, finishToolNames).

Caveats

• The plugin runs with the current dsh process permissions; before installation, read the source code and MIT license to confirm the bundle patch and default configuration suit your environment.
• The Governor is a trajectory policy layer, not a replacement for sandboxes and manual approval; high-risk shell writes only create verification debt and do not alone serve as a security boundary.
• SkillHub (directory page) is a community plugin directory with no official affiliation to DeepSeek / High-Flyer; the DSH ecosystem philosophy is “everything is a plugin,” and this plugin is a supplementary workflow direction within it.

Conclusion¶

dsh-trajectory-governor connects Task Episodes, verification debt, benchmark gates, and completion thresholds to the real event stream of Harness, transforming Agent trajectories from “relying on prompt self-discipline” into configurable, accountable, and gradually rollable-out closed-loop policies. It’s recommended to first use shadow mode to cross-reference the ledger, then switch to active; for performance tasks, separately enable benchmarkRequired.

• SkillHub directory: https://www.skillhub.cn/plugins/chunsi-w/dsh-trajectory-governor
• GitHub repository: https://github.com/chunsi-w/dsh-trajectory-governor