Introduction

In the design of DeepSeek Harness, plugins can fill specific gaps within a workflow. The problem handled by dsh-proof is relatively clear: before a top-level turn is about to close, let a read-only verifier perform an independent acceptance check first. If the verdict is not pass, send the gap and subsequent steering back to the driver agent.

Below is an introduction to its positioning, how it works, how to install and configure it, and the limitations to be aware of during deployment.

What is it

dsh-proof is DeepSeek Harness’s independent read-only acceptance layer. It is maintained by EvilIrving, is under the MIT license, and has a version of 0.1.0 in package.json.

It depends on the subagents service, which refers to the official dsh-subagent providers.

Core Functions

  1. Intercepts “about to close” top-level turns.

    It intervenes via agent/turn-stopping, serially waits for this process to complete, and then commits the turn.

  2. Starts a read-only verifier.

    It uses:

    ctx.subagents.start('spawn', …)

to start the verifier, and combines it with:

    toolFilter.deny
    outputSchema

to collect a structured verdict.

  1. Sends failed items back to the driver agent.

    When the verdict is fail or insufficient-evidence, the plugin injects gap details and provides subsequent steering.

  2. Prevents verifier recursive calls.

    It limits recursion through the following constraints:

    delegationDepthOf(agent) > 0
    maxDepth: 0

  1. Limits verifier tools by default.

    The default denyTools includes:

    write
    edit
    str_replace_editor
    bash
    run_code
    subagent

The default retained read-only discovery tools are:

    read
    read_image
    glob
    grep

Installation & Enablement

First, install from GitHub:

dsh plugin --profile <name> add github:EvilIrving/dsh-proof

Here, <name> is a placeholder and needs to be replaced with the actual DSH profile name.

You can also install from a local checkout:

dsh plugin --profile <name> add ./dsh-proof

Before enabling, you need to confirm that the current environment provides the subagents service.

Typical Usage

After installation, you can configure plugins.dsh-proof.config in cordis.yml. For example:

plugins:
  dsh-proof:
    config:
      maxAttemptsPerTurn: 2
      denyTools: [write, edit, str_replace_editor, bash, run_code, subagent]

maxAttemptsPerTurn: 2 indicates that the acceptance check will be attempted at most twice per turn.

denyTools is used to declare tools that the verifier cannot use. This list must match the actual registered tool names in the current deployment, as tools.restrict will error directly on unknown names.

Scenarios & Notes

dsh-proof is suitable for deployment scenarios where you want to add a layer of read-only acceptance before a DSH agent turn closes.

When deploying, you need to pay special attention to the following points:

  1. The verifier inherits the parent agent’s tool set and narrows permissions via the deny list; it does not see an explicit whitelist.

  2. denyTools must be consistent with the tools in the deployment. The default list covers write, edit, str_replace_editor, bash, run_code, subagent; if the deployment adds other mutating tools, you need to extend the list yourself.

  3. This plugin does not perform evidence normalization. The verifier collects evidence on its own; the plugin does not reimplement diff, test, typecheck, lint, and other processes.

  4. Spawn is best-effort. If the provider does not exist or the request is rejected, the process will degrade to a no-op, and logs will be recorded.

  5. If the verifier’s final state is not completed, or if structured results are missing, it is considered no objection. That is, a single failed proof will not directly cause the user’s turn to fail.

  6. The plugin runs with the permissions of the current DSH process. You should check the source code, dependencies, and MIT license before installation.

Conclusion

dsh-proof provides a specific plugin capability: inserting a read-only acceptance check before a top-level turn closes, and sending gaps that are not pass back to the driver agent. Its value lies in adding a configurable acceptance point to the DSH workflow, rather than replacing business verification processes.

GitHub link:

https://github.com/EvilIrving/dsh-proof