DeepSeek Harness (DSH) has a rich plugin ecosystem, typically offering single-domain tools. This forces developers to trust the individual outputs of multiple plugins. dsh-supreme takes the opposite approach by providing a complete governance stack. It includes seven governance domains: cost policy, observability, routing, validation, memory policy, workflow limitations, and security auditing. Its core principle is “evidence as product”: every claim is an executable command, and all hard rules (denial paths, cost gating, and secret scrubbing) are deterministic code rather than model judgments.

Core Features

dsh-supreme installs a set of seven policy plugins as a single bundle without modifying upstream.

  • Zero upstream patches: The upstream version is pinned to d347e703908d, and the workspace remains clean.
  • Deterministic code: No machine learning dependency; it uses deterministic counting, wildcards, and comparison operations.
  • Verdict gating: The verdict flag is COMPLETE only when all checks pass.
  • Configuration key hygiene checks: Scans configuration keys against real Zod schemas to prevent silent truncation pitfalls.
  • Evidence storage: Provides a published JSON Schema and an append-only JSONL evidence store.
  • Safe scrubbing: Includes a built-in secret sentinel for cleaning sensitive data.
  • Reproducibility: Generates reproducible task/run/score JSONL evidence.
  • Performance metrics: Provides router latency metrics.

Installation and Activation

The plugin is installed as a DSH bundle with no build step required. After installation, default policies automatically enable safety restrictions:

  1. PAID / TRIAL routes → DENIED (LAB-only override)
  2. UNKNOWN cost class → DENIED
  3. commands / network → OFF by default

Run the following command to install:

dsh plugin --profile <your-profile> add github:stadeummwt/dsh-supreme

Typical Usage

The plugin provides built-in CLI tools (zero dependencies) for diagnostics, installation, and verification.

  • Diagnose the environment:
    node real/supreme.mjs doctor

The output lists missing items and provides remediation commands.
  • One-click setup and verification:
    node real/supreme.mjs setup

This command builds missing components, runs `dsh plugin add`, applies the configuration, and guides testing until it displays "SUPREME READY".
  • Full verification:
    node real/supreme.mjs verify

Runs the complete verification ladder, checking the pass/fail status of each gate.
  • Specify a configuration composition:
    node real/supreme.mjs setup --composition standard

Available compositions include `core` (policy), `standard` (policy + observability + memory + validation), `supreme` (all seven), and `lab` (all seven + experimental overrides).

Security and Performance

  • No ML dependency: Fully deterministic logic, where speed is a feature. Router decision latency is approximately 0.02–0.04 ms / 1k.
  • Security audit: Performs a six-part security audit in CI (prompt, hooks, MCP, permissions, secrets, and agent files).
  • Secret sentinel: No leaks were found in any run.

Use Cases

dsh-supreme is suitable for developers who need strict governance, auditable behavior, and deterministic decision-making in DSH environments. Because the plugin runs with the permissions of the current DSH process, you should review the source code and license before installation.

References

  • GitHub repository: https://github.com/stadeummwt/dsh-supreme
  • Plugin directory: https://www.skillhub.cn/plugins/stadeummwt/dsh-supreme