governed-workflow-for-dsh

In vibe-coding projects, we often face a challenge: once given a prompt, coding agents modify code freely, leading to scope drift, accidental changes, and a lack of clear review boundaries. The dsh-governed-workflow plugin addresses this by introducing a governed sequence, using GitHub Issues as the authority source for tasks. The lifecycle state machine ensures that protected mutations only occur during the RUNNING state, and modifications freeze upon completion or blocking before moving to independent review, reducing drift and unintended edits in long sessions.

Key capabilities include: GitHub Issue-based task authority, strict lifecycle state management (e.g., from AUTHORITY_OBSERVED to REVIEW_PENDING), guarding modifications to tools like bash, write, and edit only when in RUNNING state, providing read-only governance_status and allowlisted governance_transition actions, and terminal freeze in states like BLOCKED or COMPLETED. All authority observations and transitions are logged as bounded governance evidence for review and replay, enhancing traceability and discipline.

This plugin is best suited for medium-to-large, multi-file, long-running vibe-coding projects where agents execute commands or modify real code and mistakes carry high costs—such as apps, backend services, research tooling, or maintained repositories. It is less ideal for one-off scripts or tiny throwaway prototypes, where governance overhead may outweigh the benefits. By trading some speed for structure, it offers clearer boundaries and better support for projects requiring real review, rollback, or release processes.