dsh-audit-log

In DeepSeek Harness, every listener in a waterfall dispatch shares the same args array, and any plugin can silently rewrite a field as it flows through the system. When a critical value vanishes or gets replaced mid-pipe, pinpointing the culprit is nearly impossible without external tooling, and the problem only gets worse as the plugin count grows into the hundreds.

dsh-audit-log mounts as a purely read-only observer at two internal hooks: it snapshots argument shapes (types, keys, lengths) before and after each dispatch to record structural diffs, and wraps every external listener at registration so each call window is compared in isolation. Mutations are attributed to the exact plugin and fiber with a "window" confidence tag rather than a heuristic guess. Because only structural fingerprints are logged and payload values are never captured, secrets stay out of the trail. A ring buffer, package allowlist/blocklist, and event filters keep the audit scope flexible and the overhead negligible.

If your instance loads dozens of plugins, routes data through multiple waterfall, serial, and parallel stages, and you need to answer "who touched my field" before an incident forces you to, dsh-audit-log fills the runtime data-layer observability gap. It complements prompt-level audit tools, so running both gives you a complete input-to-dataflow accountability picture.