dsh-write-gate

In autonomous agent workflows, models can quietly attempt dangerous actions—a force-push to a shared branch, a mutating SQL statement against a production database, a write to a path that should stay read-only—without anyone noticing until after the fact. dsh-write-gate intercepts tool calls before they execute, enforcing operator-authored commitment statements such as "never force-push to main" or "stay read-only on the production database." Structurally decidable constraints are handled by deterministic checks (path globs, command regexes, scope filters); genuinely semantic constraints are judged by a local model against the operator's own wording. Every block is appended to a contradictions JSONL log that records which commitment fired, at which tier, and why, giving you a complete, explainable audit trail.

The plugin is built around explicit engineering guarantees: a monotonic guard that no allow-short-circuit listener can bypass; a fail-closed default when the judge is unreachable, timed out, or over budget; bounded judge cost with per-step budgets and verdict memoization; and an injection-fenced prompt that treats action content strictly as data, accepting only a rigid JSON verdict. An anti-self-justification clause prevents the model from talking the judge into clearing a real violation. A standalone dsh-write-gate check CLI lets you run tier-1 structural checks in CI, pre-commit hooks, or manually, with semanticized exit codes and optional JSON output that pipes cleanly into jq. The core is engine-agnostic with zero harness imports; a Claude Code adapter is on the roadmap.

It is for teams running DeepSeek Harness or similar frameworks in production: repositories with shared branches that must not be force-pushed, databases with strict read/write boundaries, and compliance requirements for explainable blocking. If you want to turn a spoken consensus like "we never do that" into a code-enforced gate, dsh-write-gate gives you a lightweight, testable, fully local write-gate that drops into an existing agent pipeline or CI workflow without requiring any cloud dependency.