dsh-code-reuse-firewall

The most expensive failure mode in AI-maintained codebases is not a syntax error but the same capability quietly implemented a second time. Two versions drift apart without any linter ever firing, because nothing looked broken when the copy was made. dsh-code-reuse-firewall moves the intervention point earlier: while the new code is still a plan on the agent canvas, not yet a file on disk.

Under the hood it runs a deterministic, LLM-free retrieval pass before the write tool is invoked. Three channels—callable-name overlap, docstring lexical match, and string-literal similarity—each carry IDF-weighted coverage scores. The agent receives top-K candidates with file paths, per-channel evidence, and an explicit LOCKED flag when a candidate sits in a frozen-JSON provenance manifest, steering it toward import rather than copy-and-modify. The entire engine is pure Python 3.10 stdlib; a mid-size project scan completes in roughly one second with no external model calls.

It is built for teams maintaining medium-scale Python repositories with DeepSeek Harness or similar agent workflows. You do not replace your existing checker pipeline; just insert one reuse_check step before each write decision, and the signal that this capability already exists in the repo arrives while duplication is still preventable.