dsh-agent-harness-audit

The robustness of an agent harness usually hides in the branches nobody rereads: a tool call that times out and drops its result, a truncated model stream that lands in history as if it were complete, a cancellation signal that dies before reaching a spawned subprocess, a context cut that slices right through a call-and-pair. Individually minor, stacked together they are the root cause of an untrustworthy agent loop. dsh-harness-audit pins all fifteen of these failure modes down with code-level checks, and it refuses any finding whose cited evidence does not appear within three lines of the cited source location.

The fifteen checks span six dimensions: state self-consistency, untrusted-input handling, failure as a first-class outcome, closable boundaries, finite-resource accounting, and run observability. Each check runs in its own throwaway subagent that receives only that check's criteria. The summary is written by pure code, not by a model, so unevidenced claims never make it into the report. Path validation guarantees the audit targets project code rather than vendored dependencies, and the rejection rate is surfaced in every report as the primary signal that a subagent is fabricating rather than reading.

Built for developers who are constructing or maintaining an agent harness. Your loop has been running for months, nobody has audited the cancellation, retry, or truncation paths, and you are not sure they hold. Install the plugin, run the seven critical checks, and in a few minutes you get a report where every finding carries a file, line number, and a verbatim code snippet you can re-read yourself. The criteria ship inside the plugin, so there is nothing extra to configure and nothing to load at runtime.