dsh-verdict-guard

The most expensive failure an agent can produce is not a wrong patch. It is a wrong closing verdict: “it does not work,” “no bug here,” “not reproducible.” A false “it works” leaves a trace for the next run to catch. A false “it does not work” leaves none. The direction is sealed quietly, and nobody re-opens a question that already carries an answer. The two error classes are not equally priced, so they should not be held to the same standard of proof.

dsh-verdict-guard intervenes at the turn-stopping boundary and asks one question: does the answer the model is about to close with carry anything a reader can follow? Evidence comes from three layers. The first two live in the answer text itself — fenced command output, file paths, test tallies, HTTP statuses. The third lives in the session log for that turn: an actual verifying tool call (bash, grep, read, test, and others). That third layer is what makes this a plugin rather than a text hook. A text-only checker sees what the model wrote. The session log says what actually ran. If the answer pastes a polished command transcript while the turn called no tool at all, the guard holds it back with a sharper message than a plain missing-citation notice.

It does not verify that a claim is true. No oracle, no acceptance criteria, no contract. It checks one thing: whether the answer offers something to check at all. A wrong claim sitting beside real command output passes and is caught by the reader; a right claim with nothing beside it is held. By default it intervenes once per turn — a speed bump, not a gate. It is built for engineers who drive agents against production systems and know that one confident, unsupported verdict can cost a full day of re-triage.