dsh-reset-handoff

When an agent inside DeepSeek Harness needs the host process to restart, killing itself is the most dangerous path: the command is dispatched, the process dies, and no one is left to see the outcome or recover. dsh-reset-handoff turns that into a clean handoff. DSH writes a single request.json; an independent ops agent performs preflight checks, restarts the service, runs a health check, and—if anything goes wrong—attempts diagnosis and recovery before writing a result.json that the requesting session reads back after boot. Nothing is lost.

The protocol enforces three mandatory gates before any restart is allowed: no pending approvals in the relay queue, at least 500 MB of free disk, and a 60-second cooldown since the last restart. If any gate fails, the executor writes a detailed gate array and simply does not restart, so the calling agent or a human sees the exact reason and can retry when conditions are right. After a restart, if the health check fails, the executor follows a recovery contract—diagnose from the web error log, retry up to three times with a cooldown, observe for a 120-second window, and report the full attempt history—rather than just reporting failure.

It is built for long-lived DSH web deployments with complex plugin trees that need frequent config reloads or state recovery. Because the contract is just two versioned JSON files, any process that can read and write them—a custom script, a cloud function, a Hermes cron job—can serve as the executor. The protocol is the interface; the implementation is yours.