dsh-stack

In a stacked PR workflow, a single rebase at the base layer rewrites every SHA above it, instantly invalidating CI results and review approvals. Engineers see a Sync Success message and reflexively hit merge, yet the new HEAD was never re-validated. dsh-stack is designed as a DeepSeek Harness safety-rail plugin to close exactly that blind spot.

It enforces eight guard assertions across the full lifecycle: environment and auth validation, clean-worktree pre-flight, dependency topology integrity, per-layer test re-runs after every cascade rebase with SHA-bound validation records, landing eligibility checks, MERGED-status polling confirmation, and zero-dependent branch cleanup. /stack-land refuses to merge any layer that lacks a passing record for its current HEAD, while branch deletion is SHA-conditional and uses --force-with-lease so a branch that moved between the check and the delete is retained rather than destroyed. Every command supports --json output for stable consumption by AI agents and CI/CD pipelines.

If you already manage multi-layer dependency chains with gh-stack, or want tested to become provably tested per commit, dsh-stack layers defense in depth on top of GitHub branch-protection rules, making every merge auditable and every cleanup safe and reversible.