dsh-supreme

The DSH plugin catalog is full of single-domain tools: a router here, a memory store there, a verifier over there you wire together and trust. dsh-supreme flips that. It bundles seven governance services—cost admission, observability, benchmark evidence, deterministic routing, verification, memory policy, and workflow scoping—into one install, and every hard rule is deterministic code (counting, glob, comparison), never model judgment. UNKNOWN cost means DENY. Unicode-tainted arguments are rejected at the door. Secret sentinels produce zero leaks every run. A denied call cannot be retried in the same shape. Every claim in the README is tied to a command you can re-run; if it cannot be re-run, it is labeled a claim, not a fact.

Routing walks eight hard gates, then weighted scoring, with an RM0 cost-class rule first and an unscored-evidence downweight to stop sandbagging. A thousand decisions cost 0.02 to 0.04 ms and there is no ML dependency anywhere. Observability writes append-only JSONL over official DSH event seams, allowlists fields, scrubs secrets, and fails open so one bad record never drags the pipeline down. Workflow policy pins subagents and the workflow engine inside glob-scoped boundaries where blocked beats allowed, requires a verifier pass to close HIGH-risk tasks, and locks inter-agent channels to a declared directed contact graph—anything off that graph is audited and, when set to DENY, blocked before the fact.

Teams running DSH in production who want an auditable governance floor without stitching six single-domain plugins together and hoping they agree. You get safe production defaults out of the box, composition fragments (core, standard, supreme, lab) to trim scope as needed, zero upstream patches with a pinned commit and a clean worktree verified on every run. No monkey-patching, no vibes-based config checks, no "trust the output"—just deterministic enforcement you can re-run and audit offline.