dsh-pr-gate

Deterministic write gate for DeepSeek Harness (dsh) — the CI gate moved to the moment of the write.

Every file the agent writes (write / edit / str_replace_editor) passes the same scope policy and residue rules that agent-pr-gate applies to PRs in CI — deny-before-write in tools/pre-execute, residue scan of the written text in tools/post-execute, and a durable content-hashed JSONL ledger of every decision. Zero LLM calls in the trust path: the parts of the gate that must NOT be an LLM live here.

Why now (checked 2026-10-12)

The review/guard lane in the dsh ecosystem is entirely LLM-shaped: answer-reviewer plugins re-read turns with a second model, dsh-gungnir verifies goal completion from exit codes, and the closest action-guard (cc-safety-net, 1.6k★ in the Claude ecosystem) blocks destructive commands. Nobody gates what the agent writes deterministically — scope policy, residue markers, or a durable record the CI can consume. That slot is empty, and this plugin is the agent-pr-gate engine living inside the runtime instead of waiting for the PR.

What it does

Stage	Hook	Deterministic action
Before the write	tools/pre-execute	Scope policy: deny globs always win; a non-empty allow list means "only these". Denied writes never touch the disk
After the write	tools/post-execute	Residue scan of the written text: injection text aimed at reviewers, skipped tests, debug markers. warn (default) logs + ledgers; block also fails the write with corrective feedback
Always	JSONL ledger	One line per decision — tool, path, action, sha256 of content, matched pattern, residue kinds. agent-pr-gate CI can consume it as the session-side record

One policy, two enforcement points

Point policyFile at your repo's agent-pr-gate.yaml and the live session enforces the same allow/deny the CI gate enforces on PRs — all policy entries are unioned. Inline allow/deny config works without a file.

Install

dsh plugin --profile default add dsh-pr-gate

From npm — no build step, no allowBuilds authorization; git installs are equally prebuilt (lib/ ships in the repo).

Configure

- id: dsh-pr-gate
  name: dsh-pr-gate
  config:
    tools: [write, edit, str_replace_editor]
    allow: [src/**, docs/**]     # non-empty = only these
    deny: ["**/*.pem", .github/workflows/**]
    policyFile: ""               # or e.g. agent-pr-gate.yaml
    residueMode: warn            # warn | block
    ledgerPath: .dsh-pr-gate/session.jsonl

Develop

npm install
npm test   # syncs the vendored agent-pr-gate core, builds, runs unit tests

The scope glob semantics and residue rules are vendored from the sibling agent-pr-gate checkout (npm run sync; CI runs sync --check).

Roadmap

• bash command write-heuristics (redirect/shell-write detection, warn-only)
• Ledger → GitHub check-run bridge (session attestations surfaced in CI)
• Per-policy selection by agent preset, matching the CI gate's policy classes
• Claims-vs-diff at turn end (the agent's final summary vs. the session ledger)

Kill criteria

If dsh ships first-party deterministic write gating, or reviewer plugins converge on deterministic enforcement (they are all LLM-based today), this freezes at its last working version with a postmortem here. The engine stays owned by agent-pr-gate either way.