dsh-plugin-harnessmm

Guarded decision reuse for the DeepSeek Harness. The model writes down already-decided tool actions once; when the previous tool result satisfies the guard it wrote for them, those actions run through the native tools without another reasoning request.

This is a derivative work of HarnessMM by Yuhua Jiang (Apache-2.0). See Provenance — the attribution is not boilerplate. This plugin re-implements one part of that research codebase for a general harness, and it does not inherit its benchmark claims.

---

The problem

An agent loop pays a full model request before every tool call, even when the model already knows exactly what the next three calls are:

step 1  request → "read a.ts, then b.ts, then run the tests"   ← pays once
step 2  request → "ok, read a.ts"                               ← pays again, said nothing new
step 3  request → "ok, read b.ts"                               ← pays again
step 4  request → "ok, run the tests"                           ← pays again

Steps 2–4 are not decisions. They are the model re-deriving something it already decided.

What this plugin does

slow actor (one request, already paid for)
  ├─ visible text: <CHISEL_PLAN>{candidates:[...]}</CHISEL_PLAN>
  └─ one native tool call                        ← the "root"
        │
        ▼  real tool result (the receipt)
  guard checked deterministically against the receipt
        │
        ├─ holds  → run the stored action through the SAME native tool
        │           no model request at all  →  certificate
        └─ else   → the slow actor runs normally

Three moments:

Moment	Boundary	What happens
Author	llm/stream	After the model answers, its <CHISEL_PLAN> bank is validated against the live tool catalog and recorded.
Substitute	llm/stream	If exactly one stored action's guard holds, the request is answered with that exact tool call and no model call happens.
Certify	tools/post-execute	The action runs through the original tool definition; a certificate is recorded only after the real result is in hand.

Anything else — no bank, failed guard, ambiguous successors, graph exhausted, a native error, a non-conversation request, or the plugin disabled — calls next() unchanged, so the harness behaves exactly as it would without the plugin.

Why a substitution is safe

• Literal only. A candidate must validate against the live JSON Schema of the tool it names. Placeholders, unknown tools and repeated roots are rejected.
• Receipt-guarded. A guard is a conjunction of return_code, stdout_contains, stdout_equals, stderr_empty, or json_equals, checked against the immediate native receipt. Semantic guards ("the code is correct") are not expressible.
• No guessing. Two eligible successors defer to the model instead of picking one.
• Nothing is claimed. A certificate records one actually bypassed reasoning callback — not an estimate of counterfactual token savings.
• The request is never rewritten. The plan tag stays in the conversation as ordinary assistant text, so every request remains a pure function of the durable session log.
• No extra model call, ever. There is no selector model. A request is either answered from an already-decided action or it is not answered by this plugin at all.

Install

dsh plugin --profile <your-profile> add github:Xiuxiu-6/harnessmm-dsh

Or install the local directory:

dsh plugin --profile <your-profile> add /path/to/harnessmm-dsh

Requires Node.js ≥ 22 and DeepSeek Harness ≥ 0.2.1-rc.1.

Configuration

Set these under the harnessmm-guarded-reuse row in your profile's cordis.patch.yml:

- id: harnessmm-guarded-reuse
  name: 'dsh-plugin-harnessmm'
  config:
    enabled: true
    minimumChain: 2

Key	Type	Default	Meaning
enabled	boolean	true	Master switch; false passes everything through.
minimumChain	integer 1–16	2	Literal future callbacks a bank needs before it may replace reasoning.
maximumCandidates	integer 1–16	16	Largest bank the model may author (A–P).
maximumFastSteps	integer 1–16	8	Consecutive substitutions before control returns to the model.
injectPlanInstruction	boolean	true	Add the authorship instruction to the system prompt.
auditLog	boolean	true	Append a JSONL audit trail to $DSH_HOME/harnessmm-audit.jsonl.

Checking that it works

The plugin registers two tools:

• harnessmm_status — counters for substitutions, certificates, authored and rejected banks, deferrals, and pending actions.
• harnessmm_receipts — what ran through which tool, with exact arguments, guard, and native receipt hash.

Empty counters on a new session are normal: they stay at zero until the model authors a bank whose guard holds.

When it helps: long, repetitive, well-specified work — many known file reads, edit → compile → test cycles, batch checkouts. When it does nothing: exploration, debugging where each step depends on the previous output, and any task where the model cannot name three literal next actions in advance. A session that never authors an eligible bank simply sees normal behaviour.

What this plugin does not do

• It does not choose tools for you, judge your code, or decide when a task is done.
• It does not compress, summarize, or rewrite your conversation.
• It does not call a model of its own.
• It makes no claim about measured token savings in your session. The published HarnessMM benchmark numbers are for its research harness, not for this plugin — no number here has been reproduced against this integration.

Provenance

Derived from HarnessMM: Recursive Self-Improvement for Harness Token Efficiency by Yuhua Jiang, Chang Xu, Feifei Gao and Li Zhao — arXiv:2610.32813.

@misc{jiang2026harnessmmrecursiveselfimprovementharness,
  title={HarnessMM: Recursive Self-Improvement for Harness Token Efficiency},
  author={Yuhua Jiang and Chang Xu and Feifei Gao and Li Zhao},
  year={2026},
  eprint={2610.32813},
  archivePrefix={arXiv},
  primaryClass={cs.AI},
  url={https://arxiv.org/abs/2610.32813},
}

This plugin ports the Guarded Decision Reuse (GDR) and Certified Callback Substitution (CCS) contracts from the upstream modules integrations/deepseek_harness/sar_v2.mjs and cot_jev.mjs (the ExecutableSubdag controller and its v6 authored-bank contract). It is not the upstream repository and does not include its Python research runners, benchmark controllers, RSI loops or datasets. The precise list of changes is in NOTICE. If you use this plugin, please cite the original paper above.

If you want the research code itself — benchmarks, controllers, reproduction scripts — go to the upstream repository.

Development

npm test     # 26 tests: engine contract + Host wiring
npm run check

The tests drive the plugin with a minimal Context and a real waterfall dispatcher; they make no model calls. Config is a Schemastery schema because the Loader validates through Config['~standard'].validate(). Since @deepseek-ai/schemastery ships inside the harness rather than on npm, npm test registers tests/register-vendor.mjs to resolve the vendored copy in .vendor-tools/ (test-only; never part of the published package).

License

Apache License 2.0 — see LICENSE and NOTICE. HarnessMM is Copyright 2026 PhiAgent-0 contributors.

---

中文说明

DeepSeek Harness 的守卫式决策复用插件。 模型一次性写下已经决定好的后续工具动作；当上一个工具的真实结果满足模型自己写的守卫条件时，这些动作直接通过原生工具执行，不再发起一次推理请求。

三种情形：授权（模型回答后，动作库被校验并记录）、替换（恰好一个动作的守卫命中，该请求不再发给模型，直接执行）、签发证书（动作经由原生工具跑完并拿到真实结果后，才记录一条替换证书）。

其余情况——没有动作库、守卫不命中、有歧义、图已耗尽、原生报错、非对话请求、插件关闭——一律原样交给 next()，行为与未安装本插件完全一致。

替换为什么安全： 每个候选动作都必须通过其所声明工具在线 JSON Schema 的校验；守卫只能是 return_code / stdout_contains / stdout_equals / stderr_empty / json_equals 的合取，对「上一条原生结果」做确定性判断，"代码写对了"这类语义守卫无法表达；两个候选同时合格时不猜，交还模型；证书只记录「确实被跳过的一次推理回调」，绝不声称节省了多少 token；请求内容从不被改写。

安装：

dsh plugin --profile <你的 profile> add github:Xiuxiu-6/harnessmm-dsh

什么时候有用： 长程、重复、规格明确的任务——大量已知文件读取、编辑→编译→测试循环、批量 checkout。 什么时候没用： 探索性任务、每步都依赖上一步输出的调试、以及模型无法提前写出三个字面动作的任务。没有产出合格动作库的会话，表现与平时完全一样。

配置项与英文部分一致（enabled / minimumChain / maximumCandidates / maximumFastSteps / injectPlanInstruction / auditLog），写入 profile 的 cordis.patch.yml 即可。

用 harnessmm_status 查看计数器，用 harnessmm_receipts 查看替换证书。新会话计数器为 0 是正常的。

来源： 本插件改编自 HarnessMM（作者 Yuhua Jiang、Chang Xu、Feifei Gao、Li Zhao，arXiv:2610.32813，Copyright 2026 PhiAgent-0 contributors，Apache-2.0），移植了其中的守卫式决策复用（GDR）与认证回调替换（CCS）契约。本插件不是上游仓库，也不包含其 Python 研究代码、基准控制器、RSI 循环与数据集；具体改动清单见 NOTICE。使用本插件请引用原论文。

本项目采用 Apache-2.0 许可证。