AutoResearch DSH Preset

A source-controlled AutoResearch Project Mode preset for DeepSeek Harness (DSH). It coordinates structured, evidence-grounded research through an approved DAG, independent role subagents, an AutoReason-style A/B/AB refinement loop, blind Borda judging, acceptance receipts, and final integration.

This repository starts from the installed, runnable preset snapshot currently identified by generation 73dba5793f85. The generation, entry hashes, and aggregate build identity are retained in tools/build-manifest.json so the initial commit is traceable. The checked-in entries are generated runtime artifacts, not a claim that their original build source has been recovered.

Status

The runtime snapshot is usable with a compatible DSH installation. The proposed causal upstream-backtracking extension is design only, not part of the implemented baseline. See docs/causal-backtracking-plan.zh-CN.md; its v1 design defaults to observation and treats a reopen as a bounded repair experiment, not proof that an upstream node caused a defect.

What it provides

• preset.yml and agent.cordis.yml: the DSH preset metadata and composition.
• roles/: confined role prompts for planning, evidence, authoring, critique, judging, reporting, implementation, and integration.
• skills/: standard and outline-led project workflows.
• tools/: the versioned AutoResearch core, orchestrator, Linear adapter, bounded web/PDF fetch provider, and build manifest.
• briefs/demo-brief.md: synthetic local example input.

The workflow uses an immutable approved plan.json, a mutable receipt-journal state.json, and Linear only as a derived view. It does not treat Linear as the source of truth for dependency completion.

Requirements

• A compatible DSH installation. This snapshot was recorded with @deepseek-ai/dsh 0.1.1-rc.2 available locally; pin and test the DSH version in your own deployment before production use.
• Node.js 20 or later for the verification and installation scripts.
• Optional: a Linear credential exposed to DSH as LINEAR_API_KEY for Linear workflows. Local-only projects do not require it.
• Configured model providers for the role profiles in config.default.json. Those identifiers are deployment defaults, not an endorsement or portability guarantee. Copy/override the configuration for your own provider catalog.

Install

First inspect the snapshot locally:

npm run verify:snapshot

Install it into a user-owned DSH preset location, replacing the target with the actual DSH home used by your deployment:

node scripts/install-preset.mjs "$HOME/.dsh/.agent-presets/research"

Start a new DSH research session after installation. Preset composition is mounted per process/session generation, so an already-running session can retain an earlier generation.

For safer evaluation, use a distinct preset id and target directory rather than overwriting a working preset. The composition and its runtime entries are self-contained relative to the preset root.

Validate the baseline

npm run check

The check is offline. It confirms every manifest-listed file hash, recomputes the aggregate build ID, verifies the embedded entry identities, and checks the required preset assets. It does not invoke a model, DSH server, Linear, or web fetch.

A full DSH runtime validation should also mount the copied preset and invoke its autoresearch_build_probe and linear_build_probe; both must report the same aggregate ID and graphMatches: true.

Configuration and operation

config.default.json seeds configuration for new project workspaces. Existing workspace configuration can override it. Review it before use:

• The baseline includes linear.approval: "auto"; set a stricter approval mode in your deployment if side effects should require confirmation.
• Model identifiers are deployment-specific. Configure accessible providers and models, particularly for the integration editor when image inspection is needed.
• External research performs outbound HTTP(S) fetches and may send context to configured model providers. Disable it when the research material is not authorized for those services.
• The web/PDF fetch provider accepts only HTTP(S), rejects URL credentials, bounds URL/response/body sizes and time, retries transient failures, and refuses cross-origin redirects. Remote sources remain untrusted input.

Use the research-project skill for an open research brief and research-outline-project for a substantial user-provided outline. Both lead to the same approved plan, node execution, integration, and finalization flow.

Data handling

Never commit .research-agent/. It can contain research briefs, source excerpts, model transcripts, state receipts, Linear metadata, and generated artifacts. Credentials, local configuration, logs, and private input material are also ignored by default. Inspect git status before every commit and use a secret scanner in CI.

The preset redaction checks final reports, but that is not a substitute for reviewing what external systems receive. Web pages, PDFs, Linear comments, and model output may contain prompt injection or sensitive data.

Development

This repository preserves the current runtime snapshot so work can continue with normal Git history. Do not edit the generated entry files casually: any change to manifest-covered content must update the manifest and the embedded aggregate build identifiers together. Run npm run verify:snapshot after every such change.

See CONTRIBUTING.md for test and data rules, SECURITY.md for reporting and operational boundaries, and NOTICE for third-party attribution. The project is MIT-licensed; vendored PDF.js remains subject to Apache-2.0 notices retained in its source files.