@zhengqiuyang

Signed chain-of-custody for DeepSeek Harness sessions — hash-chained, ed25519-signed records of what the agent actually did, commits bound into the chain

Deterministic write gate for DeepSeek Harness — scope policy + residue scan at the moment of the write; the CI gate moved into the session

Hermetic composition lock for DeepSeek Harness — profile fingerprint; drifted compositions warn or fail (strict)

System-prompt surface drift gate for DeepSeek Harness — sections any plugin contributes are hashed and baselined; silent rewrites fail loud

Tool-surface snapshot and drift gate for DeepSeek Harness — every visible tool (incl. MCP) baselined; silent surface changes fail loud

Deterministic network egress gate for DeepSeek Harness — web fetches checked against a destination allowlist before they run

Deterministic artifact lifecycle for DeepSeek Harness — scan session debris, return a reviewable cleanup plan; the janitor is never an agent

Deterministic prompt-injection interception for DeepSeek Harness — scans what the agent READS before it enters model context; credential files quarantined on path alone

The deterministic trust chain for DeepSeek Harness: eight plugins + dsh-bench-local — zero LLM in the trust path. Now expanding to OpenCode (oc-read-guard)