dsh-doublecheck

dsh-doublecheck installs two plugin rows that read and enforce from the same durable session log:

1. doublecheck-grill — the requirements furnace: the bundled grill-requirements skill plus the model-facing doublecheck_skills, doublecheck_spec, and doublecheck_report tools and the per-dimension verification workflow.
2. doublecheck-guard — the discipline guard: the grill gate, the red/green evidence gates, the adversary review, the /doublecheck and /gate commands, the doublecheck.gate settings namespace, and the four-phase delivery gate.

Together they enforce the discipline loop — grill → design → red → green → review → verify:

grill ──▶ design ──▶ red ──▶ green ──▶ review ──▶ verify
   │
   └─ six requirement dimensions, consensus gate,
      structured spec committed to the session + workspace

# 1. install the bundle into your profile
dsh plugin --profile web add "github:PerryLink/dsh-doublecheck#main"

# or from npm (published releases)
dsh plugin --profile web add dsh-doublecheck

# 2. restart and verify the row
dsh --profile web --dump-config | grep -E -A3 'id: doublecheck-(grill|guard)'

Both rows (doublecheck-grill and doublecheck-guard) activate automatically with the profile.

• git channel (latest main): dsh plugin --profile web add "github:PerryLink/dsh-doublecheck#main" — the prepare script builds with production dependencies only.
• npm channel (published releases): dsh plugin --profile web add dsh-doublecheck.
• tarball channel: pnpm pack in this repo, then dsh plugin --profile web add ./dsh-doublecheck-<version>.tgz.
• uninstall: dsh plugin --profile web remove dsh-doublecheck (or remove the rows from the profile patch).

For a zero-configuration strict mode (every gate on at block intensity, gate coverage required), apply the shipped overlay on top of the bundle patch: dsh --profile web --patch ./node_modules/dsh-doublecheck/strict.patch.yml.

All tunables are Schemastery Config fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. cordis.patch.yml documents each key inline; Schema defaults are the single source of tuning defaults.

Misconfiguration fails loud at load: invalid regexes, empty or duplicated name lists, out-of-range thresholds, and duplicate checklist ids throw instead of silently doing nothing. strict.patch.yml is the all-gates-block overlay that restates the guard row at intensity: block with every module on and the coverage requirement enabled.

The delivery gate aggregates the session's durable evidence into a configurable four-phase checklist and settles one deliverable / rework required decision. Every phase folds the session log alone (replay IS the state), so a run re-derives identically after resume or fork.

Red lights are failed checks (a missing spec, a failing latest run, coverage below minimum, an unmapped edit, blocker/major findings) — each carries a rework suggestion. Warnings and skips never flip the decision. The gate integrates dsh-auto-review as a weak dependency: review.engine: auto folds its verdict records when present and degrades to the local reviewer otherwise; gate.tests.evalReports.enabled folds its eval engine's dsh-eval report (prompt-regression / stress / fairness suites) into the test evidence and skips honestly when no report exists. The gate never synthesizes approval requests.

/gate run returns this markdown — paste it into a PR description:

# Delivery gate report

> **Verdict: rework required** — 2 red item(s)
> The gate is red. Re-open the work in plan mode to re-check the open items before delivering.

## 1. Requirements interrogation — PASS
- [✔] **What outcome must the delivery produce?** — spec dimension "goal" committed
- [✔] **What is in scope, and what is out of scope?** — spec dimension "scope" committed
- [✔] **Which observable checks prove the work is done?** — spec dimension "acceptanceCriteria" committed
- [✔] **What can go wrong, and what is the correct behavior in each case?** — spec dimension "failureModes" committed
- [✔] **What is traded when goals conflict; what is optional?** — spec dimension "priorities" committed
- [✔] **What does the user explicitly not want?** — spec dimension "nonGoals" committed

## 2. Test evidence — FAIL
- [✔] **passing test run** — latest test run passed
- [✔] **failing cases after green** — 0 failing run(s) after green (allowed: 0)
- [✖] **coverage evidence** — 61% coverage below the 80% minimum — rework: raise coverage above the configured minimum

## 3. Implementation consistency — WARN
- [⚠] **[minor] src/telemetry.ts touched without a requirement** — [minor] the edit adds a metric no spec dimension covers

## 4. Review conclusion — PASS
- [✔] **dsh-auto-review conclusion** — 3 call(s) approved by dsh-auto-review (latest risk: low)

## Red items
1. **tests/coverage** — 61% coverage below the 80% minimum — *rework: raise coverage above the configured minimum*
2. **consistency/finding-1** — [minor] the edit adds a metric no spec dimension covers — *rework: src/telemetry.ts touched without a requirement*

## Audit
- review engine: dsh-auto-review
- generated at: 2026-08-14T12:00:00.000Z
- counts, ids, and verdicts only: no file contents or session text are embedded, and recognized secrets are redacted.

• Reads: the session log (tool/call / tool/result / tool/code-dispatch, injected user/message sources, and the foreign autoReview/* verdict records) in-process only; the optional plan-mode service state.
• Writes: doublecheck-spec.md, doublecheck-report.md, and gate-report.md in the session workspace (paths configurable) through the ctx.fs seam; the durable doublecheck/state and doublecheck/gate session events.
• Model calls: the gate's consistency and local-review phases (one subagent each per /gate run), the optional adversary review, and the doublecheck_report verification workflow start subagent runs; nothing else calls a model or the network.
• Never touched: credentials, environment variables, or any file outside the session workspace. The workshop manifest declares filesystem:read and filesystem:write only. Gate reports carry counts, ids, and verdicts only; recognized secrets in reviewer texts are redacted before storage or display.

• Model-visible ⟺ logged. Every injected reminder, review, and gate notice rides the standard channels and lands in the session log; the durable spec/state/gate facts ride tool results or SessionEventMap members.
• Fail closed / fail loud. Guard and gate config are validated in apply (assertions throw); a reviewer or adversary seam that cannot run settles as an honest "unavailable"/skip notice instead of a fake verdict.
• Audit-safe reports. Gate and delivery reports record counts, ids, and verdicts only — no file contents or session text — and model-produced finding texts pass a secret redactor before storage or display.
• No network of its own. The plugin makes no direct network requests; the critic and reviewer subagents ride the harness subagent seam.
• Weak dependency on dsh-auto-review. It is never imported or hard-required; the gate folds its durable verdict records and degrades to the local reviewer, and never synthesizes approval requests.

• Durable writes. /doublecheck on\|off → doublecheck/state and /gate run → doublecheck/gate ride the host's ignorable append surface (post-rc.6), which every supported host (≥ 0.1.1-rc.2) provides.
• Optional seams. The doublecheck.gate settings namespace registers only when the settings service is mounted; the /gate status plan-mode line reads the optional ctx.planMode (shows unknown without it); the adversary review needs ctx.subagents; verification needs workflowEngine.
• Local degrade. gate.review.engine: auto degrades to the local reviewer when dsh-auto-review is absent or has no verdict records this session — the report names the reason instead of inventing a verdict.
• dsh-eval evidence is file-based. The dsh-auto-review eval engine (dsh-eval) writes its prompt-regression / stress / fairness results to a workspace report file, not the session log. gate.tests.evalReports.enabled folds that file (off by default; skips when absent) and the folded counts ride the durable doublecheck/gate record so a settled run still replays.

pnpm install             # node ^22.19 || >=24
pnpm run build           # tsc --noEmitOnError (lib/ is committed)
pnpm run prepare         # tsc --noEmitOnError (git-install channel)
pnpm run prepublishOnly  # build + full test suite
pnpm run typecheck       # tsc --noEmit + tests tsconfig
pnpm run lint            # eslint src tests
pnpm test                # vitest run
pnpm run test:coverage   # vitest run --coverage
pnpm run pack:check      # build + pack the tarball

dsh, dsh-plugin, deepseek-harness, engineering-discipline, requirements, guard, skill, quality-gate, delivery-gate

• @PerryLink — creator and maintainer: the grill → design → red → green → review → verify discipline loop, the four-phase delivery gate, the five-language docs, and the CI/release pipeline.

This project is one of the 15 DeepSeek Harness plugins maintained by PerryLink. If this one helps you, the others likely will too:

Apache License 2.0 © 2026 dsh-doublecheck contributors