dsh-supreme

---

📊 At a glance

Every row below is re-runnable — see the proof wall.

---

🤔 Why Supreme

DSH's plugin ecosystem (3,421 catalog entries reviewed, 2026-09) is rich in single-domain tools — a router here, a memory store there, a verifier somewhere else. Each solves one slice of governance and asks you to trust its output.

Supreme is the opposite design. It is a full governance stack — cost policy, observability, routing, verification, memory policy, workflow limits, security audit — that treats proof as a product feature: every claim in this README maps to a command you can run, and every hard rule (deny paths, cost gates, secret scrubbing) is deterministic code, not model judgment.

The core rule of this repo: bukti sebenar > klaim — real evidence over claims. If a statement here can't be re-run by you, it's marked as a claim, not a fact.

---

⚡ 60-second install

The repository is a dsh bundle — no build step needed (dist/ is committed):

dsh plugin --profile <your-profile> add github:stadeummwt/dsh-supreme

That mounts all seven plugins with safe production defaults:

PAID / TRIAL routes  → DENIED (hard rule, LAB-only override)
UNKNOWN cost class   → DENIED
commands / network   → OFF by default
router candidates    → you add yours in your own patch layer (last write wins)

Zero-thought path: one command does everything

Don't want to think about environments, builds, or profiles at all? The built-in operator CLI (zero dependencies) diagnoses, installs, composes and boot-proves your setup:

node real/supreme.mjs doctor    # what's missing? (prints a fix line per check)
node real/supreme.mjs setup     # EVERYTHING: builds what's missing, runs the real
                                # `dsh plugin add`, applies the composition,
                                # boot-probes it → "SUPREME READY"
node real/supreme.mjs verify    # full verification ladder, PASS/FAIL per gate
node real/supreme.mjs setup --composition standard   # core|standard|supreme|lab

setup is idempotent and never modifies the upstream checkout. It will clone + pin + build the pinned DSH upstream only if it is missing (skip with --no-upstream-build).

v1.3.2 note (Windows): if an earlier version showed bundle:verify … obs stats 0 or a composition:verify dataDir failure — root cause found and fixed (store engines created their parent directory with a POSIX-only separator check; on Windows every record write was silently dropped). Re-run setup (rebuilds dist/), then re-run the verifiers — they now also print full writer stats + an exact diagnosis instead of a bare zero.

Pick a composition in one more line if you don't need all seven:

dsh --profile <your-profile> \
  --patch "$DSH_HOME/profiles/<your-profile>/node_modules/dsh-supreme/config/compositions/standard.patch.yml"

---

🧩 The seven governance plugins

Exactly seven. The scope is frozen (AGENTS.md) — no scope creep without a proven blocker.

flowchart TB
    subgraph SUP["Supreme plugin layer — project-owned, frozen 7"]
        P["supreme-policy"]
        O["supreme-observability"]
        BM["supreme-benchmark"]
        R["supreme-router"]
        V["supreme-verifier"]
        M["supreme-memory-policy"]
        W["supreme-workflow-policy"]
    end
    subgraph CORE["DSH core — pinned upstream · never modified"]
        C["ctx.llm · ctx.sessions · ctx.systemPrompt · ctx.tokenMeter · ctx.credentials · ctx.subagents · ctx.workflowEngine"]
    end
    P --> C
    O --> C
    BM --> C
    R --> C
    V --> C
    M --> C
    W --> C
    P -. consults .-> V
    P -. consults .-> R
    P -. consults .-> W
    O -. optional .-> V
    O -. optional .-> W
    BM -. history .-> R
    V -. evidence .-> W

Four support plugins (supreme-minimal-probe, supreme-boot-probe, supreme-gate-driver, supreme-fake-llm) exist only as test fixtures for the suite — they never ship in the bundle.

---

🏁 Proof wall — every verdict runnable

Don't trust this README. Run these:

Level A unit checks      101/101 PASS  (policy 17 · observability 7 · benchmark 11 · router 23
                                       verifier 11 · memory 13 · workflow 19)
v1.3.1 review probes     465/465      (cost 37 · verifier 43 · memory 88 · a2a 63 ·
                                       evidence 82 · outcome-routing 80 · failure-injection 72)
v1.3 E2E probes          184/184      (policy 85 · workflow 82 · routing 17 — real engines,
                                       real pinned-cordis adapters, no upstream build needed)
Real-loader boots        5/5 PASS     (supreme-minimal, core, standard, supreme, lab)
  boot times             supreme-minimal ~51–60 ms · core/standard/supreme/lab ~830–990 ms
Keyless scenario         9/9 gates PASS (real DSH session; router picks free route; PAID rejected)
Security                 sentinel leaks = 0 · paid automatic fallback = DISABLED
v1.2/v1.3 audit gates    config-key hygiene PASS · pinned-ref scan PASS ·
                         six-surface audit PASS (incl. the pinned `workflow/agent-start` seam) ·
                         schema contract PASS (3 schemas)
Upstream integrity       commit unchanged · worktree clean · patches = 0
Performance              router ≈ 0.02–0.04 ms / 1k · observability serialize ≈ 0.001–0.007 ms / 1k
VERDICT                  COMPLETE

Honesty rule: the real-loader path (real/boot.mjs) is the only real-integration evidence. The Level-A harness under src/harness/cordis-mini is a lifecycle fixture — it is never cited as DSH proof.

---

🔐 Security guarantees

---

🛡️ v1.3.1 review-hardening

Response to an external v1.3.0 review: 5 findings reproduced → fixed → proven (each with a failing test on the original code), plus outcome-based routing, evidence-bound verification, fast path/recovery, and a failure-injection harness. Full per-issue evidence — reproduction commands, root causes, before/ after outputs, remaining limits, and rollback steps (bash + PowerShell) — lives in docs/REVIEW-FIXES-v1.3.1.md.

Run it: bun run v131:verify (7 markers, 465 probes) — then read the doc before trusting this table.

📈 Benchmarks v1.3.1

Policy-enforcement delta across three labels — same runner, same datasets, thresholds frozen before evaluation, dev + held-out inputs disjoint:

All 6 thresholds PASS. Safety regressions (benign denials) block promotion.

• Method, limits and cleanup record: benchmarks/BENCH-v1.3.1.md
• Thresholds-then-evaluate: benchmarks/THRESHOLDS-v1.3.1.json · raw runs: benchmarks/runs/
• Re-run yourself: bun real/bench-v131.mjs --label C --reps 1 → BENCH_C_THRESHOLDS_PASS
• Astra (GPT-6): NOT_RUN — no verified public evaluation data; never fabricated (research note). This is a policy-enforcement benchmark, not a model-quality ranking.

🧬 v1.3 ASTRA-hardening features

Seven deterministic hardening features from the ASTRA-1 backlog (research/gpt6-astra-2026-09.md §7). No ML, no new deps — every feature is engine-checked in the keyless suite and proven end-to-end by bun run v13:verify (real engines + real pinned-cordis adapters). The shared label contract CapabilitySignal { capabilityClass?, cotVisibility? } is exported by supreme-policy and carried (never enforced) by the router.

supreme-policy — four features (config table)

Config key	Default	Meaning
cotVisibilityProfiles	{}	routeId → expected CoT visibility. A route declared none never denies on cot_missing — ENFORCE downgrades to audit-only (empty-CoT models can't be coerced into producing a trace). Resolution: explicit signal > profile > verbose.
riskGatedCoT	false	ENFORCE applies only to HIGH-risk tools (deterministic command/network/write name classifier); non-HIGH tools keep AUDIT.
denyCircumventionGuard	true	A same-shape retry of an already-denied call is refused with reason code deny_retry. The signature encodes argument NAMES + TYPES only — values can never enter it. First calls unaffected; resetDenyCircumvention(sessionId) is the escape hatch.
enableEncodingScan	false	Audit/deny ≥256-char base64/hex runs in tool arguments (encoding_blob; argument NAME + run LENGTH only). Extends the v1.2 taint surface: same event, same taintPolicy.
capabilityClassGate	'OFF'	Gate requests carrying capabilityClass: AUDIT records, ENFORCE denies unsanctioned classes. Unlabeled requests always pass untouched.
sanctionedCapabilityClasses / labCapabilityClassAllowlist	[] / []	Sanction lists; the LAB allowlist is additive and binds ONLY on the LAB floor. No implicit ROUTINE exemption — a self-declared label can only RESTRICT, never grant.

supreme-workflow-policy — two features (config table)

Config key	Default	Meaning
agentContactPolicy / allowedContacts	'LOG_ONLY' / []	A2A contact graph: directed { from, to } edges of agent ids/roles (empty = inert). Out-of-graph spawn/message contacts are audited as a2a_contact; under 'DENY' the pre-fact tools/pre-execute waterfall refuses with a2a_contact_denied. Emit-mode seams are DETECT-only.
maxRiskLevel / approvalRequiredFor	'HIGH' / []	Overreach audit: delegations above the risk ceiling, listed task classes without an approval flag, or paths outside the v1.2 scope are audited as overreach_suspected (labels, levels, flags, config globs — never content).

supreme-router + supreme-benchmark — anti-sandbagging (config table)

Config key	Plugin	Default	Meaning
requireEvidenceForScores	benchmark	false	Score claims without verifier-PASS evidence are flagged evidenceBacked: false on the score + run (flag only — scores never rewritten; re-evaluated when verification lands late).
unscoredEvidenceWeight	router	1	FIXED multiplicative downweight for unevidenced benchmark claims (e.g. 0.5 halves such scores); ids + factors recorded on the decision + unscored_evidence events (ids only). 1 = off, back-compat.
—	router	—	Carries capabilityClass / cotVisibility labels from candidates onto the selected RouteDecision (carrier, not enforcer).

Composition fragments (v1.3 posture)

Fragment	v1.3 keys
core	denyCircumventionGuard: true pinned (the one default-ON); everything else inherits OFF defaults
standard	enableEncodingScan: true + capabilityClassGate: AUDIT — audit-only, cannot block
supreme	same audit-only policy posture + requireEvidenceForScores: true + workflow keys pinned at behavior-preserving defaults
lab	enforcing demo: capabilityClassGate: ENFORCE + labCapabilityClassAllowlist, cotVisibilityProfiles + riskGatedCoT, declared contact graph + maxRiskLevel: MEDIUM, unscoredEvidenceWeight: 0.5

---

🧬 v1.2 governance features

Deterministic. No ML. No new runtime deps. Every feature binds to a real pinned upstream seam and ships with engine checks + boot-level proof (bun run v12:verify).

supreme-policy — unicode taint denial + CoT presence gate

Upstream freezes tool arguments after logging (wrappers may change only exec.signal), so the enforceable host-side posture is detect → audit → deny through the official tools/pre-execute seam ({ kind: 'deny', reason } — upstream materializes the error result; Supreme never fabricates tool output):

Config key	Default	Meaning
enableUnicodeSanitization	true	scan tool arguments for zero-width / bidi-isolate / bidi-override / tag codepoints (U+200B–200F, U+2060–206F, U+202A–202E, U+FEFF, U+E0000–E007F)
logTaintAttempts	true	record taint_detected events — class names only, values are NEVER echoed
taintPolicy	LOG_ONLY	DENY refuses the call before dispatch
reasoningTracePolicy	OFF	AUDIT records cot_missing when an assistant message carried no reasoning trace; ENFORCE additionally denies that session's tool calls (ENFORCE refused on the CORE floor)