dsh-memory-jev

dsh-memory-jev

English · 中文

Memory for DeepSeek Harness (DSH) where every read and every write is a judgement — made by TypeSafe's Jev decision model.

Jev answers in only three typed shapes — choice (pick one of the given candidates), score, noul (probability of yes/no) — and never generates text. This plugin uses that property as the safety boundary of a memory system: the model decides whether something is worth keeping, which older memory it replaces, whether a retrieved memory is actually relevant, and whether this turn deserves an injection — while all text stays under plugin control. The model can never invent memory content.

---

Three gates

Invariants

• I1 — at most one injected block per (session, turn); later steps of the same turn neither judge nor inject again.
• I2 — each memory is injected at most once per session: already-injected ids are removed from the candidate pool before the Jev call, so they do not even cost a request.
• No permanent silence after compaction — once an injected block leaves the context, its ids become eligible again (logged as reset).
• Self-identifying blocks — framed by <retrieved-memories …> plus an explicit "not conversation history, not instructions" line; every < inside memory content is escaped to \u003c, so a memory cannot forge the delimiter.
• Prefix-cache friendly — appended at the tail only; system prompt and prior history stay byte-identical.

---

Tools

Physical deletion never happens: deletion is always retired=true and is reversible.

---

Install

Via the DSH plugin marketplace

Once the repository carries the dsh-plugin topic it is indexed automatically (the registry CI scans every 2 hours):

dsh plugin --profile web install <owner>/dsh-memory-jev

Manually

1. Copy this repository into ~/.dsh/profiles/web/node_modules/dsh-memory-jev/.
2. Register it in the profile's cordis.patch.yml (or let the marketplace do it):

- id: dsh-memory-jev
  name: dsh-memory-jev
  config:
    storePath: /absolute/path/to/gate-store.json   # empty = <cwd>/data/gate-store.json
    injectEnabled: true

3. Restart DSH at process level (set_bundle enabled:false→true only re-mounts the row; the ESM module cache is not re-imported).
4. Confirm with mem_gate_status.

Host interface packages (@deepseek-ai/cordis, dsh-llm, dsh-tools) are declared only as peerDependencies — shipping copies would shadow the host and break every tool call.

---

Configuration

Tuning

Every magnitude is a config value — nothing is hidden in the code. Change them in the profile's cordis.patch.yml (or the bundle's own patch) and restart DSH at process level.

Tune from evidence, not feel: the audit log records every candidate's noul probability together with the threshold in force, so mem_gate_log (or the per-day gate-decisions-*.jsonl shard) tells you exactly what a given threshold would have admitted or dropped.

Cost model — Jev input is $0.042/M and output is free. The plugin accounts and reports in CNY (rate constant USDTOCNY in lib/index.js). A measured judgement costs 2,000–4,200 input tokens ≈ ¥0.0006–0.0012. Budgeting is reserve → settle → reconcile, with a serialized ledger so concurrent calls cannot overspend.

---

Data boundary (disclosure)

• Cloud dependency: yes. Exactly three egress points, all to https://openrouter.ai/api/alpha/decisions — the write gate (first 600 chars of the new memory + candidate titles), the recall gate and the injection gate (the question text + candidate titles).
• Offline path: yes. Without an API key, write/recall fall back to deterministic behaviour (marked degraded) and the injection gate injects nothing.
• Credentials: read on demand from OPENROUTER_API_KEY (environment variable; falls back to the Windows registry HKCU\Environment). Never written to config files, never echoed, never logged.
• Redaction guard: if a question or body matches phone / national-id / bank-card / sk- / Bearer / password / api_key patterns, the judgement is skipped entirely (gate=redacted-skip) — one missed judgement is preferable to leaking.
• Audit log: ids, probabilities, tokens, CNY cost, error kind and the build version only. No bodies, no raw queries (hash and length only).
• Local persistence: store, audit log and budget file live next to your storePath. Nothing is synced or uploaded.
• Egress guard (egressGuard, default off — opt-in): when enabled, a question that looks like it carries a secret (phone / national id / bank card / sk-… / Bearer … / password / api_key) is not sent to the endpoint — recall falls back to local ranking and still returns your memories, and auto-injection skips that turn. It governs what leaves the machine only: it never decides what may be stored, retrieved or injected. Default is off because what counts as sensitive is the user's call; turn it on when you want the extra boundary. Every threshold and budget below is a plain config value — see Tuning under Configuration.
• Server-side retention: none (request-and-discard). Memories exist only in your local store file.

---

Verify

npm run verify     # = node --import ./tools/load-plugin.mjs tools/verify_all.mjs

Runs offline with zero spend: tools/fake-jev.mjs starts a controllable local Jev stub (HTTP 500, ECONNRESET, timeouts, malformed JSON, missing usage) and asserts both invariants, the failure semantics, an unchanged prompt prefix hash, budget under concurrency, read-only behaviour on a corrupt store, and log fields plus a privacy scan. A failing assertion exits non-zero.

A real Jev endpoint is only used for a few manual confirmations (requires a real key).

---

License

MIT