1052326311/dsh-plan-lattice

Plan Lattice

Execution-time drift control for long-running DeepSeek Harness agents.

Plan Lattice is a passive continuity layer over DeepSeek Harness's native plan, Todo, Session, compaction, and subagent lifecycle. In default auto mode it restores exact authority already recorded by DSH only when a committed surfaceOp.replace removed its source from the model-visible Session. A cold resume reuses DSH's restored surface, and a fresh child receives only DSH's native standalone prompt. Auto adds no Lattice tools, state, contract, graph, or guard. A recursive graph and one-use action bases remain available only as explicit full-Lattice control.

Hand-designed mechanism stress test using real Harness runtime services:

• Unsafe stale-basis mutations: native 12/12; Plan Lattice 0/12.
• Matched legitimate controls: native 7/7; Plan Lattice 7/7.
• Unsafe post-SIGKILL continuations: native 2/2; Plan Lattice 0/2.
• Matched post-restart controls: native 2/2; Plan Lattice 2/2.

Benchmark · Raw results · Crash results · Executable driver · Field reports · CI

Status: v0.3.0 remains the latest stable release; v0.4.0-rc.6 is the current public runtime candidate. This checkout contains unreleased rc.8 native-continuity work, not an evidence-backed stable release. Focused mechanism and lifecycle tests have passed. V20 is a retained negative result: both arms scored 100, but the candidate exceeded its 4M input-token budget and did not execute final integration, so no uplift claim or release is allowed. V18 is also a retained negative result: native scored 88 with one hard miss, while the candidate scored 75 with two hard misses. The V18 driver bypassed DSH's model-facing foreground subagent result path, so it is neither evidence of uplift nor a valid delegation-continuity comparison. It must not be rerun under the same identity. The earlier frozen V17 pair produced an exploratory 100 versus 84 score and zero versus one hard miss, but both arms exceeded the 4M-input-token budget and neither completed all five lifecycle stages. The result therefore fails its preregistered evidence gate and is not a quality or uplift claim. The crash-safe v3 external-model study is frozen but has not executed against this runtime, so no general coding-quality uplift or ranking is claimed.

Evidence At A Glance

Try It

Try the public v0.4.0-rc.6 runtime candidate represented by the mechanism evidence above:

gh release download v0.4.0-rc.6 --repo 1052326311/dsh-plan-lattice --pattern '*.tgz'
dsh plugin --profile web add ./dsh-plan-lattice-0.4.0-rc.6.tgz

For the stable v0.3.0 release:

gh release download v0.3.0 --repo 1052326311/dsh-plan-lattice --pattern '*.tgz'
dsh plugin --profile web add ./dsh-plan-lattice-0.3.0.tgz

The stable release is also listed in the community-maintained Awesome DeepSeek Harness Plugin catalog and its dsh-market storefront. The catalog currently points to the audited v0.3.0 tarball; RC.6 remains an explicit prerelease install until its external evaluation is complete.

The package is an independent community plugin for DeepSeek Harness. To build the current checkout from source, run pnpm install, pnpm pack, and install the generated tarball with the same dsh plugin --profile web add command. Current official-release evidence and its claim boundaries are tracked in DeepSeek Harness release compatibility.

The First-Drift Test

A long task does not usually fail because its plan file vanished. It fails when one mutation finally executes from a basis that was incomplete, compacted away, superseded, or changed elsewhere. Explicit full-Lattice control makes that boundary executable: it joins the accepted contract, exact target bodies, live ownership, observable external preconditions, and, only in explicit full-Lattice mode, the current root-to-leaf address and required semantic evidence into a one-use authorization epoch.

The repository includes a deterministic stress test built on the real Harness context, session, agent-registry, compaction, and tool-runtime services. It deliberately invalidates one part of that basis immediately before a protected mutation. Each controlled arm must block before the protected tool body runs and match its preregistered enforcement mechanism; an unrelated exception does not count as a pass:

Observed result on these 12 engineered hazards: native executed 12/12 unsafe mutations; Plan Lattice executed 0/12, a 100 percentage-point difference on the tested mechanism. Reproduce it locally:

pnpm install --frozen-lockfile
pnpm run demo:first-drift:check

This is intentionally a mechanism stress test, not a sampled benchmark of software tasks. The 100% prevention rate applies only to the 12 hazards the test was designed to trigger. It does not estimate general coding quality, real-world task success, or production uplift. See the machine-readable results, rendered report, and reproducible driver.

The stricter external protocol remains frozen separately. V1 through V5 failed their first reveal; V6 failed annotation reliability; V7 lacked blind-stratum capacity; V8/V9 were retired before router reveal during source isolation; and V10 was retired before seed access when its frozen collector encountered an unhandled empty GitHub repository. V11 was then retired before seed access when live GitHub Search returned an object whose updated_at was later than the frozen historical cutoff, proving that the search index could not replay a trustworthy historical source frame. V13 replaces mutable search with 24 prospective, versioned GH Archive hour objects, freezes their raw gzip Merkle root before parsing any body, and uses a future public drand round only after three-annotator reliability and exact max-flow capacity pass. The complete protocol and router source are bound by the public router-v13-protocol-freeze-v2 release before source access. The original V13 tag was retired before source access after a crash-recovery audit; v2 keeps the source, router, labels, and gates unchanged while making its one reveal single-execution and crash-safe. These negative and retired results remain in the repository and are not repaired or relabelled as release evidence.

V13 has exactly one reveal and eight preregistered router gates. Passing it would establish source-disjoint automatic-control accuracy on that frozen sample only; it would not establish general coding-quality uplift. The executable stages, raw evidence requirements, thresholds, and retirement rules are in the V13 preregistration. Run all protocol controls locally with:

pnpm run router:v13:test

The RC.4 external-model study has a second, stricter evidence boundary. Its candidate, 96-slot order, hidden graders, release thresholds, first public runtime build, V13/V14 router gate, controller, preflight, analyzer, and retry policy are frozen before any paid model call. A later execution envelope may bind only the independently revealed router outcome, the preselected runtime bytes, and a new signing identity. See the preregistration and public v3 protocol freeze. Until its analyzer returns releaseAllowed: true, router accuracy and mechanism tests do not support a general software-quality claim.

Automatic Control

New installations default to activationMode: auto. In this mode Plan Lattice does not classify the request into a plugin-owned contract, graph, or read-only probe. It exposes no lattice_* tools, installs no mutation guard, injects no permanent Plan Lattice policy, and creates no workspace .dsh state. The native DSH model request and tool set remain unchanged until DSH crosses a real continuity boundary.

The automatic projection is assembled from DSH's append-only Session log. It may contain exact anchored human messages, the latest successfully approved native exit_plan_mode plan, and foreground subagent results already delivered through native tool/result, but only when their exact source messages are no longer in session.surface.nodes. The projection is frozen at the replacement event seq. Later user messages and child results remain on DSH's normal wire and cannot rebuild the old recovery payload. Native Todo remains current-turn DSH state and is never promoted into cross-turn authority.

Only a committed surfaceOp.replace activates that projection. A compaction/summary, process restart, fresh child, Todo update, tool result, or ordinary user follow-up is not independently a continuity loss. Cold resume reconstructs the durable replacement identity and retained runtime snapshot without appending a duplicate. A fresh child receives the exact parent-authored standalone prompt unchanged; only a later replacement in that child Session may restore the delegated instruction it removed.

Full contract and graph control is opt-in through activationMode: always, an explicit Use the full Lattice request, or resumed legacy graph state. This is the only mode in which intake, reframe, refresh, receipts, leases, checkpoints, tool restrictions, and mutation guards apply.

Root Invariant

Within the controlled long-task execution domain, drift has one precise form: a protected mutation executes from an intent or fact basis that is incomplete, no longer authoritative, or no longer current. If such drift occurs, the ordered execution has a first protected mutation with that invalid basis. This is a scoped invariant for that failure class, not a law about every model error or every task. Compaction, handoff, parallel agents, revised requirements, plan edits, and external state changes are mechanisms that can invalidate the basis.

The stable invariant is therefore not “keep a longer prompt” or “refresh before every edit.” It is: after DSH loses model-visible continuity, the next model request must be able to reconstruct the native execution basis that still governs the task. Default auto mode restores that basis as passive runtime context and does not authorize, guard, or intercept mutations. DSH continues to own ordinary repository reads, writes, planning, tool results, and lifecycle.

Explicit contract and full-Lattice modes intentionally provide a stricter pre-action basis containing:

1. the complete accepted execution contract;
2. the exact current contents of every declared target file, or a digest-bound fact that the target does not yet exist;
3. any proof still required from prior protected work; and
4. host-observable preconditions for non-filesystem side effects.

Only explicit full-Lattice mode adds a checked-out leaf and full root-to-leaf plan to that basis. Default auto mode does not create graph nodes, leases, or semantic checkpoints; DSH's native Plan Mode and Todo remain the sole planning representations.

In explicit full control, lattice_refresh_context({ targetPaths }) rebuilds and verifies that basis internally. In a stable native DSH conversation the original user request is already visible, so the result projects only the new receipt, exact target facts, and an optional full-Lattice leaf. It reprojects the full immutable contract only after a real surface replacement, resume, delegation, or material reframe. A built-in write, edit, or mutating str_replace_editor call is accepted only when its actual path is one of those targets and its body still matches the observed digest. The joined authorization epoch is consumed before validation or dispatch in explicit control, including failed attempts, so parallel or retried mutations cannot reuse it. A prepared dispatch then binds and locks the call identity and exact arguments; supported authority invalidation while an asynchronous dispatch middleware waits aborts the call before tool-body entry. The guard compares the contract revision and aggregate digest of every declared target, plus the graph revision and root-to-leaf digest only in explicit full-Lattice mode. Surface replacement, resume, reframe, plan mutation, handoff, disposal, or a concurrent durable change invalidates the whole epoch. Read-only str_replace_editor view calls do not.

The first accepted global definition for each guarded tool is pinned for the process lifetime, including its execute function. Scoped same-name shadows and later global replacements do not inherit trust, and any supported registry change aborts an active guard-to-body dispatch. Plan Lattice also locks the name and arguments of initially unguarded calls at its first dispatch middleware, so a later middleware cannot upgrade a harmless call into write or edit after the guard has run.

Non-filesystem guarded tools require a programmatic host precondition adapter. An adapter can bind exact action arguments to observable external state, or it can expose snapshotScope plus verifyScope for a host-observable scope such as the complete writable workspace. Scope authority does not pre-approve raw arguments: the guard still normalizes the eventual action, consumes one authorization epoch, locks the complete call identity, and rechecks the scope before tool-body entry. An explicit action binding suppresses broader automatic scope authority for that tool. Without either proof mode the guard fails closed. This includes strictBash: declaring files cannot prove that arbitrary shell text has no other side effects.

An adapter may implement normalizeArguments when the host tool adds display-only metadata after the context receipt is prepared. The normalized identity must be a synchronous, finite, acyclic JSON value; promises, class instances, sparse arrays, undefined, and non-finite numbers fail closed. snapshot and verify still receive the complete raw arguments. The adapter must reject every field omitted from the identity that can change execution semantics; only presentation metadata may be ignored.

In explicit full-Lattice mode, the recursive tree is a persistent execution address rather than a Todo display. Default auto mode does not add that address: after replacement compaction, cold resume, or handoff, it re-projects the native human authority, approved Plan, current Todo, returned child results, and Session lineage that DSH already recorded. A summary, model memory, inherited message, or parentSession does not replace those native records.

Inbox arrival and durable message append each invalidate authority. This closes the interval in which a receipt could otherwise be reissued after a message was queued but before it became model-visible. Every new human message after contract commitment stays fenced until the root agent reads the complete contract and exact pending messages with lattice_review_input, then durably commits contract-unchanged or contract-changed with lattice_commit_input_review. Another message consumes the prepared review. Plugin-authored operational notices also revoke ephemeral action authority, but they cannot revise the human product contract or raise reframePending. Delegated agents revalidate every live parent ownership edge when authority is issued, consumed, and dispatched; a stale parentSession value cannot revive a dead handoff.

In explicit full-Lattice mode, structural plan changes obey the same rule. Adding, splitting, updating, archiving, or checking out a node requires a one-action receipt from a complete contract and exact current plan-neighborhood reread; the change consumes the receipt and advances the revision. An artifact edit additionally binds the current root-to-leaf plan to the exact target body. A compacted summary never substitutes for either read.

In explicit control, the accepted contract, invariants, and acceptance criteria are the current constants. Discovered facts, plans, declared mutation targets, executors, and external state may change; a trend never authorizes a mutation. Default auto mode has no such contract or action binding. It restores only the DSH-native basis lost at a continuity boundary while DSH owns planning and execution. An explicitly selected tree adds a durable root-to-leaf address without freezing changeable state.