DeepSeek Better Harness

Better Harness reviews an agent
project by separating evidence into three independent concerns. This repository
carries those three concerns to the
DeepSeek Harness as one DSH
bundle that registers three independently routable skills.

Install once. Enable the lanes you want — the ones you leave out are never
registered, so they cost no routing surface and no context.

Unofficial. Not affiliated with, endorsed by, or released by Qoder or
DeepSeek. This is a community port of a boundary, not a redistribution of the
product — see NOTICE.

The three lanes

Lane	Reviews	Answers
session-evidence	Authorized session facts	Where did the agent repeat work, hit friction, or lose a feedback loop?
project-readiness	The repository itself	Does this repo give an agent a clear change path, bounded risk, and executable verification?
agent-assets	Skills, presets, hooks, tools, MCP config	Are the agent assets discoverable, correctly routed, intact, and safely owned?

Each lane contributes exactly one runtime skill through ctx.skills. A project
or user filesystem skill with the same name still overrides the bundled runtime
skill according to DSH precedence.

Each lane is also its own npm package under packages/, so a profile that wants
exactly one can install exactly one — see Install.

Why this instead of the upstream product

One lane, one job

Better Harness answers three different questions that fail in three different
ways. Collapsing them into a single "review my project" skill is what makes such
a skill vague enough to misfire. Here each lane is a separate skill with its own
boundary, and config.lanes decides which ones a profile registers at all:

- id: deepseek-better-harness
  name: deepseek-better-harness
  config:
    lanes: [project-readiness]

Wanting a readiness review does not drag in a session analyzer, a scoring
engine, and a report renderer. An unknown lane name is a startup error, not a
silently smaller skill set.

Zero runtime dependencies

Every package ships "dependencies": {}. The only declared dep is the DSH peer
package you already have. A bundle is 7 files and about 7 KB — it adds a
capability to your profile without adding a tree to your lockfile.

Every skill says when not to fire

All three descriptions carry an explicit negative clause:

Use when reviewing authorized DSH session facts for repeated work, agent
friction, missing feedback loops, or outcome evidence. Do NOT use to read
unapproved raw transcripts, infer hidden reasoning, score a whole repository,
or inspect project assets.

Misrouting is the expensive failure in a skill layer — the model loads the wrong
skill at the wrong moment, burns context, and drifts. Because the three lanes
here are deliberately adjacent, the negative clause is what keeps a session
question from pulling in the asset auditor. Most community skills only write the
positive half.

Evidence discipline is a mechanism, not a slogan

harness-session-evidence forces observed behavior, missing evidence, and
inference into separate buckets, and requires at least two comparable
occurrences before something may be called a pattern — one occurrence is a
candidate.

All three skills return evidence candidates rather than final severities or
repository-wide scores. That is not modesty: they ship no collectors, so they
are not entitled to the score. A skill that cannot see the evidence must report
that boundary instead of inventing a finding.

Validation actually installs the plugin

scripts/validate-packages.mjs does not lint manifests. It import()s every
real index.js, captures the skill each one registers, then asserts bundle
identity, frontmatter, resource paths, description limits, and teardown. A
package that is structurally perfect but fails to register is caught here rather
than in your profile. CI runs it on Linux and Windows.

Install

The repository root is the bundle: its manifest declares
dsh.bundle.patch, so DSH treats it as a profile layer and DSH Hub accepts it
as a submission. Tested baseline is DSH 0.1.0-rc.6.

From a commit

dsh plugin --profile web add "github:guyuefangyuanl/deepseek-better-harness#<commit-sha>"

Pin a commit rather than a branch: the skill text is the product here, and you
want a review you can reproduce later.

From a clone

git clone https://github.com/guyuefangyuanl/deepseek-better-harness.git
dsh plugin --profile web add "link:C:/absolute/path/to/deepseek-better-harness"

On 0.1.0-rc.6 the profile reconciles itself — a dependency whose manifest
declares dsh.bundle.patch is appended to dsh.profile.bundles automatically,
so there is nothing to edit by hand. Confirm the layer landed:

dsh --profile web --dump-config

If the layer is missing, DSH will have said why on stderr:

dsh: warning: <name> declares no dsh.bundle — installed as a plain dependency,
not a profile layer

Choosing lanes

All three lanes are enabled by default. To register only some of them, give the
bundle a config.lanes list in your profile patch:

- id: deepseek-better-harness
  name: deepseek-better-harness
  config:
    lanes: [project-readiness, agent-assets]

Valid names are session-evidence, project-readiness, and agent-assets. An
unknown name, an empty list, or a non-array fails at startup instead of quietly
registering fewer skills than you asked for.

Installing a single lane instead

Each lane is also a standalone package, for a profile that should never be able
to route to the other two:

dsh plugin --profile web add "link:C:/absolute/path/to/deepseek-better-harness/packages/project-readiness"

Do not install both the root bundle and a lane package into one profile — the
lane would be registered twice.

Requirements

The selected profile must already provide the DSH skills service and a
user/model skill surface. This bundle installs no lifecycle scripts: there is no
preinstall, install, postinstall, or prepare, and nothing is compiled on
your machine. What is in the tarball is what runs, and CI asserts that.

Validate

No dependencies. Node.js 22:

node scripts/validate-packages.mjs
node scripts/pack-dry-run.mjs

Two things that look like bugs and are not

parseCanonicalSkill is duplicated verbatim in all three packages. A shared
helper would couple three independently publishable bundles to a common
versioned runtime dependency for about thirty lines of parsing — and break the
zero-dependency property that makes a single-package install cheap. The
validator asserts every copy still produces an identical skill shape. See
the design note.

Publishing is not automated. Registry credentials, package ownership,
release tags, and community submission are external actions.

Boundary

• Better Harness remains the full product: evidence collection, reconciliation,
  scoring, and rendering. This repository ports its three evidence boundaries
  as prompt-level skills and never claims an unavailable collector ran.
• These bundles contribute prompt text and a small loader. They open no ports,
  spawn no processes, and make no network requests. See SECURITY.md.
• DSH is pre-release. Re-run the checks above before claiming support for a
  newer DSH than the declared baseline.

Contributing and security

CONTRIBUTING.md covers the checks and the rules that are not
negotiable. SECURITY.md covers the trust boundary and how to
report a vulnerability.

Author and license

Created and maintained by @guyuefangyuanl.

MIT. See NOTICE for attribution and the unofficial-status statement.