@@ -7,6 +7,83 @@ This project follows semantic versioning from 1.0 onwards; 0.x releases may chan
 
 ## [Unreleased]
 
+The description now fits the harness that renders the smallest slice of it, and the eval runner can
+measure DeepSeek Harness alongside the two harnesses it already ran. A description is what a harness
+matches a request against, and dsh renders `name` plus a normalized description capped at 500
+characters — anything longer is truncated with an ellipsis, never rejected. The previous
+1019-character description therefore lost its second half inside dsh, including both negative
+predicates ("silent on a fully stated task", "not for explaining existing state") that keep
+auto-invocation off work that needs no convergence. It is now 491 characters and keeps every
+predicate, including the qualifier that lets a complete request still be premised-checked ("silent
+on a fully stated request its sources do not contradict"); the `ask`-budget detail it dropped lives
+in §4.3, where it is executed. Three passages of
+environment mechanics that restate what any harness already does — how to call tools, how to retry a
+shell command, why a reply keeps its fence — are gone from `SKILL.md`, and the evidence exclusion
+list gained `.dsh/`, the directory dsh installs from. The file is 493 lines.
+`--check-frontmatter` now fails above 500 characters, with the dsh cap as its stated reason.
+
+`evals/run.py` gains `--harness dsh`, which drives `dsh --profile headless` and parses its `--json`
+event stream: only assistant prose is a candidate reply, so a run that correctly stays silent is
+never scored against the skill text its own tool output carried. Each dsh run gets an isolated
+`DSH_HOME` and `DSH_AGENTS_HOME` beside its workspace, a generated `--patch` overlay that pins the
+skill surface to the workspace and the posture to a read-only sandbox with approval `never`,
+credentials copied in as a file, and a fourth preflight session that measures the isolation instead
+of asserting it. The posture is not the shipped default because the shipped `workspace-write`
+sandbox cannot read the runner's temporary workspaces on Windows — every shell call is denied there
+and a run spends its budget diagnosing the sandbox instead of probing. `--delivery`
+and `--rescore-delivery` refuse dsh — their per-arm configuration and report section do not exist
+for it yet. Adding `.dsh` to the delivery diff's runner-owned paths keeps the installed copy and
+anything the model writes under it out of the delivered-work check, exactly as `.claude` and
+`.agents` already did.
+
+`references/harness-compat.md` corrects its dsh row — explicit invocation is `/<skill>`, and the
+project directory is both `.dsh/skills/` and `.agents/skills/` — and its notes now record the
+500-character description cap, that `whenToUse` and `metadata` are parsed but never rendered, the
+root ranking, the `.system` exclusion, and that dsh's project root is the nearest `.git` ancestor.
+
+`README.md` gains the dsh install paths and the `/intent-router` invocation. The description change
+is a triggering-surface change, so it was measured on dsh itself: a six-case subset covering four of
+the suite's auto-mode cases (including both the report scores for auto-trigger) passed 5/6, with
+zero hallucinated evidence (`evals/reports/2026-10-15-dsh.md`). The sixth case, `git-only-fact`,
+failed — and that failure is the sandbox's, not the skill's: following a reference that only version
+history explains needs a shell that can read the repository, and on Windows the dsh sandbox cannot
+read the runner's own temporary workspaces; the same case passes on dsh with confinement off, which
+is how the failure was localized. Reports now also record the SHA-256 of the `SKILL.md` that ran,
+because the commit alone does not identify an uncommitted working tree. The OpenCode numbers above
+were not re-measured against the new description.
+/
+描述现在适配"渲染得最少"的那个 harness，评测跑分器也能把 DeepSeek Harness 和前两个 harness 一起测
+了。description 是 harness 拿来做请求匹配的字段，dsh 只渲染 `name` 加一段归一化后的描述、上限 500
+字符——超长会被省略号截断而不是报错。旧描述 1019 字符，因此在 dsh 里**后半段整体消失**，其中包括两条
+否定谓词（"任务已完整说明时保持沉默"、"不用于解释现状"），而它们正是防止自动触发在无需收敛的工作上开
+火的条件。新描述 491 字符，谓词一条不少，包括让"完整请求仍可做前提检查"的那句限定语（"silent on a
+fully stated request **its sources do not contradict**"）；被它省下的提问预算细节在 §4.3 里，那里才是执行位置。
+`SKILL.md` 删掉三处"环境机制"交代（怎么调工具、怎么重试 shell 命令、回复为什么保留围栏），这些是任何
+harness 都已经在做的事；evidence 排除清单补上 `.dsh/`（dsh 的安装目录）。全文 493 行。
+`--check-frontmatter` 现在超过 500 字符即失败，并在输出里写明理由是 dsh 的目录渲染上限。
+
+`evals/run.py` 新增 `--harness dsh`：驱动 `dsh --profile headless`，解析它的 `--json` 事件流——只有
+assistant 正文进入候选，因此一次"正确地保持沉默"的运行不会被它自己工具输出里的技能正文误判。每次 dsh
+运行都在工作区旁拿到隔离的 `DSH_HOME`/`DSH_AGENTS_HOME`、一份自动生成的 `--patch`（把技能面钉在工作区、
+把权限姿态钉成只读沙箱 + 审批 `never`）、以文件形式复制进来的凭据，以及第四个 preflight 会话**实测**这套
+隔离，而不是声称它成立。之所以不用随包默认姿态：随包的 `workspace-write` 沙箱在 Windows 上读不到 runner
+的临时工作区，每次 shell 调用都被拒绝，一次运行会把预算花在诊断沙箱而不是探测上。`--delivery` 与
+`--rescore-delivery` 对 dsh 直接拒绝：它们的每臂配置与报告段落尚不存在。把 `.dsh` 加进交付 diff 的
+"runner 自有路径"，是为了让安装副本与模型写在 `.dsh/` 下的任何东西都不被算作交付——`.claude` 与
+`.agents` 早就如此。
+
+`references/harness-compat.md` 修正 dsh 行——显式调用是 `/<skill>`，项目目录是 `.dsh/skills/` 与
+`.agents/skills/` 两处——并在注意事项里记下：500 字符描述上限、`whenToUse` 与 `metadata` 会被解析但
+从不渲染、技能根优先级、`.system` 例外，以及 dsh 的项目根是最近的 `.git` 祖先。
+
+`README.md` 补上 dsh 的安装路径与 `/intent-router` 调用方式。description 属触发面改动，因此直接在 dsh
+上实测：覆盖套件中四个 auto 模式用例（含报告里计入自动触发指标的那两个）的 6 例子集通过 5/6，零编造
+evidence（`evals/reports/2026-10-15-dsh.md`）。第六个用例 `git-only-fact` **失败，而这是沙箱的失败、不是
+skill 的**：要跟随一条"只有版本历史能解释"的引用，需要一个能读仓库的 shell，而在 Windows 上 dsh 沙箱读
+不到 runner 自己的临时工作区；同一用例在不设限的 dsh 下通过，失败因此定位在沙箱。报告现在还会记下实际运行
+的那份 `SKILL.md` 的 SHA-256，因为未提交的工作树上"提交号"不足以定位内容。上面那些 OpenCode 数字没有针对
+新描述重测。
+
 ## [1.3.0] — 2026-10-09
 
 The saved contract becomes a two-way artifact. It gains an optional `verification_status`
 
@@ -447,6 +447,8 @@ agent reads:
 
 - `.claude/skills/` — Claude Code
 - `.agents/skills/` — Cursor, Codex, OpenCode, Gemini CLI, Copilot, Pi, Amp, Zed and others
+- `.dsh/skills/` — DeepSeek Harness (dsh); it scans one level deep and takes the nearest `.git`
+  ancestor as the project root, so the copy belongs at `<repo>/.dsh/skills/intent-router/`
 
 Add `~/` in front for a global install. Per-harness paths, including the ones that use their own
 directory name, are in
@@ -462,24 +464,24 @@ when you remember to invoke it. (`grill-me`, by contrast, documents that *"the a
 for it on its own."*) Force it when you want to:
 
 ```
-/intent-router refactor the auth module     # Claude Code, Cursor, Copilot, Zed, Kiro, Augment
+/intent-router refactor the auth module     # Claude Code, Cursor, Copilot, Zed, Kiro, Augment, dsh
 $intent-router refactor the auth module     # Codex
 /skill:intent-router refactor the auth module   # Pi, Kimi Code
 ```
 
 <details>
 <summary>Which agents it runs in</summary>
 
-`SKILL.md` names no tools — it asks for *"whatever file-reading, search, or shell capability your
-environment provides"* — so it runs anywhere that reads the
+`SKILL.md` names no tools — it asks for *"the read, search and shell capability the environment
+has"* — so it runs anywhere that reads the
 [Agent Skills](https://agentskills.io/) format.
 
-**verified** (run here, report in `evals/reports/`) — OpenCode
+**verified** (run here, report in `evals/reports/`) — OpenCode, DeepSeek Harness (dsh)
 
 **spec-compatible** (its docs say it loads standard `SKILL.md`; not exercised here) — Claude Code,
-Codex CLI, Cursor, GitHub Copilot (CLI and VS Code), Gemini CLI, Antigravity, Windsurf, DeepSeek
-Harness (dsh), Pi, Qwen Code, Kimi Code CLI, Trae, Cline, Roo Code, Kilo Code, Goose, OpenHands,
-Amp, Zed, Warp, Kiro CLI, Junie, Augment, Factory Droid
+Codex CLI, Cursor, GitHub Copilot (CLI and VS Code), Gemini CLI, Antigravity, Windsurf, Pi, Qwen
+Code, Kimi Code CLI, Trae, Cline, Roo Code, Kilo Code, Goose, OpenHands, Amp, Zed, Warp, Kiro CLI,
+Junie, Augment, Factory Droid
 
 **needs-adapter** (no documented skill mechanism; paste `SKILL.md` into the system prompt) —
 Continue
@@ -507,6 +509,7 @@ else.
 2026-09-24 · opencode · dp/deepseek-flash · delivery add-caching-delivery · bare 5.0/6 (N=5) · with skill 6.0/6 (N=3) · ADR trap avoided bare 5/5 vs skill 3/3
 2026-09-24 · opencode · (harness default) · 4/4 subset cases · probe ratio 0.25 · 0 over-asks · 0 hallucinated evidence
 2026-09-27 · opencode · dp/deepseek-flash · 6/6 subset cases · probe ratio 0.44 · 0 over-asks · 0 hallucinated evidence
+2026-10-15 · dsh · opencode-go3/deepseek-v4.1-flash · 5/6 subset cases · probe ratio 0.35 · 0 over-asks · 0 hallucinated evidence
 <!-- evals:end -->
 
 Line by line: line 1 is a full-suite run of the suite as it stood on 2026-09-23, which was ten
@@ -516,8 +519,12 @@ project's result metric — the skill arm delivered 6/6 on all three runs and ev
 cache failure policy, where none of the 5 bare runs did; line 4 is the v1.1.0 release
 verification, a 4-case subset run; line 5 is a subset run verifying the three request-defect
 cases (`ambiguous`, `conflict`, `premise`) added for v1.2.0 alongside the three cases that change
-could disturb. Probe ratio is a diagnostic metric, never judged. The suite is seventeen cases,
-which puts the full-suite threshold at 14 of 17 with zero hallucinated evidence; no full-suite
+could disturb; line 6 is the first DeepSeek Harness (dsh) run, a 6-case subset whose four auto-mode
+cases are the evidence for the description rewrite. Its sixth case, `git-only-fact`, failed, and
+the failure is the sandbox's rather than the skill's: reaching a fact that lives only in version
+history needs a shell that can read the repository, and on Windows the dsh sandbox cannot read the
+runner's own temporary workspaces — the same case passes on dsh with confinement off. Probe ratio
+is a diagnostic metric, never judged. The suite is seventeen cases,
 run at that size has been published yet. Every published report is in
 [`evals/reports/`](evals/reports/).
 
 
@@ -403,6 +403,8 @@ skill 没自动触发的 session 里也被读到：*"若 `.intent/` 里有未结
 
 - `.claude/skills/`——Claude Code
 - `.agents/skills/`——Cursor、Codex、OpenCode、Gemini CLI、Copilot、Pi、Amp、Zed 等
+- `.dsh/skills/`——DeepSeek Harness（dsh）；它只扫一层，并以最近的 `.git` 祖先为项目根，
+  所以副本要放在 `<仓库>/.dsh/skills/intent-router/`
 
 前面加 `~/` 就是全局安装。逐个 harness 的路径（包括那些用自己专属目录名的）在
 [`references/harness-compat.md`](skills/intent-router/references/harness-compat.md)。
@@ -415,23 +417,23 @@ system prompt 即可。`references/` 是按需加载的，可以一起粘，也
 （相比之下 `grill-me` 自己的文档写着 *"agent 不会主动去用它。"*）想强制触发就：
 
 ```
-/intent-router refactor the auth module     # Claude Code、Cursor、Copilot、Zed、Kiro、Augment
+/intent-router refactor the auth module     # Claude Code、Cursor、Copilot、Zed、Kiro、Augment、dsh
 $intent-router refactor the auth module     # Codex
 /skill:intent-router refactor the auth module   # Pi、Kimi Code
 ```
 
 <details>
 <summary>它能在哪些 agent 里跑</summary>
 
-`SKILL.md` 不点名任何工具——它只要求 *"你的环境提供的任何读文件、搜索或 shell 能力"*——所以凡是能读
+`SKILL.md` 不点名任何工具——它只要求 *"环境具备的读取、搜索与 shell 能力"*——所以凡是能读
 [Agent Skills](https://agentskills.io/) 格式的地方它都能跑。
 
-**verified**（在这里跑过，报告在 `evals/reports/`）——OpenCode
+**verified**（在这里跑过，报告在 `evals/reports/`）——OpenCode、DeepSeek Harness（dsh）
 
 **spec-compatible**（其文档声称支持标准 `SKILL.md`；本项目未实测）——Claude Code、Codex CLI、
-Cursor、GitHub Copilot（CLI 与 VS Code）、Gemini CLI、Antigravity、Windsurf、DeepSeek Harness
-（dsh）、Pi、Qwen Code、Kimi Code CLI、Trae、Cline、Roo Code、Kilo Code、Goose、OpenHands、Amp、
-Zed、Warp、Kiro CLI、Junie、Augment、Factory Droid
+Cursor、GitHub Copilot（CLI 与 VS Code）、Gemini CLI、Antigravity、Windsurf、Pi、Qwen Code、
+Kimi Code CLI、Trae、Cline、Roo Code、Kilo Code、Goose、OpenHands、Amp、Zed、Warp、Kiro CLI、
+Junie、Augment、Factory Droid
 
 **needs-adapter**（没有公开的 skill 机制；把 `SKILL.md` 粘进 system prompt）——Continue
 
@@ -456,15 +458,20 @@ Zed、Warp、Kiro CLI、Junie、Augment、Factory Droid
 2026-09-24 · opencode · dp/deepseek-flash · delivery add-caching-delivery · bare 5.0/6 (N=5) · with skill 6.0/6 (N=3) · ADR trap avoided bare 5/5 vs skill 3/3
 2026-09-24 · opencode · (harness default) · 4/4 subset cases · probe ratio 0.25 · 0 over-asks · 0 hallucinated evidence
 2026-09-27 · opencode · dp/deepseek-flash · 6/6 subset cases · probe ratio 0.44 · 0 over-asks · 0 hallucinated evidence
+2026-10-15 · dsh · opencode-go3/deepseek-v4.1-flash · 5/6 subset cases · probe ratio 0.35 · 0 over-asks · 0 hallucinated evidence
 <!-- evals:end -->
 
 逐行说明：第 1 行是 2026-09-23 当日套件规模（10 例）下的全量单次运行；第 2 行是当天提示词强化后
 对 8 用例子集的单次重测——子集口径，与全量数字分开陈述；第 3 行是交付对照，本项目的**结果指标**——
 skill 臂三次运行全部交付 6/6，且每次都写明了缓存失败策略，不装的 5 次一次都没有；第 4 行是 v1.1.0
 发版核验，4 用例子集运行；第 5 行是 v1.2.0 新增的三个请求缺陷用例（`ambiguous`、`conflict`、
-`premise`）连同该改动可能影响的三个回归用例一起的子集运行。probe ratio 是**诊断指标**，从不参与
-判定。套件现为 17 例，全量阈值随之为 17 例中至少通过 14 例、且零编造 evidence；这一规模下的全量
-运行尚无公开报告。所有公开报告都在 [`evals/reports/`](evals/reports/)。
+`premise`）连同该改动可能影响的三个回归用例一起的子集运行；第 6 行是 DeepSeek Harness（dsh）的首次
+运行，6 用例子集，其中四个 auto 模式用例正是 description 改写所依据的证据。第六个用例
+`git-only-fact` 失败，而这是沙箱的失败、不是 skill 的：要拿到"只存在于版本历史里的事实"，需要一个能读
+仓库的 shell，而在 Windows 上 dsh 沙箱读不到 runner 自己的临时工作区；同一用例在不设限的 dsh 下通过。
+probe ratio 是**诊断指标**，从不参与判定。套件现为 17 例，全量阈值随之为 17 例中至少通过
+14 例、且零编造 evidence；这一规模下的全量运行尚无公开报告。所有公开报告都在
+[`evals/reports/`](evals/reports/)。
 
 怎么自己跑、每个用例查什么：[`evals/README.md`](evals/README.md)。
 
 
@@ -235,16 +235,17 @@ itself as a finding.
 
 The boundaries matter more than the conclusions, so here they are:
 
-- **One model, one harness have a publishable report** (opencode + `dp/deepseek-flash`).
+- **Two harnesses have publishable reports** (opencode + `dp/deepseek-flash`; DeepSeek Harness
+  (dsh) + `opencode-go3/deepseek-v4.1-flash`, a 6-case subset), and one model serves both.
 - **The Claude Code report was withdrawn.** The 2026-09-22 run went through a channel that forced
   `thinking` off and answered English prompts in Chinese, so its failures cannot be attributed to the
   skill. The report was removed from the repo and Claude Code dropped to `spec-compatible`. The
   methodology and cases stay public; **only the report is held back** — a number nobody can attribute
   should not be published.
 - **`codex` has never been evaluated.** It appears only as a `spec-compatible` target in the
   compatibility docs (its docs say it loads standard `SKILL.md`; not exercised here). The runner
-  supports `claude-code` and `opencode` only.
-- **The full-suite threshold is 14/17**, but **no full-suite run at that size has been published**.
+  supports `claude-code`, `opencode` and `dsh`; the dsh channel cannot score a case that needs to
+  read the workspace's git history, because the Windows sandbox denies the shell that access.
   The most recent committed report is a subset run.
 - **The delivery comparison is small** (bare N=5, skill N=3). It can show that the skill arm states a
   failure policy; it cannot give you a precise effect size.
 
@@ -1,4 +1,4 @@
-# agent 为什么会猜错意图：17 个可判定的用例
+# agent 为什么会猜错意图：18 个可判定的用例
 
 > 写于 2026-10-03。本文所有数字都来自 `evals/reports/` 里已提交的报告，没有一处估计值。
 > 方法论见 [`../evals/README.md`](../../evals/README.md)，用例定义见 [`../../evals/cases.yaml`](../../evals/cases.yaml)。
@@ -197,7 +197,7 @@
 
 我把边界写清楚，因为这些边界比结论更影响你怎么用它：
 
-- **只有一个模型、一个 harness 出过可发布的报告**（opencode + `dp/deepseek-flash`）。
+- **有两个 harness 出过可发布的报告**（opencode + `dp/deepseek-flash`；DeepSeek Harness（dsh）+ `opencode-go3/deepseek-v4.1-flash`，6 例子集），两者都由同一个模型家族应答。
 - **Claude Code 的报告被撤回了。** 2026-09-22 那次跑在一个强制关闭 `thinking`、且对英文提问用中文回答的通道上，失败无法归因于 skill 本身。报告已从仓库移除，Claude Code 降级为 `spec-compatible`。方法学和用例保持公开，**只有报告被扣下**——一个无法归因的数字，不该被发布。
 - **`codex` 从未被评测。** 它只在兼容性文档里被列为 `spec-compatible`（文档声称支持标准 `SKILL.md`，本项目未实测）。runner 支持的目标只有 `claude-code` 和 `opencode`。
 - **完整套件的门槛是 14/17**，但**这个规模的完整套件运行还没有发布过**。已提交的最新报告是子集运行。