DeepSeek Harness Makes a Serious Promise. I Would Audit It Before Letting It Touch a Repository DeepSeek Harness 做出了严肃承诺，但在让它接触代码库之前，我会先审计它

TL;DR

• DeepSeek Harness prioritizes auditability and transparency in AI coding agents through an append-only session record that enables full reconstruction of the context presented to the model
• The article argues that a coding agent's usefulness depends less on its ability to produce impressive diffs and more on its capacity to provide a comprehensible, evidence-grade paper trail of every decision, tool call, and permission change
• Key audit requirements include tracking exact instruction files loaded (with versions and precedence), separating model proposals from human-approved actions, recording plugin configurations, and detecting approval drift where agents subtly modify parameters after permission is granted
• The recommended evaluation strategy involves starting with deliberately narrow, boring tasks to test whether the harness can leave a traceable record before granting broader repository access
• The durable model for production AI agents is one that moves quickly within clear boundaries and makes its work easy to inspect, pause, and correct, rather than one that sells full autonomy as its primary feature

Why It Matters

This article addresses a critical gap in the current AI agent ecosystem: the difference between a system that appears competent in demos and one that is genuinely trustworthy in production environments. For AI practitioners deploying coding agents, the audit trail quality is as important as the agent's output quality, since unexplainable autonomous actions in a codebase can introduce subtle bugs, security vulnerabilities, or compliance violations that are extremely costly to trace after the fact.

Technical Details

• DeepSeek Harness uses an append-only session record architecture designed to make the exact state shown to the model reconstructible from the log, treating agent history as an engineering artifact rather than a casual chat transcript
• The system emphasizes tracking which repository instruction files (AGENTS.md, CLAUDE.md, project notes) were discovered, loaded, and included in the prompt, along with their order, version, and any conflicts between them
• Tool permissions require a four-part trail distinguishing proposal, approval, execution, and result, with the exact command, working directory, applicable permission rule, and approving entity or policy recorded for each action
• Plugin architecture flexibility is acknowledged as both a capability and a liability, requiring a manifest that records which plugins were enabled, their versions, configuration values that affected behavior, and which plugin owned each tool call
• The proposed evaluation framework includes four task types: a small code change, a task requiring the agent to stop for missing information, a task testing permission boundary crossing, and a task with intentionally conflicting instructions, each assessed against five traceability questions

Industry Insight

The coding agent market is approaching an inflection point where the differentiator will shift from raw capability to verifiable reliability, and organizations that prioritize auditability in their agent selection process will avoid costly production incidents caused by opaque autonomous actions. Teams should treat agent evaluation as an ongoing operational discipline rather than a one-time benchmark check, pinning versions, exporting configurations, and replaying known tasks after any plugin or instruction file changes to detect behavioral drift. The most practical path to broader agent permissions is incremental trust earned through transparent performance on bounded tasks, not demonstrated ability on dramatic or complex ones.

TL;DR

• DeepSeek Harness将可追溯的审计记录置于设计核心，强调append-only session record和可重建的model context，而非仅仅提供流畅的对话界面
• 文章严格区分"transcript"与"audit trail"：前者只是对话记录，后者需能回答指令版本、工具调用、审批时机等关键问题
• 建议从简单、边界清晰的任务开始审计，验证agent是否能留下可理解的paper trail，而非直接信任其demo表现
• 强调instruction files、tool permissions和plugins都需要独立的审计记录，特别警惕approval drift风险
• 提出五个评估问题：能否识别确切指令、列出所有操作、区分提案与审批、复现context、从日志解释最终diff

为什么值得看

这篇文章为AI从业者提供了评估coding agent安全性的实用框架，强调审计能力比demo表现更重要。对于考虑在生产环境部署agent的团队，提供了具体的验证方法和风险点识别。

技术解析

• DeepSeek Harness采用append-only session record架构，核心承诺是能从日志重建呈现给model的完整context，包括指令文件版本、读取的文件、执行的命令及工作目录、人类审批时机
• 建议的测试场景包括：简单代码变更、缺少信息时应停止的任务、尝试跨越权限边界的任务、存在冲突指令的任务，用于验证agent的scope意识和可审计性
• 插件架构需要manifest记录：启用的插件、版本、配置值变更、每个tool call的归属，否则不同session可能因隐藏配置差异产生不同行为
• 工具权限日志需分离proposal、approval、execution、result四个阶段，记录确切命令、操作目录、适用权限规则、审批人或策略，防止approval drift
• 评估框架包含五个问题：能否识别model所见的确切指令和配置、能否列出所有文件/命令/外部操作、能否区分model提案与已审批操作、能否让其他工程师复现context、能否从日志证据解释最终diff

行业启示

• Agent安全性评估应从审计能力而非demo表现出发，可追溯性和可中断性比功能强大更重要，生产环境部署需建立渐进式权限扩展机制
• 团队应建立agent操作的标准化审计流程，确保非原始会话参与者也能理解决策过程，instruction files冲突等隐蔽风险需主动测试
• 开源agent工具的透明度不等于安全性，可检查的引擎仍可能连接不透明或配置不当的组件，需保持 operational discipline 而非依赖faith