zoahdev — engineering notes
zoahdev — engineering notes
Evidence-first engineering deep-dives on DeepSeek Harness and agent runtimes: root causes, reproductions, mechanism-level verification, and patches that are ready for upstream.
- Maintainer of the DSH ecosystem map (weekly editions) and a 42-patch upstream queue.
- Author of dsh-github-intelligence (196+ read-only tools, 16 ecosystems) and dsh-plugin-doctor.
- Every claim here comes with a reproducible trace; nothing is asserted without evidence.
Posts
-
Why compaction never fires in DSH web sessions · 2026-08-17
-
What 900 plugins taught me about an ecosystem’s first week · 2026-08-17
-
Time-travel debugging for agents: replaying a session from its ground truth · 2026-08-17
-
Tickets before motion, receipts after motion: permission infrastructure for physical AI · 2026-08-17
-
The symbol that broke every plugin in DeepSeek Harness · 2026-08-17
-
The first real finding: how 5 KB of parentheses crashes a package npm depends on · 2026-08-17
-
The bug that wasn’t: how testing kept me from reporting a false vulnerability · 2026-08-17
-
Regex injection in a 9-year-old package: what stale code teaches us · 2026-08-17
-
How to build trust in a plugin ecosystem · 2026-08-17
-
How to systematically audit a small plugin (and why ‘found nothing’ still counts) · 2026-08-17
-
From code processor to code execution: RCE in jdists · 2026-08-17
-
Five implementations, one contract: how the DSH doctor ecosystem converged · 2026-08-17
-
Catching a poisoned plugin before it runs: three layers and an honest threat model · 2026-08-17
-
Approval is not a security boundary · 2026-08-17
-
Agents that remember: verification-driven self-evolution · 2026-08-17
-
196 read-only tools, zero API keys: the discipline behind the catalog · 2026-08-17
Posts
-
Why compaction never fires in DSH web sessions
-
What 900 plugins taught me about an ecosystem's first week
-
Time-travel debugging for agents: replaying a session from its ground truth
-
Tickets before motion, receipts after motion: permission infrastructure for physical AI
-
The symbol that broke every plugin in DeepSeek Harness
-
The first real finding: how 5 KB of parentheses crashes a package npm depends on
-
The bug that wasn't: how testing kept me from reporting a false vulnerability
-
Regex injection in a 9-year-old package: what stale code teaches us
-
How to build trust in a plugin ecosystem
-
How to systematically audit a small plugin (and why 'found nothing' still counts)
-
From code processor to code execution: RCE in jdists
-
Five implementations, one contract: how the DSH doctor ecosystem converged
-
Catching a poisoned plugin before it runs: three layers and an honest threat model
-
Approval is not a security boundary
-
Agents that remember: verification-driven self-evolution
-
196 read-only tools, zero API keys: the discipline behind the catalog
subscribe via RSS