# ARIS on DeepSeek Harness

English | [中文](https://github.com/wanshuiyin/Auto-claude-code-research-in-sleep/blob/dsh-aris/README_CN.md)

> The `dsh-aris` distribution branch. The full ARIS project — every workflow, the docs, and the other host adaptations — lives on [`main`](https://github.com/wanshuiyin/Auto-claude-code-research-in-sleep).

Runs the ARIS research workflow inside [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): all 83 upstream ARIS skills (synced to upstream `341f914`) plus 3 local skills and 9 Claude reviewer overlays in the native skill catalog, with cross-model adversarial review through Codex.

The skills are unmodified. This bundle is one configuration layer plus a short adapter — it patches no Harness code and forks nothing.

## Install

```sh
dsh plugin --profile web add dsh-aris
```

Restart the profile afterwards; plugin code loads at startup, so reloading the page is not enough.

`dsh plugin` shells out to **pnpm**, which the Harness does not bundle. Without it on `PATH` the install exits before doing anything.

## Prerequisites

**Codex CLI, installed and authenticated.** It is the independent reviewer. The bundle spawns `codex mcp-server` and never overrides its model or reasoning effort — **`~/.codex/config.toml` is the reviewer posture contract**. ARIS expects a non-DeepSeek family at `xhigh`:

```toml
model = "gpt-6-astra"
model_reasoning_effort = "xhigh"
```

If Codex cannot start, the Harness fails to boot rather than running a composition with no reviewer. That is deliberate: ARIS without an independent reviewer is not ARIS.

**A DeepSeek API key**, through the Harness Models page or `DEEPSEEK_API_KEY`.

**Behind an HTTP proxy**, start the Harness with `NODE_USE_ENV_PROXY=1`. Node's fetch ignores `http_proxy` otherwise, and model requests fail with `TRANSPORT`. It must be set when Node starts; configuration cannot repair an already-started process.

**Optional — bound the executor too.** ARIS's reviewers already carry scope limits: the block that forbids proposing hashes, defensive scaffolding, corner-case hardening, and over-mechanized judgement is embedded in the skills that produce review prompts, and applies with no setup. Nothing bounds the *executor* the same way. Two ways to close that, and they are different things:

- **ARIS's own limits, one flag.** The `aris-scope-limits` row ships disabled; set `disabled: false` in your profile's patch to apply the same block to the executor. It reads the packaged `skills/shared-references/review-scope-limits.md` at load, so the reviewer path and the executor path cannot drift apart. Off by default because it spends tokens on every request.
- **The full [HERO](https://github.com/wanshuiyin/HERO-Anti-OverDefense) contract.** Paste its canonical block into the project's `AGENTS.md` or `CLAUDE.md`, or into `$DSH_HOME/AGENTS.md` for every dsh project — the Harness loads those files itself. This bundle does not vendor HERO's text; its canonical home is HERO's own `RULES.md`.

## Verify

```sh
dsh --profile web --dump-config | grep -A2 aris-
```

Then, in a session, type `/` — the skill menu lists the ARIS skills. To check the part that matters, ask the model to call `mcp__codex__codex` with a trivial prompt, report the `threadId` it can see, then continue that thread once with `mcp__codex__codex-reply`. A visible `threadId` is what makes multi-round review work.

## The ARIS tab

In the Web UI a session gains an **ARIS** tab after Chat and Trajectory
(`order: 15`, between Trajectory and LiveBench). The tab has two layers:

- **A read-only run-status block on top**: it shows what the reviewer and the
  loop's own artifacts say, and never writes, advances a round, or turns a score
  into a completion decision. It reads `review-stage/REVIEW_STATE.json` from the
  session's workspace, so it stays empty until an `auto-review-loop` run
  finishes a round there.
- **The interactive ARIS workbench below it**: skill launcher, workflow guide,
  idea board, experiments, wiki graph, and audit chain. It reads workspace
  artifacts through two JSON endpoints — `/api/aris-run` (run status) and
  `/api/aris-wb` (workbench) — and is always bound to the current
  session. The old bottom-left full-screen workbench overlay is gone; the
  composer stays available while the tab is open.

The top run-status summary is the reason the tab exists: **who reviewed this
round**, and
whether ARIS could verify that the reviewer belongs to a different model family
than the executor. On the Codex backend that verification is `unverified` by
design — Codex reports its own model, but nothing independently attests the
executor's, so ARIS records `identity_assurance: caller_declared`. Read it as
"route-consistent, not attested".

Two honest limits are shown in the tab and worth repeating: state is written
when a round finishes, not continuously, so a long round displays the previous
one; and `completed` means the loop ended — a positive assessment *or* the round
cap — never that the work was acquitted.

## Local additions (dsh-aris-panel)

- **Claude reviewer route — 9 thin overlays.** `research-review`, `research-refine`, `auto-review-loop`, `kill-argument`, `proof-checker`, `paper-plan`, `paper-figure`, `paper-write` and `auto-paper-improvement-loop` each have a `<name>-claude` overlay that loads the latest base skill in full and swaps only the reviewer transport (Codex MCP → `claude-review` MCP). Orchestrators switch to them automatically when `$ARGUMENTS` carries `reviewer: claude` or the user asks for Claude as the reviewer; the six audit skills without an overlay stay on Codex and the report says `reviewer: claude (partial)`. Rebuild with `python tools/build_claude_overlays.py` after every upstream sync; `test/test_claude_overlays.py` fails when upstream introduces a reviewer tool the overlay does not map.
- **`/verify-manager` — idea verification in `_verify-` mirrors.** One call runs falsifiable hypothesis + pre-registered criteria → plan and tasks → run (with baseline reproduction) → analysis against the baseline → next ideas, inside `_verify-<mainline-dir>/<slug>/`. The mainline stays read-only; a supported result is promoted only through a handoff note. Triggered by plain requests such as 「我有个想法需要验证」 or 「做个简单的验证实验」; requests that say full-scale / mainline / formal experiment / baseline runs go to `/experiment-plan` → `/experiment-bridge` instead.
- **`/human-in-loop-refine`** — after an ARIS draft exists, folds the human's critiques, requirements, reference papers (innovations and implementation ideas extracted) and wild ideas into a revision staged under `_refine/rNN/`. Every change is triaged as evidence-backed / needs-verification / rejected; it contains `/verify-manager`, which runs each needs-verification item and feeds the verdict back. Mainline files change only after the human confirms.
- **`aris/` — upstream snapshot.** A full copy of the ARIS repository (commit in `aris/UPSTREAM.txt`, without `.git` and `.env`) for reference and re-sync; DSH loads skills only from `skills/`.
- **`/gpt-image-2`** — bridge to the local OpenAI-compatible image route, used by `paper-writing`'s `illustration: gpt-image-2`.
- **Deep-audit tier `max`, not `ultra`.** Upstream pins deep audits at `gpt-6-astra` + `ultra`; this install's Codex catalog lists `gpt-6-astra` levels `none/high/xhigh/max`, so the corpus is localized to `max` (see the note in `shared-references/reviewer-routing.md`).

## What the layer changes

| Row | Effect |
|---|---|
| `agent-default-model` | executor becomes `deepseek-flash` |
| `aris-skills` | mounts the skill corpus (83 upstream + 3 local + 9 Claude overlays), publishes `ARIS_REPO`, restores Codex's `threadId`, serves the ARIS tab |
| `aris-codex` | `codex mcp-server` over MCP, 20-minute call budget, pinned to a stable working directory |

The corpus mounts at the bundled rank, so a project or user skill of the same name wins. The executor default is a deployment default, not a lock: a saved model setting or a per-session choice overrides it.

## Developing against a checkout

```sh
ARIS_REPO=/absolute/path/to/aris NODE_USE_ENV_PROXY=1 \
  dsh --profile web --patch /absolute/path/to/aris/dsh/checkout.patch.yml
```

Skill edits take effect without a restart. `ARIS_REPO` is required; without it the load fails naming the variable.

This overlay is **not** equivalent to the installed bundle: it cannot restore Codex's `threadId`, so multi-round `codex-reply` — and therefore the hard-tier Debate Protocol — works only through the installed bundle. The two are mutually exclusive: applying the overlay to a profile that already has the bundle fails on a duplicate row id. Remove one.

## Known limits

- **Tracks a Harness window, declared as a peer dependency.** DeepSeek Harness is a developer preview; this bundle declares `@deepseek-ai/dsh >=0.1.7-rc.2 <0.3.0-0` as an optional peer. The transport test passes against `0.2.1-rc.2` (and passed against `0.2.0-rc.2`); the `HostConnectionFetch` registry it uses exists in every release of that window. The `dsh` peer-dependency gate reads the range: an incompatible runtime skips the whole bundle with a line in the boot log. On a newer runtime, re-run `node node_modules/dsh-aris-panel/test/transport-smoke.mjs`, then widen the range, or grant the exact-version exemption with `dsh plugin allow-version`.
- **The panel's browser transport is HTTP, not an RPC channel.** dsh's generic channel registry (`connection.rpc.handle`) resolves `webServer` from Connection's own context, which dsh does not inject there (`0.1.7-rc.2` through `0.2.1-rc.2`), so an out-of-tree channel registration throws and every call dies as HTTP 405 from the SPA fallback. ARIS mounts exact Fetch routes on the `/api` prefix instead (`HostConnectionFetch.register`), served behind dsh's Host/Origin fence and browser-session cookie; since `0.2.1` the shared handler also serves exact routes to the owner peer only, and a browser session is that owner. `test/transport-smoke.mjs` pins both halves, including the 403 for a non-owner peer; it cannot cover the carrier's own auth path, so verify a live host with `POST /api/aris-run` and `/api/aris-wb` — 400 means mounted, 403 means the owner gate refused, 404 means not mounted.
- **No dsh packages are declared as npm dependencies.** In-box packages are host-provided and resolve from the Harness installation through the profile module fallback. The Harness's own rule keeps `@deepseek-ai/dsh-*` out of `dependencies`, and the packages version in lockstep with the CLI, so any range this bundle pinned would fight the version the user already has installed. The peer range above is a compatibility declaration, marked optional so it never pulls a second copy of the runtime.
- **`web_fetch` is off.** Stock dsh ships it disabled and this bundle does not enable it, which would mean depending on a provider package. Skills that reach the web use `web_search`, or `bash` with `curl`.
- **Reviewer thread continuity is process-local.** A Harness restart, or any MCP reconnect that replaces the Codex child, loses saved `threadId`s. Rounds after that start fresh; `review-stage/REVIEWER_MEMORY.md` remains the durable record either way.
- **Codex's own reasoning is not in the Harness log.** Only the verdict returns. The call arguments and the verdict are logged; the reviewer's intermediate work stays on the Codex side.
- **A verdict over 50 KB is spilled** to a file with a preview left in context. Raise `maxInlineBytes` on the `spill-policy` row if your reviews run longer.