v0.9.8: DeepSeek Harness harvest — simplify #5353 + adopt dsh's denial language, prompt assembly, compaction, and test lane

[Hmbown]

DeepSeek Harness (dsh, 0.1.0-rc.5) harvest for CodeWhale v0.9.8 — read-only research of /Volumes/VIXinSSD/CW/dsh, filed as the action list for the v0.9.8 cycle.

Core finding on Auto-Review (answers the "too much machinery" feedback)

dsh has NO LLM reviewer, guardian agent, or auto-review tier at all. Its model: OS-enforced sandbox (read-only / workspace-write / danger-full-access, deployment default read-only), deny-by-default, denial surfaced as an actionable result fact ("[sandbox: file access denied under ] ... [sandbox: escalation available — retry this exact command once with sandbox_permissions + justification; the approval prompt asks the user]"), escalation = model-requested + one-shot user approval (allowed-once | rejected | cancelled | unavailable; no answerer → fail closed; approval policy is just ask/never; no remembered rules). Zero LLM gate machinery.

CodeWhale's #5353 guardian adds real autonomy dsh doesn't offer, but the scaffolding around the single LLM consult is measurable overhead (4 new concepts + a config flag + third audit event on top of a 3-enum cascade). Verdict: keep the ONE fail-closed LLM consult; cut the scaffolding.

Simplify #5353 — the 8 exact cuts (~170–200 lines, 2 state vars)

1. ToolActionKind 13 → 6 decision-relevant variants (rest become audit labels) — auto_review.rs:74-89, 391-441
2. Merge safety_floor into deterministic_fallback with a floor: bool for the honest message — engine.rs:5350-5362
3. Delete AutoReviewRule.action (redundant with Vec membership) — auto_review.rs:255-261
4. Merge auto_review_plan_decision into _in_workspace; move write-bounding into evaluate() via a workspace field on the context (kills a double context rebuild)
5. ReviewerLedger: drop the 50-window; consecutive-only (3 → abort) or a cap-10 window
6. Collapse the ConsultReviewer handler into one Result<(), ToolError> helper; unify the 3 audit emitters into one gate-tagged event
7. Drop the reviewer_enabled config flag — derive from ApprovalMode::Auto alone
8. No secondary advisory LLM paths in the gate

Invariant preserved: deterministic blocks stay non-bypassable; no LLM override of a floor block; failure = deny.

Adopt / adapt list (with effort)

• ADOPT (S) — dsh denial/escalation language in Auto mode: on sandbox deny, tell the model exactly how to retry (narrowest sufficient mode + justification), stamp approved escalations (CodeWhale has RetryWithPolicy plumbing already)
• ADOPT (S) — model-visible "approval prompts disabled — do not request escalation" notice (dsh ApprovalPolicy::never parity)
• ADOPT (M) — ordered-section system-prompt registry (reserved bands, toolOrder + '' rest, fail-loud {{var}} interpolation, per-component KV-cache-effect notes) — packages/core/system-prompt/README.md
• ADOPT (M) — compaction: token-meter gate at step boundary (thresholdRatio 0.8), in-place range replace, summarize-from-the-same-prefix-the-model-sees (provider cache stays warm), optional model-free tool-result pruner — packages/compaction/*. Builds on codex/harvest-4293-compaction-budget
• ADAPT (S/M) — plugins: config-patch layers + explicit "dynamic package = bash access" trust stance + human round-trip for sandbox escapes; skip node:vm runners
• ADAPT (S) — telemetry: audit = session-log replay; redact on outbound copy only; first-assistant-chunk elision; dedupe on (session.id, event.seq); default-off
• ADOPT (S) — pack + verify-install on every PR; committed version bump (published version readable from the repo); tag-only publish
• ADOPT (S/M) — test lane for v0.9.8 Known issues: parallel-load and config-fixture flakes (from the v0.9.7 close-out) #5355: recorded LLM replay fixtures with consumption assertions; fake-PTY unit harness (real PTY only e2e); retry+scaled-timeout on the flaky pty gate; transcript-tail + exit-status capture on every timeout path
• ADOPT (S) — plan-review approval-intent card (approve/dismiss as distinct model feedback) + mode-as-log-event

Not present in dsh (searched)

No TUI (CLI launcher + web UI), no prompt versioning, no reviewer/guardian machinery.

[Hmbown]

Rolled to v0.9.10: the v0.9.9 release branch merged to main tonight (#5476) without this landing; nothing here is closed or dropped.