devrites 7.1.2 → 7.2.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.2.1](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.0...v7.2.1) (2026-10-29)
+
+### Fixed
+
+* **agents:** restore DSH code intelligence and skill discovery ([#185](https://github.com/ViktorsBaikers/DevRites/issues/185)) ([ab67651](https://github.com/ViktorsBaikers/DevRites/commit/ab67651aa3a9555fdf68e40859f3451ab20f42e7))
+
+## [7.2.0](https://github.com/ViktorsBaikers/DevRites/compare/v7.1.2...v7.2.0) (2026-10-28)
+
+### Added
+
+* **installer:** add DSH specialist integration ([#184](https://github.com/ViktorsBaikers/DevRites/issues/184)) ([0fe9f07](https://github.com/ViktorsBaikers/DevRites/commit/0fe9f07be170eef1c581b9401b565a8688dc64b4))
+
 ## [7.1.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.1.1...v7.1.2) (2026-10-28)
 
 ### Fixed

package/README.md

@@ -24,14 +24,14 @@
 DevRites is a repository-local workflow for AI coding agents. It turns a
 feature request into a spec, a sliced plan, working code, recorded proof, a
 release decision, and an explicit ship step. It runs inside Claude Code, Codex,
-omp, pi, and Devin CLI.
+omp, pi, Devin CLI, and DSH.
 
 DevRites keeps that work in `.devrites/` inside your repository, where chat
 history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.1.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.1.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.2.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -64,8 +64,7 @@ root, then run /rite-doctor ($rite-doctor in Codex) and report any FAIL line
 with its fix.
 ```
 
-The installer adds project-local support for Claude Code, Codex, omp, pi, and
-Devin CLI. It does not write skills, agents, or hooks to `~/.claude`,
+The installer adds project-local support for Claude Code, Codex, omp, pi, Devin CLI, and DSH. It does not write skills, agents, or hooks to `~/.claude`,
 `~/.codex`, `~/.pi`, or `~/.config/devin`.
 
 **2. Pick the smallest route** that still protects the work.
@@ -306,6 +305,7 @@ Run `npx devrites@latest --help` for common flags and
 | `--no-omp` | Skip `.omp` skills, agents, and command stubs. |
 | `--no-pi` | Skip `.pi` skills, agents, prompt commands, and the pi `AGENTS.md` block. |
 | `--no-devin` | Skip `.devin` skills, agents, and the Devin `AGENTS.md` block. |
+| `--no-dsh` | Skip `.dsh` skills, named presets, permission guard, and the DSH `AGENTS.md` block. |
 | `--no-agents` | Skip hook-free native specialist profiles. |
 | `--no-skills` | Skip skills and their bundled standards. |
 | `--no-binary` | Do not keep the shared `devrites-engine` binary in a user or system bin directory. On `uninstall`, keep the existing binary. |
@@ -424,6 +424,10 @@ that the intended publishing step produced it. See
 
 ## Hosts
 
+For DSH, launch `npx @deepseek-ai/dsh web --patch .dsh/cordis.patch.yml`
+and select the **DevRites** agent preset before starting a workflow. See the
+[DSH integration guide](docs/dsh.md) for permissions, dispatch, and result collection.
+
 | Host | Skills | Agents | Also installs | Invoke |
 | --- | --- | --- | --- | --- |
 | **Claude Code** | `.claude/skills/` | `.claude/agents/` | Native root permissions merged into `.claude/settings.json` | `/rite-spec` |
@@ -431,6 +435,7 @@ that the intended publishing step produced it. See
 | **omp** | `.omp/skills/` | `.omp/agents/` | Command stubs in `.omp/commands/`; `.omp/config.yml` hiding duplicate DevRites skills (only if absent) | `/rite-spec` or `/skill:rite-spec` |
 | **pi** | `.pi/skills/` | `.pi/agents/` | Prompt commands in `.pi/prompts/`, marked block in `AGENTS.md`; with Codex, `.pi/settings.json` skipping the `.agents/skills` copies (only if absent) | `/rite-spec` or `/skill:rite-spec` |
 | **Devin CLI** | `.devin/skills/` | `.devin/agents/` | Marked block in `AGENTS.md` | `/rite-spec` |
+| **DSH** | `.dsh/skills/` | Named native agent presets; profiles in `.dsh/agents/` | `.dsh/cordis.patch.yml`, role permission guard, marked block in `AGENTS.md` | `/rite-spec` in the DevRites preset |
 
 On every host, among the lifecycle `devrites-*` specialists only
 `devrites-slice-wright` is writable and the rest are read-only and hook-free;

package/docs/dsh.md

@@ -0,0 +1,85 @@
+# DSH integration
+
+The standard DevRites installer ships project-local DSH skills and named native
+agent presets. To launch from the installed project's root:
+
+```sh
+npx @deepseek-ai/dsh web --patch .dsh/cordis.patch.yml
+```
+
+Choose **DevRites** (`devrites-orchestrator`) in the agent preset selector for a
+new conversation, then use `/rite` or `/rite-spec`. The overlay loads alongside
+your DSH profile; the installer does not edit your global DSH configuration.
+Use `--no-dsh` with DevRites install/update to omit this host. Updates and
+uninstall manage the same files through the existing hashed manifest.
+
+Skills live under `.dsh/skills`, with native invocation flags preserved. Presets
+with skill access mount DSH's filesystem skill provider before the skill tool
+so installed skills are discovered in that preset's scope. The
+`.dsh/agents` files retain the expanded canonical specialist instructions.
+`.dsh/cordis.patch.yml` and `.dsh/specialist.mjs` register those exact identities
+as native DSH presets and enforce their tool and permission boundaries.
+
+The orchestrator calls `subagent` with an exact `agent_preset`, a self-contained
+`prompt`, and a short `description`. Its configured backend is `spawn`, which creates a fresh
+Session without the parent conversation. An omitted or unknown role is denied;
+generic dispatch and fork are not substitutes. Specialists cannot delegate.
+The root may use `list_agents`, `send_message`, and `interrupt_agent` to manage
+its native children.
+
+DSH delivers each child's final text and terminal status to the parent in a
+settlement notice. A returned child id means dispatch was admitted; `inactive`
+activity alone does not prove successful completion. The orchestrator collects
+and reconciles every terminal result, including failures, before dependent work.
+
+Read-only roles retain only their mapped tools and run shell commands under the
+read-only sandbox. Shell-capable roles also receive native job tools to collect
+background command output and stop their jobs. Writers have a workspace-write ceiling. The guard narrows
+DSH's inherited parent override before each allowed call, preserves an existing
+read-only parent boundary, and denies explicit sandbox escalation. Confining
+shell and filesystem providers are required; an unconfined composition fails
+closed. Tool access derives from canonical agent frontmatter; unsupported
+Claude-specific tools are omitted. The writer's exact file list
+remains a task contract checked by the orchestrator, as on the other hosts.
+
+Codebase Memory MCP is optional. Install `codebase-memory-mcp` separately and
+make the binary available on `PATH`, then load the supplied connection overlay:
+
+```sh
+dsh web --patch .dsh/codebase-memory.patch.yml --patch .dsh/cordis.patch.yml
+```
+
+The optional overlay registers one global `@deepseek-ai/dsh-mcp-client` stdio
+connection named `codebase-memory-mcp`. If your DSH configuration already provides
+that global connection, use only `.dsh/cordis.patch.yml`. Installation does not
+install the MCP binary, start a server, or change global configuration. Without
+the overlay or a configured connection, grep/glob/read remain available.
+
+For a browser served on a local interface, keep launcher flags before app flags:
+
+```sh
+dsh web --patch .dsh/codebase-memory.patch.yml --patch .dsh/cordis.patch.yml --no-open --host <local-interface-ip> --port 3080
+```
+
+Canonical `mcp__codebase-memory-mcp__*` grants expand to a finite set of query
+tools: index status, projects, schema, architecture, graph and code search, call
+paths, snippets, file outlines, graph queries, change detection, coverage, and
+graph comparisons. Individual supported query grants are also preserved. Roles
+without a canonical grant receive none. Other MCP namespaces, unknown tools,
+`delete_project`, `manage_adr`, and `ingest_traces` are denied. Only the root
+orchestrator may use `index_repository`, with `persistence` omitted or `false`
+for cache-only indexing; all specialists, including writers, cannot index.
+
+Use graph queries first for structural questions, checking index status,
+freshness, and coverage and verifying material findings in source. Use
+grep/glob for literal searches. An unavailable server or missing index falls
+back to grep/glob/read; a specialist may hand indexing to the parent. The tool
+catalog refreshes when DSH registers or removes tools, including later successful
+connections. DSH may retain registrations during a temporary connection loss.
+MCP calls use the external server's permissions, outside DSH's shell/filesystem
+sandbox. LSP integration is outside this adapter's scope.
+
+The adapter targets the published DSH `0.2.1-rc.2` plugin interfaces, checked
+against [DeepSeek Harness source](https://github.com/deepseek-ai/deepseek-harness)
+at `f3803c96974ad4a94195fb97e5c637e9c2a3afe3`. DSH is a developer preview;
+changes to its preset, tools, or sandbox interfaces require revalidation.

package/engine/internal/devritespaths/paths.go

@@ -18,12 +18,14 @@ const (
 	OmpSkillsTarget       = ".omp/skills"
 	PiSkillsTarget        = ".pi/skills"
 	DevinSkillsTarget     = ".devin/skills"
+	DshSkillsTarget       = ".dsh/skills"
 	ClaudeAgentsTarget    = ".claude/agents"
 	CodexAgentsTarget     = ".codex/agents"
 	OmpAgentsTarget       = ".omp/agents"
 	OmpCommandsTarget     = ".omp/commands"
 	PiAgentsTarget        = ".pi/agents"
 	DevinAgentsTarget     = ".devin/agents"
+	DshAgentsTarget       = ".dsh/agents"
 	PiPromptsTarget       = ".pi/prompts"
 	ClaudeWorkflowsTarget = ".claude/workflows"
 

package/engine/internal/hostpack/hostpack.go

@@ -19,12 +19,14 @@ const (
 	OmpSkillsTarget       = devritespaths.OmpSkillsTarget
 	PiSkillsTarget        = devritespaths.PiSkillsTarget
 	DevinSkillsTarget     = devritespaths.DevinSkillsTarget
+	DshSkillsTarget       = devritespaths.DshSkillsTarget
 	ClaudeAgentsTarget    = devritespaths.ClaudeAgentsTarget
 	CodexAgentsTarget     = devritespaths.CodexAgentsTarget
 	OmpAgentsTarget       = devritespaths.OmpAgentsTarget
 	OmpCommandsTarget     = devritespaths.OmpCommandsTarget
 	PiAgentsTarget        = devritespaths.PiAgentsTarget
 	DevinAgentsTarget     = devritespaths.DevinAgentsTarget
+	DshAgentsTarget       = devritespaths.DshAgentsTarget
 	PiPromptsTarget       = devritespaths.PiPromptsTarget
 	ClaudeWorkflowsTarget = devritespaths.ClaudeWorkflowsTarget
 )
@@ -111,6 +113,15 @@ var DevinAgentsMerge = MarkerMerge{
 	MarkerText: "AGENTS.md contains a DevRites managed block between BEGIN/END DEVRITES DEVIN markers.",
 }
 
+var DshAgentsMerge = MarkerMerge{
+	TargetRel:  "AGENTS.md",
+	PayloadRel: "dsh/AGENTS.md",
+	Begin:      "<!-- BEGIN DEVRITES DSH -->",
+	End:        "<!-- END DEVRITES DSH -->",
+	MarkerRel:  ".claude/devrites.dsh-agents-merge",
+	MarkerText: "AGENTS.md contains a DevRites managed block between BEGIN/END DEVRITES DSH markers.\n",
+}
+
 var CodexConfigMerge = MarkerMerge{
 	TargetRel:  ".codex/config.toml",
 	PayloadRel: "codex/config.toml",
@@ -166,6 +177,7 @@ var LegacyCodexHooksMerge = ManagedMerge{
 }
 
 var managedMerges = []ManagedMerge{
+	{MarkerRel: DshAgentsMerge.MarkerRel, TargetRel: DshAgentsMerge.TargetRel, Begin: DshAgentsMerge.Begin, End: DshAgentsMerge.End, DryRun: "AGENTS.md DevRites DSH block"},
 	{
 		MarkerRel: CodexAgentsMerge.MarkerRel,
 		TargetRel: CodexAgentsMerge.TargetRel,
@@ -202,7 +214,7 @@ var managedMerges = []ManagedMerge{
 	LegacyCodexHooksMerge,
 }
 
-func RequiredPayload(withCodex, withOmp, withPi, withDevin bool) []string {
+func RequiredPayload(withCodex, withOmp, withPi, withDevin, withDsh bool) []string {
 	required := []string{
 		"claude/skills",
 		"claude/agents",
@@ -240,11 +252,14 @@ func RequiredPayload(withCodex, withOmp, withPi, withDevin bool) []string {
 			"devin/AGENTS.md",
 		)
 	}
+	if withDsh {
+		required = append(required, "dsh/skills", "dsh/agents", "dsh/runtime/cordis.patch.yml", "dsh/runtime/specialist.mjs", "dsh/AGENTS.md")
+	}
 	return required
 }
 
-func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi, withDevin bool) error {
-	for _, rel := range RequiredPayload(withCodex, withOmp, withPi, withDevin) {
+func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi, withDevin, withDsh bool) error {
+	for _, rel := range RequiredPayload(withCodex, withOmp, withPi, withDevin, withDsh) {
 		if _, err := fs.Stat(payload, rel); err != nil {
 			return fmt.Errorf("missing %s", rel)
 		}
@@ -252,7 +267,7 @@ func ValidatePayload(payload fs.FS, withCodex, withOmp, withPi, withDevin bool)
 	return nil
 }
 
-func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin bool) []Tree {
+func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin, withDsh bool) []Tree {
 	var trees []Tree
 	if withSkills {
 		trees = append(trees, Tree{PayloadPrefix: "claude/skills", TargetPrefix: ClaudeSkillsTarget})
@@ -274,6 +289,9 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin
 		if withDevin {
 			trees = append(trees, Tree{PayloadPrefix: "devin/skills", TargetPrefix: DevinSkillsTarget})
 		}
+		if withDsh {
+			trees = append(trees, Tree{PayloadPrefix: "dsh/skills", TargetPrefix: DshSkillsTarget})
+		}
 	}
 	if withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/agents", TargetPrefix: ClaudeAgentsTarget})
@@ -290,13 +308,16 @@ func InstallTrees(withSkills, withAgents, withCodex, withOmp, withPi, withDevin
 			trees = append(trees, Tree{PayloadPrefix: "devin/agents", TargetPrefix: DevinAgentsTarget})
 		}
 	}
+	if withAgents && withDsh {
+		trees = append(trees, Tree{PayloadPrefix: "dsh/agents", TargetPrefix: DshAgentsTarget}, Tree{PayloadPrefix: "dsh/runtime", TargetPrefix: ".dsh"})
+	}
 	if withSkills && withAgents {
 		trees = append(trees, Tree{PayloadPrefix: "claude/workflows", TargetPrefix: ClaudeWorkflowsTarget})
 	}
 	return trees
 }
 
-func AliasTargets(alias Alias, withCodex, withOmp, withPi, withDevin bool) []string {
+func AliasTargets(alias Alias, withCodex, withOmp, withPi, withDevin, withDsh bool) []string {
 	targets := []string{filepath.ToSlash(filepath.Join(ClaudeSkillsTarget, alias.Name, "SKILL.md"))}
 	if withCodex {
 		targets = append(targets, filepath.ToSlash(filepath.Join(CodexSkillsTarget, alias.Name, "SKILL.md")))
@@ -310,6 +331,9 @@ func AliasTargets(alias Alias, withCodex, withOmp, withPi, withDevin bool) []str
 	if withDevin {
 		targets = append(targets, filepath.ToSlash(filepath.Join(DevinSkillsTarget, alias.Name, "SKILL.md")))
 	}
+	if withDsh {
+		targets = append(targets, filepath.ToSlash(filepath.Join(DshSkillsTarget, alias.Name, "SKILL.md")))
+	}
 	return targets
 }
 

package/engine/internal/install/apply.go

@@ -26,6 +26,7 @@ func (r *runner) install() error {
 	fmt.Fprintf(r.opts.Stdout, "  omp    : %s\n", yesno(r.opts.WithOmp))
 	fmt.Fprintf(r.opts.Stdout, "  pi     : %s\n", yesno(r.opts.WithPi))
 	fmt.Fprintf(r.opts.Stdout, "  devin  : %s\n", yesno(r.opts.WithDevin))
+	fmt.Fprintf(r.opts.Stdout, "  dsh    : %s\n", yesno(r.opts.WithDsh))
 	fmt.Fprintf(r.opts.Stdout, "  aliases: %s\n", r.opts.AliasMode)
 	if r.opts.DryRun {
 		fmt.Fprintln(r.opts.Stdout, "  (dry run - no changes will be made)")
@@ -43,7 +44,7 @@ func (r *runner) install() error {
 		return err
 	}
 
-	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
+	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin, r.opts.WithDsh) {
 		if err := r.installTree(tree.PayloadPrefix, tree.TargetPrefix); err != nil {
 			return fmt.Errorf("install tree %s: %w", tree.TargetPrefix, err)
 		}
@@ -54,7 +55,7 @@ func (r *runner) install() error {
 			if err != nil {
 				return fmt.Errorf("render alias skill %s: %w", alias.Name, err)
 			}
-			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
+			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin, r.opts.WithDsh) {
 				if err := r.installData(data, rel); err != nil {
 					return fmt.Errorf("install alias: %w", err)
 				}
@@ -79,6 +80,11 @@ func (r *runner) install() error {
 			return fmt.Errorf("merge %s: %w", hostpack.DevinAgentsMerge.TargetRel, err)
 		}
 	}
+	if r.opts.WithSkills && r.opts.WithDsh {
+		if err := r.mergeMarkerFile(hostpack.DshAgentsMerge); err != nil {
+			return fmt.Errorf("merge %s: %w", hostpack.DshAgentsMerge.TargetRel, err)
+		}
+	}
 	if r.opts.WithSkills {
 		if err := r.seedClaudeSettings(); err != nil {
 			return fmt.Errorf("seed claude settings: %w", err)
@@ -112,6 +118,9 @@ func (r *runner) install() error {
 	}
 	fmt.Fprintf(r.opts.Stdout, "  installed: %d   overwritten: %d   skipped(conflict): %d   pruned: %d\n", r.stats.installed, r.stats.overwrote, r.stats.skipped, r.stats.pruned)
 	if !r.opts.DryRun && r.opts.WithSkills {
+		if r.opts.WithDsh && r.opts.WithAgents {
+			fmt.Fprintln(r.opts.Stdout, "DSH: run npx @deepseek-ai/dsh web --patch .dsh/cordis.patch.yml, then select the DevRites preset.")
+		}
 		claudeHosts := "Claude"
 		if r.opts.WithDevin {
 			claudeHosts = "Claude/Devin"
@@ -445,6 +454,9 @@ func (r *runner) flagsString() string {
 	if !r.opts.WithDevin {
 		flags = append(flags, "--no-devin")
 	}
+	if !r.opts.WithDsh {
+		flags = append(flags, "--no-dsh")
+	}
 	if !r.opts.WithBinary {
 		flags = append(flags, "--no-binary")
 	}

package/engine/internal/install/install.go

@@ -37,6 +37,7 @@ type Options struct {
 	WithOmp     bool
 	WithPi      bool
 	WithDevin   bool
+	WithDsh     bool
 	WithBinary  bool
 	KeepBinary  bool
 	AliasMode   string
@@ -91,6 +92,7 @@ func DefaultOptions(mode Mode) Options {
 		WithOmp:    true,
 		WithPi:     true,
 		WithDevin:  true,
+		WithDsh:    true,
 		WithBinary: true,
 		AliasMode:  "safe",
 		Stdout:     io.Discard,
@@ -145,6 +147,7 @@ func parseArgs(args []string, opts *Options) error {
 	noOmp := flags.Bool("no-omp", !opts.WithOmp, "")
 	noPi := flags.Bool("no-pi", !opts.WithPi, "")
 	noDevin := flags.Bool("no-devin", !opts.WithDevin, "")
+	noDsh := flags.Bool("no-dsh", !opts.WithDsh, "")
 	noAgents := flags.Bool("no-agents", !opts.WithAgents, "")
 	noSkills := flags.Bool("no-skills", !opts.WithSkills, "")
 	noBinary := flags.Bool("no-binary", !opts.WithBinary, "")
@@ -174,6 +177,7 @@ func parseArgs(args []string, opts *Options) error {
 	opts.WithOmp = !*noOmp
 	opts.WithPi = !*noPi
 	opts.WithDevin = !*noDevin
+	opts.WithDsh = !*noDsh
 	opts.WithAgents = !*noAgents
 	opts.WithSkills = !*noSkills
 	opts.WithBinary = !*noBinary
@@ -220,7 +224,7 @@ func usage(mode Mode) string {
 	case ModeUpdate:
 		return "usage: devrites-engine update [--target DIR] [--dry-run] [--force] [--check] [install flags] [--source-dir DIR --payload-dir DIR]\n"
 	default:
-		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-omp] [--no-pi] [--no-devin] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
+		return "usage: devrites-engine install [--target DIR] [--dry-run] [--force] [--no-codex] [--no-omp] [--no-pi] [--no-devin] [--no-dsh] [--no-agents] [--no-skills] [--no-binary] [--short-aliases=all]\n"
 	}
 }
 
@@ -351,7 +355,7 @@ func (r *runner) validatePayload() error {
 	if r.payload == "" {
 		return fmt.Errorf("generated install payload not found; pass --payload-dir or run scripts/build-host-artifacts.sh")
 	}
-	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin); err != nil {
+	if err := hostpack.ValidatePayload(r.payloadFS, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin, r.opts.WithDsh); err != nil {
 		return fmt.Errorf("generated install payload under %s: %w", r.payload, err)
 	}
 	return nil
@@ -370,7 +374,7 @@ func isGlobalTarget(target string) bool {
 		if target == h {
 			return true
 		}
-		for _, rel := range []string{".claude", ".codex", ".omp", ".pi", ".devin", filepath.Join(".config", "devin"), ".agents"} {
+		for _, rel := range []string{".claude", ".codex", ".omp", ".pi", ".devin", ".dsh", filepath.Join(".config", "devin"), ".agents"} {
 			global := filepath.Join(h, rel)
 			globals := []string{global}
 			if resolved, err := filepath.EvalSymlinks(global); err == nil {

package/engine/internal/install/merge.go

@@ -176,6 +176,7 @@ func (r *runner) sharedMarkerMerges(merge hostpack.MarkerMerge) []hostpack.Marke
 		{r.opts.WithCodex, hostpack.CodexAgentsMerge},
 		{r.opts.WithPi, hostpack.PiAgentsMerge},
 		{r.opts.WithDevin, hostpack.DevinAgentsMerge},
+		{r.opts.WithDsh, hostpack.DshAgentsMerge},
 	} {
 		if other.enabled && other.merge.TargetRel == merge.TargetRel && other.merge.Begin != merge.Begin {
 			merges = append(merges, other.merge)

package/engine/internal/install/preflight.go

@@ -90,6 +90,7 @@ func (r *runner) preflightMerges() error {
 		{r.opts.WithCodex, hostpack.CodexAgentsMerge},
 		{r.opts.WithPi, hostpack.PiAgentsMerge},
 		{r.opts.WithDevin, hostpack.DevinAgentsMerge},
+		{r.opts.WithDsh, hostpack.DshAgentsMerge},
 	} {
 		if !m.enabled {
 			continue
@@ -160,7 +161,7 @@ func (r *runner) isPinnedAlias(rel string) bool {
 
 func (r *runner) desiredInstallPaths() (map[string]bool, error) {
 	out := map[string]bool{".devrites/README.md": true}
-	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
+	for _, tree := range hostpack.InstallTrees(r.opts.WithSkills, r.opts.WithAgents, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin, r.opts.WithDsh) {
 		err := fs.WalkDir(r.payloadFS, tree.PayloadPrefix, func(path string, d fs.DirEntry, err error) error {
 			if err != nil {
 				return err
@@ -181,7 +182,7 @@ func (r *runner) desiredInstallPaths() (map[string]bool, error) {
 	}
 	if r.opts.WithSkills && r.opts.AliasMode == "all" {
 		for _, alias := range hostpack.Aliases {
-			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin) {
+			for _, rel := range hostpack.AliasTargets(alias, r.opts.WithCodex, r.opts.WithOmp, r.opts.WithPi, r.opts.WithDevin, r.opts.WithDsh) {
 				out[rel] = true
 			}
 		}
@@ -196,6 +197,9 @@ func (r *runner) desiredInstallPaths() (map[string]bool, error) {
 	if r.opts.WithSkills && r.opts.WithDevin {
 		out[hostpack.DevinAgentsMerge.MarkerRel] = true
 	}
+	if r.opts.WithSkills && r.opts.WithDsh {
+		out[hostpack.DshAgentsMerge.MarkerRel] = true
+	}
 	if r.opts.WithSkills {
 		out[hostpack.ClaudeSettingsMerge.MarkerRel] = true
 	}
@@ -218,6 +222,9 @@ func (r *runner) installMergeTargets() []string {
 		if r.opts.WithDevin {
 			out = append(out, hostpack.DevinAgentsMerge.TargetRel)
 		}
+		if r.opts.WithDsh {
+			out = append(out, hostpack.DshAgentsMerge.TargetRel)
+		}
 	}
 	return out
 }

package/engine/internal/install/update.go

@@ -65,7 +65,7 @@ func runUpdate(opts Options) error {
 	if err != nil {
 		return fmt.Errorf("resolve payload %s: %w", opts.PayloadDir, err)
 	}
-	if err := hostpack.ValidatePayload(os.DirFS(payload), true, true, true, true); err != nil {
+	if err := hostpack.ValidatePayload(os.DirFS(payload), true, true, true, true, true); err != nil {
 		return fmt.Errorf("local update payload under %s is invalid: %w", payload, err)
 	}
 	installFlags := manifestHeader(mf, "devrites-flags")

package/engine/internal/lib/dispatch_packet.go

@@ -68,7 +68,7 @@ func lintKnownRoles(root, phase string, roles []string) error {
 			skillsRoots = append(skillsRoots, dir)
 		}
 	}
-	for _, rel := range []string{".omp/skills", ".agents/skills", ".pi/skills", ".devin/skills"} {
+	for _, rel := range []string{".omp/skills", ".agents/skills", ".pi/skills", ".devin/skills", ".dsh/skills"} {
 		dir := filepath.Join(project, filepath.FromSlash(rel))
 		if info, err := os.Stat(filepath.Join(dir, "devrites-lib")); err == nil && info.IsDir() {
 			skillsRoots = append(skillsRoots, dir)

package/pack/generated/README.md

@@ -13,6 +13,8 @@ This directory is generated by `scripts/build-host-artifacts.sh`.
 - `devin/` contains Devin CLI skill mirrors, custom subagent profiles with
   `allowed-tools` allowlists, and an `AGENTS.md` bridge block.
 
+- `dsh/` contains DSH skills, canonical role profiles, a native preset overlay, and a permission guard.
+
 Do not edit these files by hand. Edit `pack/.claude/`,
 `scripts/codex-generate.sh`, `scripts/omp-generate.sh`,
-`scripts/pi-generate.sh`, or `scripts/devin-generate.sh`, then rebuild.
+`scripts/pi-generate.sh`, `scripts/devin-generate.sh`, or `scripts/dsh-generate.py`, then rebuild.

package/pack/generated/dsh/AGENTS.md

@@ -0,0 +1,27 @@
+<!-- BEGIN DEVRITES DSH -->
+# DevRites for DSH
+
+Use the installed skills under `.dsh/skills` and invoke `/rite` or `/rite-<verb>`.
+Read `.dsh/skills/devrites-lib/reference/standards/core.md` before a workflow.
+Dispatch means call `subagent` with `agent_preset` set to the exact named specialist,
+a self-contained `prompt`, and a short `description`. Every dispatch uses the native
+`spawn` provider, a fresh Session with zero parent conversation. Never use a generic
+agent, inherit the orchestrator preset, or use `subagent_fork` as a substitute.
+Include the exact project-relative allowed paths and required evidence in the prompt.
+The child id returned by `subagent` is an admission receipt, not a completed result.
+Collect the native parent settlement notice for each id, including final text and
+terminal status. `list_agents` activity `inactive` does not prove success. Reconcile
+every result and compare returned paths with the contract before continuing.
+Missing preset, failed activation, interrupted execution, or missing result blocks
+the dependent work. Report the failure; never impersonate the specialist inline.
+The orchestrator writes workspace bookkeeping; only the named writer writes source
+and tests within its path contract. No skill or result authorizes commits, pushes,
+publishing, deployment, or other irreversible actions without explicit approval.
+Use configured Codebase Memory MCP queries first for structural code questions.
+Check index status, freshness, and coverage before relying on graph results; verify
+material findings in source. Only the orchestrator may index, using cache-only
+`index_repository` with persistence omitted or false. Children never index: hand
+missing or stale coverage to the parent, or use grep/glob/read for source fallback.
+If the MCP server or index is unavailable, continue with grep/glob/read. Keep
+grep/glob for literal searches. MCP permissions are separate from the file sandbox.
+<!-- END DEVRITES DSH -->