Evidence record / deepseek-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-08-17-deepseek-harness-cordis-is-vendored-and-republished-under-deepseek-s-scope-at-a-version
Cordis is vendored and republished under DeepSeek's scope, at a version upstream has never shipped.
The contract flags that the plugin boundary dsh sells is defined in someone else's repo. In practice it is defined in a fork of someone else's repo. @deepseek-ai/[email protected] depends on @deepseek-ai/cordis: ^4.0.1, not on cordis. DeepSeek vendored the framework as source in its second-ever commit ("Vendor Cordis framework packages as source," 2026-06-11) and republishes it under its own npm scope from vendor/cordis. The version numbers diverge in a way worth noticing: DeepSeek's latest is 4.0.1, a plain non-prerelease number, while upstream cordiverse has never released a stable 4.x -- its latest is 4.0.0-rc.8, published 2026-08-10. So the one component in the dsh install tree carrying a stable-looking version is a fork of a framework its own authors still call a release candidate.
Channel: preview-or-beta. Ancestry: The npm packument for @deepseek-ai/cordis gives dist-tags {latest: 4.0.1, next: 4.0.1-rc.4} and a repository field of git+https://github.com/deepseek-ai/deepseek-harness.git with directory: vendor/cordis -- built from this repo's tree, which at 99f6f02 (sole tag, prerelease) contains vendor/cordis alongside vendored cosmokit, group, hmr, include, loader, logger-console, schemastery and timer. The upstream cordis packument gives dist-tags {latest: 4.0.0-rc.8, next: 4.0.0-beta.5} with repository git+https://github.com/cordiverse/cordis.git.
Operator consequence: Watch the right repo. A Cordis fix landing at cordiverse does not reach your dsh install; DeepSeek ships it out of vendor/, on DeepSeek's schedule. Conversely a change to the plugin paradigm can arrive in your tree from a package whose upstream you were not watching. If you are diagnosing plugin lifecycle, service resolution or hot-reload behaviour, read vendor/cordis in this repo at your installed version -- not cordiverse/cordis, which is a different codebase on a different version line.
Receipt
Finding metadata
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
Finding ID: 2026-08-17-deepseek-harness-cordis-is-vendored-and-republished-under-deepseek-s-scope-at-a-version
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact