DeepSeek Harness Operator Guide

Developer preview

Upstream describes DeepSeek Harness as experimental, unaudited, and not production-ready. It can execute model-generated commands, load trusted host plugins, and reach every process, credential, file, and network destination made available to it. Sandboxing and approvals reduce risk; they do not guarantee isolation.

This vault is the operator source of truth for the isolated loca deployment at deek.loca.zone. It separates upstream behavior from loca policy so that an upstream capability is never mistaken for a deployment guarantee.

Start here

1. Read the source install and local run guide.
2. Complete browser authentication, provider setup, and the first session.
3. Before exposing the service, review the runtime safety boundary.
4. Operate and update only through the service runbook.
5. Use troubleshooting without weakening the boundary.

Loca deployment boundary

Layer	Required decision
Public edge	deek.loca.zone is protected by the existing Authelia one_factor policy.
Backend	The Web process listens only on 127.0.0.1:52320; the port is never published directly.
Identity	deek.service uses systemd DynamicUser=yes, not the loca account.
Application	The service reads a root-owned, immutable runtime copy at /opt/deek/app.
Home isolation	ProtectHome=true prevents visibility into /home/loca.
State	DSH_HOME=/var/lib/deek; only the dedicated state directory is writable.
Workspace	The process starts in /var/lib/deek/workspace, and that is the only workspace offered to the Web UI.
Telemetry	DSH_TELEMETRY_DISABLED=1 is the hard opt-out for this deployment.

Two gates, different jobs

Authelia controls who can reach the browser surface. Upstream’s per-process launch token and session cookie authenticate the browser to the Harness Web API. Neither gate confines tools, plugins, file reads, processes, or outbound network access.

Guide map

• Quickstart
  • First provider and session
• Operations
  • Service and updates
  • Troubleshooting
• Reference
  • Configuration and data
  • Plugin model
  • Architecture
  • Verified sources

Non-negotiable operator rules

• Never run the public service as loca or expose /home/loca to it.
• Never bind the backend to 0.0.0.0 or publish port 52320 beyond loopback.
• Never treat Authelia, the upstream token, approvals, or the sandbox as a complete security boundary.
• Never place API keys, launch-token URLs, credentials files, or secret values in Git, this vault, unit files, tickets, or shared logs.
• Review every plugin, MCP server command, configuration change, and proposed tool action before allowing it into the deployment.
• Back up the state and workspace before updates; developer-preview revisions may break compatibility.

Upstream facts in this vault are pinned to revision 4e84901e6471b79ec0338099867ebb4606d12bb5. See Verified sources for the evidence map.