Ouroboros treats a config path as executable code

Q00/ouroboros v0.51.6 makes dsh a first-class completion backend. The update wires DeepSeek Harness's ACP automation server into the project's interview, seed, QA, and evaluate loop, per the GitHub release notes.

Plugin systems that load external config rarely draw a line between config and code before an incident forces it. Ouroboros drew it in advance: any file capable of loading code gets treated like an executable, not just files that look like secrets. The repo has 5,449 stars and ships under MIT.

OUROBOROS_DSH_CONFIG_PATH went into the untrusted .env denylist. Not because it points at secrets. Because the Cordis composition file it loads selects plugin rows that execute arbitrary code. The project treats a config path as executable the moment it can load code. It denylists on that basis, not after a specific exploit forces the rule.

The second detail is smaller and just as telling. The adapter reports an honest dsh-composition sentinel in its audit metadata instead of inventing a model ID the wire protocol never actually carries. A small refusal to fake a field, just to look complete.

The release notes are also specific about what didn't get checked. The from-source build failed only at the paid model call, for lack of an API key. Everything else in the chain verified.

The lesson isn't the DeepSeek integration. It's the standard: a config path that can select and run code belongs in the same trust bucket as an executable. Ouroboros applied that standard to OUROBOROS_DSH_CONFIG_PATH. Whether it applies to every Cordis composition file the project touches, or just this one, isn't something the release notes say.