DeepSeek Harness plus Muse Glimmer on DGX Spark

# dsh + Muse Glimmer on a Spark

Files from a working DeepSeek Harness (`dsh`) session against Muse Glimmer 30B on a DGX Spark via Ollama.

`graphsec/` is the sample agentic security project. It builds a Python AST call graph, tags sources and sinks, and reports only paths from a source to a sink. `AGENTS.md` tells the agent to query that graph instead of grepping for `subprocess.run`.

Laptop runs `dsh web`. Spark runs Ollama. An SSH local forward makes `http://127.0.0.1:11434/v1` reach the GPU. Do not open 11434 on the Spark firewall unless you want every tailnet peer on Ollama.

## graphsec

```
python -m unittest tests.test_scan
python -m graphsec tool stats fixtures
python -m graphsec scan fixtures
```

`scan` exits 2 when a source-to-sink path exists. The planted fixture is `os.environ.get` to `subprocess.run(..., shell=True)` through `handle_request`. `healthcheck` calls `subprocess.run` with a literal argv list and must not appear in the report.

`AGENTS.md` is the policy for a dsh session: query this graph, do not grep, write `findings.md`.

## Layout

- `graphsec/` — AST call graph, source/sink rules, path query.
- `fixtures/webapp.py` — planted env-to-shell flow.
- `AGENTS.md` — agent policy.
- `Modelfile` — official `muse-glimmer` plus `num_ctx` 131072 and `num_predict` 32768. No `TEMPLATE`.
- `examples/settings.yaml` — custom provider `spark-ollama`.
- `examples/cordis.patch.yml` — default model for new sessions.
- `examples/credentials.yaml.example` — placeholder key name `SPARK_OLLAMA_API_KEY`.
- `scripts/forward-ollama.sh` — SSH `-L 11434`.
- `scripts/warmup.sh` — load the wrapper into VRAM.
- `scripts/capture-ui.mjs` — Playwright shots of `http://127.0.0.1:3080`.

## Spark

```
ollama pull muse-glimmer
ollama create muse-harness -f Modelfile
ollama show muse-harness
```

`ollama show` must list tools and thinking. If you only see completion and vision, the template was overwritten. Delete the wrapper and create it again from official `muse-glimmer`.

Ollama 0.32.9 includes the Muse parser. A Hugging Face GGUF import of the same 18 GB file is not the same product. That import set stop tokens on `<|start|>` and `<|message|>`, which produced empty 3-token replies (`EMPTY_RESPONSE`). A custom template that omits `.Tools` produced HTTP 400 `does not support tools`.

## Laptop

```
ssh -N -L 127.0.0.1:11434:127.0.0.1:11434 gpuuser@my-spark
npx --y