dsh-principal-binding-proof
Offline, content-addressed evidence that one pseudonymous authority and tenant remain consistently bound across a DSH execution chain: principal → session → agent → tool call → runtime → artifact.
It validates explicit recorded hashes, revision, key epoch, evidence freshness, issuer allowlists, validity windows, revocation, adjacency and a unique acyclic chain. It detects authority swaps, cross-tenant confusion, stale identities, broken or mis-typed bindings, unauthorized issuers and terminal artifact mismatches.
Boundary
This is not authentication, authorization, signature verification, access control or a remote transport. It grants no authority, reads no accounts, credentials, prompts or business payloads, and executes no commands.
dsh-decision-effect-proof reconciles authorization decisions with effects.dsh-attestation-proof verifies signed DSSE/in-toto statements.dsh-lineage tracks object and action provenance.- This plugin checks the narrower identity-confusion question: whether every redacted execution surface claims the same authority, tenant and revision through a valid explicit binding chain.
See examples/bound.json.
npm test
npm run check
node bin/dsh-principal-binding-proof.mjs verify examples/bound.json
dsh plugin --profile proof add .
DSH tools are dsh_principal_binding_inspect and dsh_principal_binding_verify. MCP exposes proof-only inline equivalents. Workspace verification accepts only relative, non-symlink paths and writes a deterministic content-addressed report beneath an explicit artifactDir, followed by SHA-256 read-back verification.
MIT licensed. See SECURITY.md.
