dsh-attest-chain
DeepSeek Harness 会话的签名保管链：每个受监控的工具结果都会追加一条采用哈希链并以 ed25519 签名的记录——代理执行的操作可在事后验证
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:zhengqiuyang/dsh-attest-chain#ce815c6d3b78579b535e3512cbe91b4d56abe1dfAttest Chain 以 dsh-attest-chain 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Signed chain-of-custody for DeepSeek Harness (dsh) sessions.
Headless agents bypass PR gates entirely; chat UIs show what the agent said
it did. This plugin records what the agent actually did: every watched
tool result (bash, write, edit, web_fetch, …) appends a hash-chained,
ed25519-signed custody record to a durable JSONL ledger. Tamper with any line
and the chain breaks; delete the tail and it no longer matches the published
head. Zero LLM calls in the trust path.
Family: dsh-read-guard guards what the agent reads, dsh-pr-gate gates what it writes, dsh-attest-chain proves what it did.
Nothing in the dsh plugin ecosystem produces tamper-evident records of agent
activity. The nearest neighbours inventory plugins (dsh-harbor, 24★ — a
read-only list of what's installed) or add LLM-based reviewing. The
in-toto-shaped lane — signed, verifiable, CI-consumable evidence of what an
agent session did — is empty. The signing core is vendored from
agent-attest, whose CI gate
can consume this ledger as session-side evidence.
tool result ──> custody record {time, tool, callId, isError, sha256(content)}
──> chained: digest = sha256(canonicalJSON({seq, prevDigest, record}))
──> signed: ed25519 over the digest (keypair in .dsh-attest-chain/keys/)
──> appended: .dsh-attest-chain/session.jsonl (one line, strict order)
Verification is pure and offline: replay the ledger, recompute every digest, check every link and signature. Publish the head digest (or the public key) anywhere durable — a PR description, a CI variable — and any later comparison detects tampering or truncation deterministically.
A keypair is generated on first run; the private half never leaves the
machine running the agent. sign: false runs a digest-only chain if you only
need tamper-evidence against a published head.
dsh plugin --profile default add dsh-attest-chain
From npm — no build step, no allowBuilds authorization; git installs are equally prebuilt (lib/ ships in the repo).
- id: dsh-attest-chain
name: dsh-attest-chain
config:
tools: [bash, write, edit, str_replace_editor, web_fetch]
ledgerPath: .dsh-attest-chain/session.jsonl
keysDir: .dsh-attest-chain/keys
sign: true
Add .dsh-attest-chain/ to your repository's .gitignore — the private key must
never be committed; the public key is what a verifier checks.
npm install
npm test # syncs the vendored agent-attest core, builds, runs unit tests
The canonical-JSON serializer and ed25519 PEM helpers are vendored from the
sibling agent-attest checkout (npm run sync; CI runs sync --check).
verify tool card: replay + verdict inside the Web UIIf dsh ships first-party signed session records, or a major plugin-adds attestation natively, this freezes at its last working version with a postmortem here. The signing core stays owned by agent-attest either way.