dsh-capability-receipt
DeepSeek Harness 实际加载技能的内容寻址收据
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-capability-receipt#0ff716fa54cf9625b01d2f638fb65cec449b9eabCapability Receipt 以 dsh-capability-receipt 发布，当前版本为 0.3.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
dsh-capability-receipt proves which skill DeepSeek Harness actually loaded. It hashes the effective instruction body returned by ctx.skills.get(), records the winning provider/source/invocation policy, and—when the resource base is local—hashes a bounded resource-directory closure. It can then compare that runtime observation with hashes pinned by a trusted source artifact and write a deterministic content-addressed receipt.
This is deliberately not another skill package format, dependency resolver, installer, registry, evaluator, per-turn summary, or event audit ledger. Use pack-agent for packaging and distribution; use this plugin for the missing last hop between a fixed source artifact and the effective capability inside DSH.
Version 0.3.0 is host-neutral: the DSH entry does not import a private ToolRuntime helper and exposes no default export, so the stock Cordis loader preserves the module-level inject = ['tools', 'skills'] contract in the built web profile.
dsh_capability_receipt_inspect: returns structural fields and hashes without returning skill instructions, metadata, or absolute paths.dsh_capability_receipt_issue: requires expectedContentSha256, accepts optional resource/provider/source/invocation expectations, and writes only beneath an explicit workspace-relative artifactDir.dsh_capability_receipt_issue_from_pack: reads a workspace-relative pack-agent agent-pack/lock/v1, recomputes pack-agent's directory and portable-bundle skill hashes, requires the effective DSH body to equal the locked SKILL.md body, checks optional provider/source/invocation expectations, and writes the same receipt format.The plugin observes but never executes the target capability. A receipt fails closed when the DSH catalog is incomplete or changes during observation, when the loaded definition disagrees with its catalog entry, when an expectation mismatches, or when resources cannot be safely closed.
The formal .mcp.json declaration exposes two stdio tools:
capability_receipt_inspect_lock parses one explicit inline pack-agent lock and returns only identities and hashes.capability_receipt_verify_recorded compares an explicit recorded DSH content/resource digest envelope with that lock and returns a content-addressed verdict.This MCP surface is intentionally proof-only and in-memory. It cannot inspect the live DSH registry, read files, access the network, execute a capability, or write a receipt. Live observation and artifact issuance remain DSH ToolRuntime responsibilities, sharing the same core verifier.
After pack-agent has exported/installed a pack, issue a receipt against its lock without translating it into another manifest:
pack-agent .agent-pack/lock.json
│ skill contentHash + fileCount
▼
dsh_capability_receipt_issue_from_pack
│ recompute pack-agent hash + compare loaded SKILL.md body
▼
content-addressed DSH runtime receipt
Required inputs are skillName, packLockPath, and artifactDir. The lock's ref and lockedAt are not copied into the receipt. The bridge currently pins the hash contract observed at pack-agent commit e2db1f8f56b74b64597a01175c810358f2c0b450; the fixture records the exact upstream Git blobs. Both directory-source and portable-bundle path forms are recognized, and the matched form is explicit in verification.matchedHashMode.
Pin a reviewed commit in an isolated DSH profile:
dsh plugin --profile capability-proof add \
github:owner/dsh-capability-receipt#<commit>
The package declares its DSH bundle and ships cordis.patch.yml, so a successful plugin install adds the layer to that profile automatically.
The CLI never discovers or loads skills. It only verifies an already-issued artifact:
dsh-capability-receipt verify \
--receipt artifacts/capability-receipt-<sha256>.json \
--require-verified
stdout is one JSON result. Failures go to stderr and exit with code 4; usage errors exit with code 1.
Directory closure defaults to at most 256 regular files, 1 MiB per file, and 8 MiB total. Symbolic links and special files are rejected. URL and opaque resource bases are disclosed as unavailable rather than fetched. Limits may be lowered or raised in trusted DSH plugin configuration.
npm install
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
DSH_CHECKOUT=/path/to/deepseek-harness npm run smoke:dsh
Requires Node.js 22 or newer. No install lifecycle scripts are used.
A verified receipt proves equality with caller-supplied expectations or one pack-agent lock at one DSH runtime observation. A pack lock is evidence input, not a signature or trust anchor: the bridge verifies its equality to runtime files and the effective body, but does not prove who produced the lock. It also does not prove that the skill is useful or safe, that the capability was executed, or that external model/tool behavior was correct. Pin trusted source commits and preserve their review/evaluation evidence separately.