dsh-config-origin-proof
用于 DSH 配置胜出项和被遮蔽来源的内容寻址证据
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-config-origin-proof#84389e3b5ff517286dec32905eb20e01b0c8e46bConfig Origin Proof 以 dsh-config-origin-proof 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
点击下方 Badge 复制 Markdown，粘贴到 README 即可。
验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。
认领这个 Plugin →An evidence layer for DeepSeek Harness configuration source ownership. It verifies an explicit redacted recording of precedence domains, source observations, the expected winning source and value digest, shadowed sources, and unobserved higher-priority gaps.
It does not reimplement the DSH composer, collect live configuration, or compare policy changes. DSH's own --dump-config remains the authority for composition. This plugin turns a structured recording from that or another trusted producer into a reproducible receipt. dsh-policy-drift-proof compares baseline and observed policy posture; dsh-profile-lock-proof proves installed bundle closure; this project answers which recorded source won and why.
Raw values and secret-, credential-, prompt-, message- or prose-shaped fields are rejected. Reports contain only stable IDs, SHA-256 digests and verdicts. The verifier fails closed when a higher-priority source is unobserved.
dsh_config_origin_inspect, dsh_config_origin_verify.dsh-config-origin-proof verify --workspace-root examples --recording recording.json --artifact-dir artifacts.config_origin_inspect_inline, config_origin_verify_inline; inline-only, no filesystem, network, process or artifact writes.dsh plugin --profile web add github:dongsheng123132/dsh-config-origin-proof
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
The ordering in examples/recording.json follows DSH's published configuration-source ownership contract, but the recording is explicit and revision-bound so a future DSH change cannot silently rewrite old evidence.
MIT