dsh-windows-readiness-proof
托管 Windows 主机上经清理的 DeepSeek Harness 观测数据的内容寻址就绪性证明
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-windows-readiness-proof#46cc6b8dbaa0f970ffa326615cb1e52683516929Windows Readiness Proof 以 dsh-windows-readiness-proof 发布，当前版本为 0.1.3。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
dsh-windows-readiness-proof evaluates a SHA-256-pinned, sanitized observation of a managed Windows host against explicit DeepSeek Harness readiness requirements.
It is an evidence verifier, not a collector or remediation tool. It never runs PowerShell, reads the registry, changes Group Policy, creates Defender exclusions, edits WDAC/AppLocker, installs software, restarts services, or probes the network.
An explicit manifest fixes an opaque machine digest, snapshot revision, observation bytes, evaluation time, maximum evidence age, and requirements for:
Missing, stale, future, malformed, secret-shaped, identity-bearing, path-escaping, symlinked, or policy-mismatched evidence fails closed. Reports expose only opaque identities, hashes, classifications, reason codes, and control status—not usernames, domains, endpoints, registry paths, command output, credentials, or raw observations.
Harness Doctor diagnoses local DSH/Codex/OpenClaw installation health. Windows desktop-control skills execute UI and PowerShell actions. This plugin does neither: it verifies a pre-collected enterprise readiness fact set under a reviewable policy and produces a deterministic artifact suitable for CI or audit.
dsh-windows-readiness-proof inspect --workspace . --manifest manifest.json
dsh-windows-readiness-proof verify --workspace . --manifest manifest.json --artifactDir artifacts
Exit 0 means verified; exit 2 means a readiness or evidence failure.
The DSH entry is a namespace plugin (name / inject / apply) with no default export. This is part of the shipped compatibility contract: the real Cordis Loader must retain the tools injection when a stock Web profile loads the bundle. The plugin smoke and structural check fail if a default export is reintroduced.
Version 0.1.3 also removes the runtime import of @deepseek-ai/dsh-tools. The optional peer was not installed by DSH's isolated github: plugin installer, so a composed profile could list the plugin while its tool module failed to load. Tool definitions are now self-contained; installation and composition alone should not be mistaken for a successful tool call. The pinned 0.2.0 RC1 ToolRuntime smoke covers the latter at service level, not a full profile Loader or model-driven task.
For a built DSH checkout and an isolated Web profile containing this bundle, run DSH_CHECKOUT=/path/to/dsh DSH_HOME=/path/to/isolated-home npm run smoke:web-loader. The smoke starts the real stock Web profile with a bounded, credential-free environment and requires an actual readiness URL.
dsh_windows_readiness_inspectdsh_windows_readiness_verifywindows_readiness_inspect, windows_readiness_verifydsh plugin --profile windows-readiness add github:dongsheng123132/dsh-windows-readiness-proof#<commit>
See examples/README.md for a synthetic, non-collecting example. MIT licensed.