@openworkproof/dsh-plugin
DeepSeek Harness 的可验证授权、执行证据和离线交付验证
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dengyier/openworkproof-dsh-plugin#38a7998a76ab82f20d1d6c80faa936b50990bf1bPlugin 以 @openworkproof/dsh-plugin 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Add prior authorization, execution evidence, independent rechecking, and human acceptance to DeepSeek Harness code changes.
This is a community plugin discovered through the official DeepSeek Harness
dsh-plugin GitHub topic. It is maintained independently and is not an official
DeepSeek product or endorsement.
plugin: 0.1.0
DeepSeek Harness: exactly 0.1.1-rc.2
OpenWorkProof Core: 1.4.0 public release
customer_adoption: not_evidenced
deepseek_endorsement: not_evidenced
The tested protocol dependency is OpenWorkProof Core 1.4.0. The release
evidence proves the packaged integration behavior described below; it does not
prove production use, customer adoption, or DeepSeek endorsement.
A local preflight installs the exact plugin tarball and OpenWorkProof wheel into fresh environments. It drives real Harness tool calls, an external Verifier, host restart, composed offline delivery verification, and tamper rejection. The generated manifest binds both artifacts and repository revisions. This is not external reproduction, production use, customer adoption, or DeepSeek endorsement.
When an agent says that a change is complete, a customer still needs to know:
OpenWorkProof does not make an agent smarter. It makes declared agent work independently reviewable.
The installed bundle is disabled by default and reports no evidence; treat that
state as NOT_CONFIGURED. After an operator explicitly enables the plugin and
provides a private case directory, Audit is the default operating mode. Audit
observes the Harness tool pipeline and asks the Python bridge to sign an
ObservationRecord. It does not block existing native tools and never turns an
action without prior authorization into an ActionReceipt.
Enforce must be enabled explicitly. It denies the known native mutation
surfaces write, edit, bash, pwsh, str_replace_editor,
cordis_define, cordis_run, cordis_stop, and cordis_undefine, then
exposes only two consequential tools:
owp_apply_patch: applies one pre-authorized, bounded patch;owp_run_tests: runs the frozen test profile through an external Verifier
boundary.Async authorization is followed by a monotonic final guard. Missing, replayed, or mismatched decision state fails closed.
The public package is available on npm. Install the exact release:
dsh plugin --profile owp-preview add @openworkproof/dsh-plugin@0.1.0
dsh --profile owp-preview --dump-config
The tagged source can also be installed directly:
dsh plugin --profile owp-preview add \
github:dengyier/openworkproof-dsh-plugin#v0.1.0
This path builds TypeScript through the package prepare script. With pnpm 10
or later, the profile may require an explicit allowBuilds entry for
@openworkproof/dsh-plugin. Prefer the prebuilt npm package when that policy
cannot be changed.
To reproduce or inspect the package before installation:
pnpm install --frozen-lockfile
pnpm test
pnpm typecheck
pnpm build
pnpm pack --pack-destination dist
dsh plugin --profile owp-preview add \
/absolute/path/openworkproof-dsh-plugin-0.1.0.tgz
dsh --profile owp-preview --dump-config
The installed bundle is disabled (NOT_CONFIGURED). For an already prepared
private case directory, explicitly apply the packaged Enforce profile:
export OWP_CASE_DIRECTORY=/absolute/path/to/private-case
dsh --profile owp-preview \
--patch "$DSH_HOME/profiles/owp-preview/node_modules/@openworkproof/dsh-plugin/profiles/owp-verified.patch.yml"
The case must contain no Manager, Verifier, or Acceptor private key. General case initialization, the independent Verifier service, and external Acceptor workflow remain integration responsibilities in this V0.1 candidate.
OWP_CORE_ROOT=/absolute/path/to/OpenWorkProof-at-v1.4.0 \
node scripts/live-preflight.mjs \
dist/openworkproof-dsh-plugin-0.1.0.tgz \
/absolute/path/openworkproof-1.4.0-py3-none-any.whl \
dist/preflight-manifest.json
The preflight installs both packed artifacts into temporary clean environments,
checks the effective profile, exercises real Harness actions and an external
Verifier across process restarts, verifies the composed delivery in a second
process, rejects a tampered package, and writes a revision-bound manifest.
OWP_CORE_ROOT must name the exact Core source checkout that supplies the live
fixture and its isolated .venv; the script does not guess a local worktree.
The temporary profile is removed on exit. No package is published and no remote
service is contacted.
With an open case, the plugin registers:
/owp-status
/owp-evidence
/owp-verify
/owp-export
/owp-verify accepts no free-form claim. It submits the exact correlated
owp_apply_patch receipt to the core bridge for independent repository,
artifact, frozen-test, and causal-ledger readback. UNKNOWN and REFUTED
results remain non-success and never become VERIFIED merely because a result
file exists.
/owp-export prepares the full customer-private evidence package needed for
offline replay. Verify that package in a separate process with:
owp dsh-delivery-verify /absolute/path/to/export
Verification and acceptance are deliberately separate:
VERIFIED != ACCEPTED != PAID/SETTLED/LEGAL AUDIT/ADOPTION
The agent has no acceptance-signing surface. Manager and Acceptor private keys remain outside Harness.
The plugin starts owp dsh-bridge --stdio, exchanges closed JSONL messages,
observes declared tool metadata and durable event identifiers, and may write
signed observations into the case evidence root. One-use decision tokens live
only in memory.
It does not collect hidden reasoning, arbitrary environment variables, or files outside the frozen case. It does not hold funds, execute payments, or accept work for a human. DeepSeek Harness and other installed plugins may have their own network and telemetry behavior.
dsh plugin --profile owp-preview remove @openworkproof/dsh-plugin
Uninstalling the profile dependency does not delete ledgers, evidence roots, session events, exports, or public keys. Archive and verify any required delivery evidence before deleting it.
0.1.1-rc.2;owp_apply_patch / owp_run_tests;See SECURITY.md and the core integration guide.
Apache-2.0. See LICENSE.