dsh-output-custody-proof

Offline, deterministic verification of body-free DSH tool-result custody receipts. It reconciles the formatted source digest and byte count with model-visible or durable-only projection, optional full-text spill reference, and durable tool/result or tool/code-dispatch event. It checks byte budgets, exact omission accounting, spill/source identity, surface mapping, stage order, duplicate call/locator identities and explicit upstream incompleteness.

This is not a spill store, output transformer, redactor, session exporter or result recorder. DSH's dsh-output-retention library decides what was mechanically retained, dsh-spill-policy transforms oversized plain-text results, and dsh-spill-local stores them. dsh-telemetry-redactor redacts export copies. This plugin only verifies explicit receipts from those or other producers. It never reads result bodies or opens spill artifacts, and every report states that hashes do not prove source authenticity or real-world completeness.

The distinction matters in DSH 0.1.1-rc.1: native results are model-visible and durable; Code Mode sub-call values are execution-local while tool/code-dispatch retains only rendered content; mixed/image results bypass generic plain-text spill. Upstream truncation is disclosed separately from budget omission.

Install and use

dsh plugin --profile web add github:dongsheng123132/dsh-output-custody-proof#COMMIT
dsh-output-custody-proof inspect examples/custody.json
dsh-output-custody-proof verify examples/custody.json artifacts

DSH tools: dsh_output_custody_inspect, dsh_output_custody_verify. MCP tools: output_custody_inspect_inline, output_custody_verify_inline. MCP is inline-only. File tools accept workspace-relative paths, reject traversal and symlinks, cap inputs, write only below an explicit artifact directory, publish create-only, and verify by read-back.

The schema accepts only bounded identifiers, byte counts, classifications and SHA-256 digests—never tool values, output text, prompts, messages, credentials or spill locators. See examples/custody.json.

Run npm test, npm run check, npm run smoke:plugin, and npm run smoke:mcp to verify the repository. MIT licensed; see SECURITY.md.