deepseekplugins

DeepSeek Harness plugin

dsh-surface-contract-proof

Content-addressed conformance proof across recorded DSH ToolRuntime, MCP JSON-RPC and CLI JSON surfaces

Development & Runtime
Jump to install

Source facts

Repository
dongsheng123132/dsh-surface-contract-proof
Latest update
Aug 20, 2026
Category
Development & Runtime
GitHub stars
2
Format
plugin
Catalog evidence
Upstream dsh.bundle evidence
Evidence path
package.json#dsh.bundle
Checked against
0.1.0-rc.8
Upstream check date
2026-08-20

This evidence comes from the upstream catalog. This site has not installed, run, or security-reviewed the plugin.

Install

Start with a prompt that asks an agent to review the GitHub repository and source. Switch to the command if you want to install it yourself.

Copy this prompt into DSH, Codex, or another agent and ask it to review the GitHub repository and source first.

Do not install or run any commands yet. Read this plugin's GitHub repository, README, and relevant source code. Then answer the questions below clearly and directly so I can decide whether it fits my needs:

1. What is this plugin, and what problem does it solve?
2. Who is it for, and what are its typical use cases?
3. How is it used after installation? Include one minimal example.
4. What known limitations or privacy, security, compatibility, or maintenance risks does it have?
5. Give a clear recommendation: recommend, conditionally recommend, or do not recommend, with reasons.

Distinguish statements documented by the repository, inferences from source code, and unknowns. If evidence is insufficient, say so explicitly. Do not guess or simply repeat the README.

GitHub: https://github.com/dongsheng123132/dsh-surface-contract-proof
Plugin: dsh-surface-contract-proof
Author: dongsheng123132

Check the source files

Read the README and other files from this plugin directory before installing.

File explorer3 files
README.mdSource · read only

dsh-surface-contract-proof

![CI](https://github.com/dongsheng123132/dsh-surface-contract-proof/actions/workflows/ci.yml) ![MIT license](LICENSE) ![Node.js 22+](package.json) ![Awesome DSH Plugins](https://github.com/dongsheng123132/awesome-dsh-plugins#2origin-plugin-lab)

dsh-surface-contract-proof verifies that recorded DeepSeek Harness ToolRuntime, MCP JSON-RPC, and CLI JSON envelopes preserve one pinned semantic contract across a baseline and an observed revision.

Version 0.2.0 removes the bundled DSH tool runtime and the default export that stock Cordis Loader misclassified. It exposes host-neutral tool definitions through its namespace export and is regression-tested through real local-path and fixed-commit stock Web profiles.

It reads explicit, SHA-256-pinned JSON fixtures. It does not execute the target, start arbitrary commands, call a network service, replay side effects, or implement an action core.

Complementary boundary

dsh-action-parity proves that interfaces bind the same Action ID/core and that runtime success/conflict behavior is reachable. This plugin answers a different upgrade question: given immutable recordings, did request/response schema versions, success bits, error classes, exit-code mapping, conflict and confirmation semantics, normalization, timeout/stale/out-of-order behavior, and result digests remain identical across ToolRuntime, MCP, and CLI?

Generic OpenAPI/Pact tools validate HTTP consumer-provider contracts. This verifier is specific to the three DSH machine surfaces and uses offline recorded envelopes.

Safety and evidence

  • Exactly three surface kinds are required: dsh-toolruntime, mcp-jsonrpc, and cli-json.
  • Baseline and observed fixtures bind target revisions, contract/schema versions, transport versions, and SHA-256 bytes.
  • Surface-specific fields normalize into one canonical case digest; the manifest pins each expected digest.
  • Missing, stale, malformed, secret-shaped, schema/version-drifted, or semantically different fixtures fail closed.
  • Reports expose hashes, identities, statuses, and differing field names only—never request arguments, response bodies, CLI output, prompts, messages, credentials, or secrets.
  • Paths are workspace-relative regular files; traversal and symlinks are rejected. Writes are atomic, read back, and limited to explicit artifactDir.

CLI

dsh-surface-contract-proof inspect --workspace . --manifest contract.json
dsh-surface-contract-proof verify --workspace . --manifest contract.json --artifactDir artifacts

Use inspect to obtain canonical baseline digests, review them, then pin them as cases[].expectedSha256. Exit 0 means verified; exit 2 means failed or invalid evidence.

DSH / MCP tools

  • dsh_surface_contract_inspect
  • dsh_surface_contract_verify
  • MCP aliases: surface_contract_inspect, surface_contract_verify

The MCP surface is proof-only and in-memory: it accepts bounded inline manifest/fixture JSON, reads or writes no files, and returns no fixture bodies. DSH/CLI may write only a content-addressed report beneath an explicit workspace-relative artifactDir, with atomic read-back verification.

dsh plugin --profile surface-contract add github:dongsheng123132/dsh-surface-contract-proof#<commit>

Development

npm ci
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp

MIT licensed. See [SECURITY.md](SECURITY.md).

Back to searchOpen GitHub repository

More related plugins

View category