Preface¶

The philosophy of DSH is “everything is a plugin”; the community catalog is an independent site with no official affiliation to DeepSeek / High-Flyer. When developing DSH / agents, a common step is to confirm at runtime whether a given skill is effective according to trusted sources. dsh-capability-receipt handles this step: it generates content-addressed receipts for the skills actually loaded by the DeepSeek Harness, allowing runtime observations to be verified offline.

What This Is¶

dsh-capability-receipt is an MIT-licensed DSH plugin, currently version 0.3.0, requiring Node.js 22 or higher. The repository is dongsheng123132/dsh-capability-receipt.

It hashes the effective instruction body returned by ctx.skills.get(), recording the winning provider/source/invocation policy; when the resource base is a local directory, it hashes the bounded local resource-directory closure. It then compares this runtime observation against trusted pinned hashes and writes a deterministic content-addressed receipt.

It only observes the target capability; it does not execute the target capability.

Core Features¶

DSH Tools¶

The plugin exposes three DSH tools:

• dsh_capability_receipt_inspect
• dsh_capability_receipt_issue
• dsh_capability_receipt_issue_from_pack

dsh_capability_receipt_issue uses the required expectedContentSha256 and writes the receipt with an explicit workspace-relative artifactDir.

dsh_capability_receipt_issue_from_pack uses skillName, packLockPath, and artifactDir, reads the workspace-relative pack-agent agent-pack/lock/v1 lock, and recomputes directory and portable-bundle skill hashes.

MCP Proof Surface¶

The plugin also exposes two MCP stdio tools:

• capability_receipt_inspect_lock
• capability_receipt_verify_recorded

The MCP surface is proof-only and in-memory: it cannot inspect the live DSH registry, cannot read files, cannot access the network, cannot execute a capability, and cannot write a receipt.

pack-agent Bridge¶

The pack-agent lock here serves as evidence input, not as a signature or trust anchor. The plugin compares the lock against DSH runtime observations by recomputing the pack-agent’s directory and portable-bundle skill hashes.

Installation and Enablement¶

It is recommended to install in an isolated DSH profile and pin to a reviewed commit. The command is as follows:

dsh plugin --profile capability-proof add \
  github:dongsheng123132/dsh-capability-receipt#<commit>

Before installation, review the source code and license. The plugin runs with the current dsh process privileges. The package declares a DSH bundle and carries a cordis.patch.yml; it does not use install lifecycle scripts.

Typical Usage¶

First pin the trusted source artifact, then generate receipts within DSH, and finally verify offline.

Generating Receipts¶

Prepare the trusted source artifact and the expected SHA-256 in advance. Within DSH, you can call:

• dsh_capability_receipt_issue: requires expectedContentSha256, with an explicit workspace-relative artifactDir.
• dsh_capability_receipt_issue_from_pack: requires skillName, packLockPath, and artifactDir.

After the above steps, you will obtain a content-addressed receipt artifact.

Offline Verification¶

The CLI does not discover or load skills; it only verifies generated artifacts:

dsh-capability-receipt verify \
  --receipt artifacts/capability-receipt-<sha256>.json \
  --require-verified

stdout outputs a JSON result. Verification failures go to stderr with exit code 4; usage errors use exit code 1.

Local Checks¶

npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp

Applicable Scenarios and Notes¶

Suitable for:

• Proving that skills actually loaded in DSH match trusted sources.
• Using pack-agent lock as evidence input rather than as a signature or trust anchor.
• Offline verification of already-generated receipts.

The receipt fails closed:

• If the DSH catalog is incomplete or changes during observation.
• If the loaded definition is inconsistent with its catalog entry.
• On expectation mismatch.
• If resources cannot be safely closed.

Resource security defaults:

• Maximum 256 regular files.
• Maximum 1 MiB per file.
• Maximum total size of 8 MiB.
• Symbolic links and special files are rejected.
• URLs and opaque resource bases are disclosed as unavailable rather than fetched.

Boundaries:

• The receipt proves consistency between runtime observations and trusted pinned hashes.
• The pack-agent lock is evidence input, not a signature or trust anchor.
• The plugin does not execute the target capability.

Conclusion¶

dsh-capability-receipt turns “what DSH actually loaded” into verifiable content-addressed evidence.

GitHub: https://github.com/dongsheng123132/dsh-capability-receipt
Plugin catalog hint: https://www.skillhub.cn/plugins/dongsheng123132/dsh-capability-receipt (this address comes from a plugin hint, not cited as verified fact)