# dsh-output-custody-proof

Offline, deterministic verification of body-free DSH tool-result custody receipts. It reconciles the formatted source digest and byte count with model-visible or durable-only projection, optional full-text spill reference, and durable `tool/result` or `tool/code-dispatch` event. It checks byte budgets, exact omission accounting, spill/source identity, surface mapping, stage order, duplicate call/locator identities and explicit upstream incompleteness.

This is not a spill store, output transformer, redactor, session exporter or result recorder. DSH's `dsh-output-retention` library decides what was mechanically retained, `dsh-spill-policy` transforms oversized plain-text results, and `dsh-spill-local` stores them. `dsh-telemetry-redactor` redacts export copies. This plugin only verifies explicit receipts from those or other producers. It never reads result bodies or opens spill artifacts, and every report states that hashes do not prove source authenticity or real-world completeness.

The distinction matters in DSH 0.1.1-rc.1: native results are model-visible and durable; Code Mode sub-call values are execution-local while `tool/code-dispatch` retains only rendered content; mixed/image results bypass generic plain-text spill. Upstream truncation is disclosed separately from budget omission.

## Install and use

```sh
dsh plugin --profile web add github:dongsheng123132/dsh-output-custody-proof#COMMIT
dsh-output-custody-proof inspect examples/custody.json
dsh-output-custody-proof verify examples/custody.json artifacts
```

DSH tools: `dsh_output_custody_inspect`, `dsh_output_custody_verify`. MCP tools: `output_custody_inspect_inline`, `output_custody_verify_inline`. MCP is inline-only. File tools accept workspace-relative paths, reject traversal and symlinks, cap inputs, write only below an explicit artifact directory, publish create-only, and verify by read-back.

The schema accepts only bounded identifiers, byte counts, classifications and SHA-256 digests—never tool values, output text, prompts, messages, credentials or spill locators. See `examples/custody.json`.

Run `npm test`, `npm run check`, `npm run smoke:plugin`, and `npm run smoke:mcp` to verify the repository. MIT licensed; see [SECURITY.md](SECURITY.md).