# Public DSH Contract Matrix

Validated against DeepSeek Harness 0.1.1-rc.2 and the official plugin development guide.

| Need | Public contract | Decision |
|---|---|---|
| Tool registration | `@deepseek-ai/dsh-tools`: `ctx.tools.register(defineTool(...))` | Supported; Cordis-owned cleanup. |
| Session identity / cwd / cancellation | `exec.agent?.session`, `session.header.cwd`, `exec.signal` | Supported; tools fail closed without an agent cwd. |
| Canonical filesystem | `@deepseek-ai/dsh-fs`: `ctx.fs` | Supported. |
| Filesystem policy | `ctx.sandboxPolicy.resolve(...)`, `ctx.fs.sandboxMode`, and `ctx.fs.writeText(..., policy)` | Supported; mutations use an exact provider version guard, and read-only escalation is unavailable for bare non-enforcing providers. |
| Read observations | Public `fs/observed` event | Supported; this plugin also owns exact observed line intervals. |
| Process management | `@deepseek-ai/dsh-subprocess`: `ctx.subprocess` | Supported. |
| Process confinement | `@deepseek-ai/dsh-sandbox`: `ctx.sandbox.confine` | Supported; process-backed read tools force read-only policy and inspect reported enforcement. Full is required by default; explicitly opted-in native Windows may accept partial enforcement. The public contract has no backend attestation. |
| Atomic process read whitelist | No public contract | Unsupported; AST directory/path scans are gated off and exact provider-read file bytes are supplied over stdin. |
| Process launch approval | Generic `ctx.approval.request` only | Enabled by default and operator-configurable; disabling the prompt never disables forced read-only policy, enforcement eligibility checks, or the exact configured spawn plan. |
| Oversized output | `@deepseek-ai/dsh-spill`: `ctx.spillStore.saveText` | Supported when an owner session exists; otherwise output remains bounded. |
| Settings UI | `@deepseek-ai/dsh-settings` plus the public `settings.plugin.item` client slot | Supported; the Host exposes `coding-tools`, while the browser card edits four live availability controls, two live approval controls, and one warned native-Windows compatibility control through the revision-fenced settings scope. The Host uses `SettingsScope.watch`, exact registration disposers, a transition guard, and generation-scoped cancellation. |
| Built-in read bookkeeping | No consumer API required | The plugin uses its own `code_read` observation store. |

No DSH private source path is imported.