dsh-instruction-audit

Readme

# dsh-instruction-audit

`dsh-instruction-audit` records privacy-minimal receipts for the workspace
instruction files that DeepSeek Harness actually placed into a session. It is
an independent community bundle, not an official DeepSeek AI package.

It observes the durable `agent-instructions` message source already emitted by
the Harness. Each receipt contains the session id, event sequence/time,
baseline flag, logical scope, display path, action, and producer-owned content
digest. It never reads instruction files, stores instruction text, modifies a
workspace, or changes prompt assembly.

The published bundle has no runtime npm dependencies. It uses the existing
Cordis context supplied by the active Harness process and only imports that
type while building.

This is useful when auditing which `AGENTS.md`/`CLAUDE.md` files actually
affected a session, especially after a nested-workspace boundary or instruction
budget incident.

## Install

Build a portable tarball first:

```sh
pnpm install
pnpm pack
dsh plugin --profile web add ./dsh-instruction-audit-0.1.1.tgz
```

The bundle writes receipts under `$DSH_HOME/instruction-audit/v1/`. File names
are SHA-256 hashes of session ids; the id remains inside each JSONL receipt.
Override the location without changing Harness state:

```yaml
- id: instruction-audit
  config:
    receiptRoot: /absolute/path/to/receipts
```

Read one session's receipts:

```sh
dsh-instruction-audit --session session-123
```

## Evidence Boundary

`--dump-config` proves only that the layer composes. A release must also be
tested by installing the packed tarball into a temporary `DSH_HOME`, booting a
real loopback Web profile, emitting a real durable `user/message` event with
the Harness `agent-instructions` source, observing one receipt, and confirming
that its JSONL contains no instruction body.

The plugin deliberately does not infer instructions from the filesystem. A
receipt proves only the structured source the Harness logged; it does not prove
that a model followed the instructions or that a digest is a security boundary.

## Verification

Version `0.1.1` was verified against DeepSeek Harness source revision
`47f943859bef60e4160492346772ded9b24f765a` by:

1. Building the Harness production libraries and Web frontend.
2. Packing this repository, then installing the tarball with
   `dsh plugin --profile web add` into a fresh `DSH_HOME`.
3. Booting the actual loopback Web profile.
4. Appending an `agent-instructions` user message through the real
   `SessionStore` publication path, then reading its receipt with this package's
   installed CLI.

The proof used a distinct instruction-text sentinel and confirmed it was not
present in the persisted JSONL. Unit coverage also checks malformed events,
replace/remove transitions, and same-session write order.

## License

MIT