Skip to content

Releases: KKLL2025/dsh-project-anchor

Release list

v0.1.0-preview.0

v0.1.0-preview.0 Pre-release
Pre-release

Choose a tag to compare

View all tags
@KKLL2025 KKLL2025 released this 15 Aug 09:34
v0.1.0-preview.0
e7c5cc7

dsh-project-anchor v0.1.0-preview.0

This is the first GitHub-only public Preview of Project Anchor. It is not
published to npm.

Verified source commit:

e7c5cc780487143bb86419c0eedc001150782247

Install the reviewed revision

dsh plugin --profile web add github:KKLL2025/dsh-project-anchor#e7c5cc780487143bb86419c0eedc001150782247

The first add is expected to stop before executing the Git package's prepare
script. Review the pinned source, then add the exact key printed by pnpm to that
profile's pnpm-workspace.yaml:

allowBuilds:
  dsh-project-anchor@git+https://github.com/KKLL2025/dsh-project-anchor.git#e7c5cc780487143bb86419c0eedc001150782247: true

Repeat the same dsh plugin ... add command, then verify:

dsh plugin --profile web list dsh-project-anchor --depth 0
dsh --profile web --dump-config

The config should contain exactly one # == dsh-project-anchor layer with the
project-anchor-skills and project-anchor rows.

Evidence

  • GitHub Actions run: https://github.com/KKLL2025/dsh-project-anchor/actions/runs/31875852667
  • Ubuntu Node 22.19/24.11 checks: passed.
  • Windows Node 22.19/24.11 full local-RC jobs: passed.
  • Local release-gate candidate tarball SHA-256 for the reviewed source commit:
    ae7a8c2cb5140df57e27cf564a15e054039bdc35af23dea0f6eb5ee540e5eb8a.
  • Clean public-GitHub install used DSH 0.1.0-rc.6 and pnpm 11.21.0;
    default prepare denial, the exact full-SHA build key, source build, installed
    lockfile revision, all three frozen Skills, and one composed bundle layer were
    verified.
  • GitHub private vulnerability reporting is enabled.

Boundaries

  • DeepSeek Harness is a developer preview and may introduce breaking changes.
  • Git installation executes the reviewed package's build on the host after the
    explicit allowBuilds approval; it is outside any agent sandbox.
  • The DSH profile can report missing plugin peer packages because those rc.6
    services are host-owned. The supported verification is the composed bundle
    check above.
  • npm publication, ownership, and provenance are outside this Preview.
Loading