Skip to main content
Glama
dsh-license-obligation-proof

dsh-license-obligation-proof

dsh-license-obligation-proof

Maintainer / Author:He Fangsheng (贺方升 / 贺去病; also known as Dosen) · hequbing.com

Offline, deterministic evidence that every required compliance artifact for a supplied release decision was delivered: NOTICE, license text, source offer, source bundle, or modification notice. Inputs and reports contain hashes, obligation codes and bounded metadata only—never license bodies, copyright text, package source or secrets.

This is deliberately not another license scanner. dsh-license-guard already scans node_modules, normalizes SPDX identifiers and applies allow/deny policy. This plugin starts after scanning and expert review: it verifies that the declared component set, decisions, obligations, delivered artifact digests, distinct receipts and fresh zero-unresolved closure agree. It does not scan packages, normalize SPDX, interpret a license, or provide legal advice.

npm test
npm run check
node bin/dsh-license-obligation-proof.mjs verify examples/closed.json

DSH tools: dsh_license_obligation_inspect and dsh_license_obligation_verify. MCP exposes equivalent proof-only inline tools. Reports explicitly retain provesComponentSetExhaustive: false and provesLegalCompliance: false.

References: SPDX License Expressions and OpenChain ISO/IEC 5230.

MIT licensed.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • F
      license
      Not graded
      quality
      D
      maintenance
      Enforces protocol-driven development by validating requirements, designs, scope, and acceptance evidence, while maintaining immutable, traceable governance archives.
      -
    • A
      license
      Not graded
      quality
      C
      maintenance
      Enables offline, deterministic verification that one immutable artifact followed a declared build-to-production promotion chain, using only hash-based evidence and failing closed on incomplete or nonconformant gate records.
      MIT
    • A
      license
      Not graded
      quality
      C
      maintenance
      Enables offline verification that a supplied DSH workflow adhered to declared duty-separation constraints, producing a redacted, content-addressed JSON verdict.
      MIT