Source excerpt
摘要 本 PR 加固 dsh-plugin-registry/v2 的索引契约、输入边界和确定性生成规则，并补充正式的索引 JSON Schema。目标是让中央仓库与只读客户端对畸形、重复、超限或不可信索引统一 fail-closed，避免把“索引不可验证”误报为“名称可用”。本 PR 不新增任何正式插件登记。
Automatically summarized from source discussions. Sources and the full record are available below.
Evidence & timeline
Verification
Not yet verified
Maintainer response
Untriaged
Author response
No response recorded
Earliest source found so far
Unknown
Sep 8, 2026, 08:56 AM
Lifecycle
Emerging
Source scope
6 automatically linked original sources; source relationships and independence are not human reviewed
Attribution confidence · 0%
First found by this site · Sep 8, 2026, 08:58 AM
No source-to-source propagation relation recorded.
feat: integrate central registry validation
Open source Opens in a new tabfeat: harden registry v2 index contract
Open source Opens in a new tabfeat(paper): formalize incident-family annotation protocol
Open source Opens in a new tabComment on feat(paper): formalize incident-family annotation protocol
Open source Opens in a new tabdocs(cards): add 0.1.5-rc.2 → 0.1.6-alpha.1 corridor card set (DSH-0.1.6-A1, 38 cards)
Open source Opens in a new tabComment on docs(cards): add 0.1.5-rc.2 → 0.1.6-alpha.1 corridor card set (DSH-0.1.6-A1, 38 cards)
Open source Opens in a new tabThe lead source, “feat(benchmark): S18 terminal sprite render trap (half-block SGR leak, trim ghosting, timer pinning),” says: “Summary Adds benchmark task S18-terminal-sprite-render-trap (static, read-only report): a terminal half-block sprite renderer whose three independent rendering bugs (SGR background.” 36 related sources are linked for comparison to determine whether they describe the same event.
The lead source, “docs(cards): 0.1.6-alpha.1 fleet-crossing companion + DSH-0.1.6-A1-39/40 (Agent Teams, Node PTC env) and A1-02/A1-36 fix,” says: “改了什么 新增 dsh-v0.1.5-rc.2 → dsh-v0.1.6-alpha.1 走廊卡（skills/plugin-upgrade/references/v0.1.6-alpha.1.md，DSH-0.1.6-A1 系列 9 张），并更新 references/README.md 走廊索引。.” 14 related sources are linked for comparison to determine whether they describe the same event.
The lead source, “feat(benchmark): H22 not-listed trap — the package that installs but never registers,” says: “Distilled from a real top-tier failure: anywhere-labs/dsh-desktop (22k★) failed our 50-plugin live verification on 09-01 with exactly this shape — dsh plugin add succeeds, the entr.” 31 related sources are linked for comparison to determine whether they describe the same event.
