dsh-context-provenance

LIMITATIONS

Known limitations

- Loader entries do not identify the bundle, profile, override, or dependency that introduced them. - Plugin inventory reveals ordered enablement and lifecycle categories, but never raw entry ids, package names, file URLs, absolute paths, or patch specifiers. - A tool name or schema does not identify its owning plugin. - Skill names remain visible because they are the public callable identity; source/provider are reduced to fixed categories. A skill name itself may still be sensitive if a deployment chooses a sensitive name. - AGENTS location categories are durable injected-source metadata, not a filesystem inventory or proof of hidden instructions. - Adjacent observations cover actual ordinary `llm/stream` calls seen while this plugin is mounted. Earlier requests, auxiliary calls, and observations lost on unload or restart are unavailable.