dsh-action-outbox

LIMITATIONS

已知限制

- This is not a distributed transaction across tools or services. - The plugin cannot generically undo a reported success or determine whether a timed-out external system applied a write. - Batch approval does not weaken a target tool owner's own approval policy, so commit can still prompt again. - Arguments already appear in DSH tool/session history and, with persistence enabled, in a local `0600` state file. Do not stage secrets the original tool contract should not expose. - The tool fingerprint covers the declared name, descriptions, schemas, and timeout. It is a drift detector, not a signature over plugin implementation code or provenance. - The Inbox inherits the DSH Web access boundary. It does not add independent multi-user authentication. - Enforcement covers DSH registry calls; it is not a sandbox against malicious in-process code. - Read tools whose output is needed for planning should be called normally rather than staged. See [the research note](docs/research.md) for the comparison, duplicate scan, and paper-derived design. See [the threat model](SECURITY.md) before deploying on a shared host.