omdsh-runtime

OMDSH Runtime is a headless execution layer that tackles the architectural fragmentation caused by extra Loaders or daemons in Harness Profile management. It reuses official Harness Profile, Bundle, Cordis, and package operations directly, adding deterministic plan/apply workflows, candidate generation, explicit confirmation, and previous-generation recovery, while DSH Hub Workshop remains the sole authority for discovery, authoring, review, and feed. Runtime handles only the auditable execution boundary, introducing no second Loader or background process.

Its core capability centers on Portable Profile Packs (omdsh-profile-pack/v1), a small and reviewable JSON distribution format that pins exact Registry project and Release IDs, locks author-owned sources to full Git commit hashes, and carries SPDX license expressions, Ed25519 publisher signatures, and named-instance generation pointers. Packs never copy plugin payloads, credentials, sessions, environment files, or absolute local paths, eliminating the risk of sensitive data leaking with a distribution. Built-in presets remain ID-only references to the official Harness installation; custom presets are embedded as UTF-8 text only after rejecting symlinks, credential-like content, binary data, and absolute user paths, and applying them requires explicit --trust-preset authorization.

It is well suited for engineering teams that need to reproduce the exact same Harness configuration across environments, organizations with hard requirements on license compliance and publisher signatures, and operations or DevOps personnel who want deterministic rollback and generation management without introducing a second Loader.