dsh-license-obligation-proof

Scanning is only the starting point of a compliance workflow. dsh-license-guard already handles node_modules scanning, SPDX identifier normalization, and allow/deny policy. But after scanning and expert review, a critical gap remains: did you actually deliver every required compliance artifact, whether a NOTICE file, license text, source offer, source bundle, or modification notice? dsh-license-obligation-proof is an offline, deterministic verification tool built for exactly that step. It does not rescan packages, normalize SPDX expressions, interpret license terms, or offer legal advice. Instead, after human review it checks that the declared component set, recorded decisions, obligation codes, delivered artifact digests, distinct receipts, and a fresh zero-unresolved closure all agree, then emits a retainable proof report.

Report data is strictly minimized: only hashes, obligation codes, and bounded metadata are included. License bodies, copyright text, package source code, and secrets are never present. Reports explicitly carry provesComponentSetExhaustive: false and provesLegalCompliance: false, making clear that this is a delivery-integrity attestation, not a legal-compliance conclusion. The tool is exposed as dsh_license_obligation_inspect and dsh_license_obligation_verify, with equivalent proof-only inline tools available over MCP.

This plugin is best suited for supply-chain security or release-engineering teams that already follow an SPDX or OpenChain (ISO/IEC 5230) compliance process, run dsh-license-guard scanning and human review, and need an offline, reproducible way to produce an evidence chain confirming that every obligated artifact was delivered, all without ever touching the license source text.