dsh-consumer-audit

When a plugin registers tools, skills, services, or routes, a successful registration does not mean the model has actually called them. The code is present, it loads cleanly, it passes tests, yet no task ever reaches it. A subtler case exists too: a package that only wraps the host's existing methods, looks like it did nothing on the manifest, and yet is silently in effect. These silent capabilities are never self-reported, turning into invisible tech debt inside your profile.

consumer_audit turns this into an auditable checklist. It reads the active profile composition, resolves the package behind each row, statically scans that package's registration sites, then counts invocations in the multi-frame zstd session logs under DSH_HOME. The report covers eight finding types: tools never invoked, skills never loaded, prompt-only packages, mounted rows that register nothing, duplicate prompt section names, unresolvable packages, tools called but always returning isError, and the skill equivalent of the last. Every finding carries an evidence locator, a gap classification, and a falsification condition. The report keeps three layers strictly separate, and ships a zstd log reader entry point so the model can retrieve recent call arguments and return bodies to judge whether the content actually works as designed.

Use it when: you just installed a new plugin and want to confirm it is doing something; you are about to prune a profile and need to know which row is safe to remove; you are authoring a plugin and want to find registration sites that no task has ever touched; or you suspect a feature was written but never wired up. The report makes no semantic judgments. The plugin's job is to hand over the records and let the model do the reasoning.