Build the evidence chain in order
- 01
Review provenance and rights
Confirm the declared source category, required attribution, and AI-generated status before treating image inputs as publishable.
- 02
Validate the declaration
Require the exact schema, kind, slug, version, fixed token catalog, controlled visual values, asset roles, and compatibility fields.
- 03
Install the final candidate in isolation
Generate the tgz, install it into an isolated rc.6 web profile, and confirm exactly one active direct @dsh-themes/* package.
- 04
Capture real light and dark evidence
Use the DSH Appearance control in the actual Web UI, replace simulated previews with controlled runtime WebP derivatives, and preserve their metadata.
- 05
Rebuild and verify deterministically
Let the trusted generator rebuild from the reviewed declaration and assets, then verify the final complete artifact before publication.
Keep digest scopes separate
| Token | Role | Check |
|---|---|---|
| artifact.sha256 | Final complete tgz bytes | Authorizes the exact downloaded installation artifact |
| payload.sha256 | Canonical tar payload excluding the manifest | Supports deterministic content audit, not download authorization |
| preview asset SHA-256 | One controlled runtime image derivative | Must match its URL, dimensions, byte size, and asset declaration |
- Reject simulated or external publication previews.
- Reject unrecognized compatibility fingerprints and any fabricated rc.6 commit.
- Reject artifact, integrity, path, MIME, byte-size, or dimension mismatches.
- Reject symlinks, path traversal, untrusted executable author input, and non-deterministic rebuilds.
- Publish only a specific reviewed version whose controlled download is available.
Prepare the release
Continue learning
Continue from the verified evidence
Compare published artifacts or return to the installation documentation.