Dsh Surface Contract Proof

Key features

• Exactly three surface kinds are required: dsh-toolruntime, mcp-jsonrpc, and cli-json.
• Baseline and observed fixtures bind target revisions, contract/schema versions, transport versions, and SHA-256 bytes.
• Surface-specific fields normalize into one canonical case digest
• the manifest pins each expected digest.
• Missing, stale, malformed, secret-shaped, schema/version-drifted, or semantically different fixtures fail closed.