Preface¶

In DeepSeek Harness scenarios, whether policies or configurations have drifted relative to the baseline often requires a reviewable record. dsh-policy-drift-proof is used to generate this type of read-only, content-addressed drift evidence.

What This Is¶

dsh-policy-drift-proof is maintained by dongsheng123132 and is positioned as read-only, content-addressed policy/configuration drift evidence for DeepSeek Harness.

It pins the baseline and observed policy-snapshot/v1 via SHA-256 and revision, then uses them for comparison and drift classification.

Core Features¶

• Provides read-only, content-addressed policy/configuration drift evidence
• Pins baseline and observed policy-snapshot/v1 using SHA-256 and revision
• Supports ordered-not-weaker, set-no-additions, and exact rules
• Uncovered changes in covered leaves fail closed as UNCLASSIFIED_DRIFT
• CLI inspect and verify commands print a JSON object to stdout
• verify writes a content-addressed JSON report under an explicit artifactDir and validates its digest
• Registers DSH tools: dsh_policy_drift_inspect and dsh_policy_drift_verify
• Exposes MCP tools via .mcp.json: policy_drift_inspect and policy_drift_verify

Installation and Enablement¶

The runtime requires Node.js 22 or later, and the license is MIT.

First, install to the policy-proof profile, then compose that profile:

dsh plugin --profile policy-proof add github:dongsheng123132/dsh-policy-drift-proof#<commit>
dsh profile --profile policy-proof compose

Typical Usage¶

inspect outputs JSON based on the specified workspace and manifest:

node bin/dsh-policy-drift-proof.mjs inspect --workspace examples/basic --manifest policy-drift.manifest.json

verify performs validation and writes a content-addressed report under the specified artifactDir:

node bin/dsh-policy-drift-proof.mjs verify --workspace examples/basic --manifest policy-drift.manifest.json --artifactDir artifacts

Exit codes are as follows:

• Drift violation: 2
• Invalid usage: 1

The report contains only paths, classifications, and SHA-256 digests—not policy values. The verifier performs no network calls and spawns no child processes.

Local Checks¶

The following commands can be run in the repository for checks:

npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp

Applicable Scenarios and Notes¶

This is suitable for scenarios where evidence of DSH policy/configuration drift needs to be preserved. This plugin does not enforce tool calls, approve actions, scan repositories, or fix configurations.

verified indicates that the hashes and revisions of both snapshots match and that no weakening, exact, or unclassified violations were found; it is evidence about the provided snapshots, not a security certification.

The plugin runs with the current dsh process permissions. Before installation, you should review the source code and the MIT license.

Links¶

GitHub repository:

https://github.com/dongsheng123132/dsh-policy-drift-proof