DSH-changeproof: Verifying That Changed Lines Are Actually Covered by Tests

DSH-changeproof is a plugin designed for DeepSeek Harness (DSH) that addresses the challenge of verifying whether code modifications are actually executed by tests after changes are made. It provides line-level evidence to ensure that the modified code lines are indeed covered by tests, rather than relying solely on overall test pass status. Core features include associated test linking, line-by-line coverage verification, a code fingerprint-based automatic invalidation mechanism for conclusions, and explicit verification statuses (such as VERIFIED, STALE, etc.). If there is a lack of valid coverage evidence or inconsistency with the current code, the system will not pass the verification. The plugin supports automatic trigger of verification and provides a standalone CLI tool, allowing users to analyze, execute tests, and view statuses without installing DSH. In terms of security, subprocess execution has been hardened with argv-only configuration, environment variable whitelisting, and path confinement. Installation requires Node.