dsh-reproducible-build-proof: Offline Build Consistency Verification
`dsh-reproducible-build-proof` is a DeepSeek Harness (DSH) plugin designed to help independent builders verify the byte-level consistency of outputs. It provides offline content-addressed proofs, ensuring the convergence of independent builds by verifying the consistency of inputs such as source revisions, recipes, parameters, and dependency sets. It supports various invocation methods, including CLI and MCP stdio, generating deterministic outputs with no runtime dependencies. Note that this plugin only verifies hash matching and does not execute builds or perform source authentication.
Read MoreDeepSeek Harness Plugin: dsh-policy-waiver-proof
The `dsh-policy-waiver-proof` plugin is designed to provide DeepSeek Harness (DSH) with an offline, deterministic evidence layer that verifies temporary policy waivers are strictly confined to their approved scope. It focuses on generating boundary proofs and managing lifecycle validity, ensuring that waivers remain valid within their authorized subject, scope, operation allowlist, and time window. It provides CLI and MCP stdio tools to perform rigorous validation of waiver continuity, constraint matching, and compensating controls. The plugin requires a Node.js 22+ environment and outputs only hashes and machine-readable decisions, without sensitive raw data, making it suitable for scenarios that demand strict compliance auditing.
Read Moredsh-deployment-rollback-proof: Offline Verification of Deployment Rollback Convergence
Maintained by dongsheng123132, the DeepSeek Harness (DSH) Deployment Rollback Proof plugin is designed to generate offline, deterministic evidence that a deployment target has stopped serving a failed version and has converged to a known good state, without relying on real-time observation or performing an actual rollback. It validates hashed manifests and checks conditions such as coverage, continuous observation, RTO, and zero active failed replicas to produce a machine-readable verdict. The plugin supports three usage modes—command line, DSH integration, and MCP server—requires a Node.js 22+ environment, and rejects reports containing sensitive keys.
Read Moredsh-canary-decision-proof: An Evidence Generator for Offline Validation of Canary Decisions
`dsh-canary-decision-proof` is a controller-agnostic, offline evidence verification tool designed to substantiate the rationale for decisions in progressive delivery. It generates content-addressed reports by validating evidence integrity, computing deterministic metrics using positive fixed-point integer arithmetic, and following the precedence logic “invalid evidence → pause, metric failure → abort, otherwise → release.” This plugin does not perform rollouts; it only provides deterministic verification at the audit level, making it suitable for scenarios requiring strict compliance and review.
Read Moredsh-attestation-proof: Offline Deterministic Release Proof for DeepSeek Harness
dsh-attestation-proof is a plugin for DeepSeek Harness (DSH) used to generate offline, deterministic release attestations. By verifying the consistency of a manifest with local identities and pinned keys, the plugin fills a gap in supply chain security verification. Its core features include offline verification, support for DSSE/in-toto statements, secure report generation, and strict filesystem restrictions. It provides two commands, inspect and verify, and outputs only JSON verdicts containing content without sensitive information, making it suitable for security audits and build quarantine scenarios in air-gapped environments.
Read MoreDSH Artifact Promotion Proof Plugin
`dsh-artifact-promotion-proof` is a security management plugin for DeepSeek Harness (DSH), designed to provide an offline, deterministic evidence layer that verifies the continuity of artifact hashes across the build, pre-release, and production promotion chain. The plugin does not rely on network access or runtime health checks and performs compliance validation solely through hash records, supporting zero-rebuild promotion and environment-bound checks. It exposes `inspect` and `verify` functions through CLI and MCP stdio interfaces, making it suitable for security and compliance audits. Installation must be performed via the DSH profile mechanism and requires Node.js 22 or later. The plugin runs in read-only mode, focuses on the integrity of structured hash records, and refuses to process secrets or raw log content.
Read Moredsh-access-review-proof: Offline Deterministic Verification of Access Review Evidence
`dsh-access-review-proof` is an offline deterministic evidence plugin maintained by dongsheng123132. It verifies whether Microsoft Entra access review evidence meets compliance and consistency requirements through strict checks such as timeline integrity, entitlement coverage, risk decisions, and reviewer independence. The tool is designed to address the difficulty of tracing UI state in automated workflows, ensuring that the review process satisfies specific logic and security rules at the data level and supports installation and use via DSH or MCP.
Read Moredsh-schema-migration-proof: Offline Content-Addressed Schema Migration Proof Generator
dsh-schema-migration-proof is a security plugin for DeepSeek Harness that generates and verifies deterministic evidence for schema migration offline. It supports validation of output determinism, idempotent reruns, reversible rollback, and explicit data-loss disclosure, without performing actual migrations. The plugin provides a fail-closed policy via CLI or MCP and is intended for scenarios requiring strict verification of migration evidence integrity and security. It requires DSH version >= 0.1.2-alpha.4.
Read More