dsh-policy-waiver-proof
离线内容寻址证明，证明临时政策豁免未超出批准范围
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-policy-waiver-proof#f6fa0363287bff4ae9cd73aa3f02755d0f7e54d6Policy Waiver Proof 以 dsh-policy-waiver-proof 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
An offline, deterministic evidence layer for temporary policy exceptions in DeepSeek Harness. It proves whether recorded uses stayed within an approved subject, revision, scope, action allowlist, time window, use limit, and compensating controls. It does not grant a waiver, change policy, approve a tool call, or execute an external command.
This is complementary to:
dsh-tool-policy, which evaluates pre-execution policy rules.dsh-policy-drift-proof, which detects policy/configuration drift.dsh-decision-effect-proof, which reconciles a decision with a resulting effect.Policy Waiver Proof instead verifies the bounded lifecycle of an already-issued temporary exception, including revocation or closure. Denied attempts are disclosed but do not consume the approved use limit. Reports contain only hashes, counts, booleans, public bounded IDs transformed to hashes, and machine-readable verdicts; raw business bodies and secret-shaped material are rejected.
dsh plugin add github:dongsheng123132/dsh-policy-waiver-proof#COMMIT
The DSH bundle publishes two tools from one headless core:
dsh_policy_waiver_inspectdsh_policy_waiver_verifyThe independent MCP stdio server publishes policy_waiver_inspect and policy_waiver_verify. The CLI accepts inspect or verify followed by an explicit JSON manifest path.
See examples/contained.json. Evidence is explicit and hash-addressed. Applied uses must be contiguous, occur before evaluation and within the waiver window, match all bindings, remain below maxUses, precede revocation/closure, and have fresh effective compensating controls. Any violation produces breached; missing or stale evidence is never silently inferred.
The DSH verify tool reads only a workspace-relative non-symlink manifest and writes only to an explicit workspace-relative artifactDir. Its deterministic report filename is the SHA-256 of canonical report bytes, created exclusively and verified by read-back.
npm test
npm run check
npm run smoke:plugin
npm run smoke:mcp
python C:/Users/YOU/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .
Node.js 22 or newer is required. No runtime dependency or network access is used by the verifier.