dongsheng123132/dsh-policy-drift-proof
30Last commit Aug 14, 2026
dsh-policy-drift-proof DSH plugin
This plugin provides evidence of policy or configuration drift by comparing pinned baseline snapshots with observed snapshots. It does not enforce tool calls, approve actions, or repair configurations. The evidence model uses SHA-256 digests and revision tracking to classify drift as weakening, tightening, exact, or unclassified.
How to install the dsh-policy-drift-proof DSH plugin
dsh plugin --profile policy-proof add github:dongsheng123132/dsh-policy-drift-proof#<commit>This source command needs manual review. Copying does not run it.
dsh-policy-drift-proof DSH plugin data source
dsh-policy-drift-proof DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-policy-drift-proof DSH plugin can do
- Pins baseline and observed policy snapshots by SHA-256 digest and revision.
- Supports drift rules: ordered-not-weaker, set-no-additions, exact.
- Produces reports with paths, classifications, and SHA-256 digests only (no policy values).
- Rejects secret-shaped fields, raw output fields, absolute/escaping paths, symlinks, oversized inputs, and excessive structure.
- Verifier performs no network calls or child processes, writes only one content-addressed JSON report.
Where the dsh-policy-drift-proof DSH plugin fits
- Detecting unintended policy changes in CI/CD pipelines.
- Verifying that observed policy snapshots match the approved baseline.
- Auditing configuration drift across environments.
- Providing evidence for compliance requirements.
Who the dsh-policy-drift-proof DSH plugin is for
- Security engineers who need to track policy drift in DeepSeek Harness.
- DevOps teams managing multi-environment policy compliance.
dsh-policy-drift-proof DSH plugin limitations
- Only supports Node.js 22 or newer.
- Does not enforce tool calls, approve actions, or repair configurations; it only provides evidence.
- Reports never include policy values, only digests and classifications.
dsh-policy-drift-proof DSH plugin: from the repository README
Quoted from the dongsheng123132/dsh-policy-drift-proof README, the upstream source of the dsh-policy-drift-proof DSH plugin. Copyright remains with the original authors.
Read-only, content-addressed policy/configuration drift evidence for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). This plugin does **not** enforce tool calls, approve actions, scan repositories, or repair configuration. `dsh-tool-policy` already provides pre-execution policy routing, while SecurStack provides security scans and policy gates. This plugin covers the missing evidence question: did the policy snapshot actually observed by an operator differ from the pinned baseline, and was the difference weakening, tightening, exact, or unclassified? ## Evidence model The explicit manifest pins a baseline and observed `policy-snapshot/v1` by SHA-256 and revision. Rules cover declared JSON Pointer roots: - `ordered-not-weaker`: enum order is restrictive to permissive; moving right fails. - `set-no-additions`: additions fail, removals are recorded as tightening. - `exact`: any change fails. - any changed covered leaf without a rule fails closed as `UNCLASSIFIED_DRIFT`. Reports include paths, classifications and SHA-256 digests only. They never include policy values. Secret-shaped fields, raw output fields, absolute/escaping paths, symlinks, oversized inputs
Read the full READMERepository license: MIT
dsh-policy-drift-proof DSH plugin questions
How do I install dsh-policy-drift-proof?
Use the DSH CLI: `dsh plugin --profile policy-proof add github:dongsheng123132/dsh-policy-drift-proof#<commit>` and then run `dsh profile --profile policy-proof compose` to register the tools. Make sure you have Node.js 22 or newer.
What drift rules are supported?
The plugin supports three rules: `ordered-not-weaker` (enum order must be restrictive to permissive, moving right fails), `set-no-additions` (additions fail, removals are recorded as tightening), and `exact` (any change fails). You can define these rules in the manifest.
Does this plugin modify policies or configurations?
No, it is read-only. It only produces drift evidence reports. It does not enforce tool calls, approve actions, or repair configurations. Its purpose is to provide verifiable evidence that a policy snapshot differs from the baseline.
What exit codes does the CLI use?
The CLI prints a JSON object to stdout. If a drift violation is detected, it exits with code 2. Invalid usage (e.g., missing required arguments) exits with code 1. A successful verification with no drift violations exits with code 0.
Can I use this plugin without DeepSeek Harness?
The plugin is designed as a DSH plugin, but you can also run its CLI directly using `node bin/dsh-policy-drift-proof.mjs inspect` or `verify` with the appropriate arguments. However, the bundle registration and MCP server are specific to DeepSeek Harness.