030611/qiushi-dsh-evidence-audit
40Last commit Aug 14, 2026
qiushi-dsh-evidence-audit DSH plugin
Qiushi DSH Evidence Audit is an observe-only Profile Bundle for DeepSeek Harness. It listens to the tools/result and session/event extension points and writes a self-validating hash chain of receipts to a local file. It never modifies prompts, tool results, or session data.
How to install the qiushi-dsh-evidence-audit DSH plugin
dsh plugin --profile web add qiushi-dsh-evidence-auditCopying does not run this command. Review the repository and version before installing the qiushi-dsh-evidence-audit DSH plugin.
qiushi-dsh-evidence-audit DSH plugin data source
qiushi-dsh-evidence-audit DSH plugin snapshot date: Aug 16, 2026
discovered
What the qiushi-dsh-evidence-audit DSH plugin can do
- Listens to tools/result and session/event extension points and appends hash-chained JSONL receipts
- Validates the entire existing receipt file at startup and refuses to append if the chain is broken
- Creates default output directory and file with POSIX owner-only permissions (0700/0600)
- Supports overriding the output path via plugin configuration
- Uses deterministic canonical JSON and SHA-256 for reproducible hashes
- Contains failures within the observer so DSH publications are unaffected
Where the qiushi-dsh-evidence-audit DSH plugin fits
- Audit tool call sequences and session events with a verifiable local trail
- Detect tampering, truncation, or modification of retained evidence records
- Use separate output files per DSH process to avoid concurrent write conflicts
- Combine with other trust-layer plugins (Telemetry Redactor, Verification Receipt) for a broader audit system
- Provide compliance evidence that a specific observer witnessed certain event hashes in a known order
Who the qiushi-dsh-evidence-audit DSH plugin is for
- DSH users who need a locally verifiable execution trail without storing plaintext
- Security auditors or compliance teams requiring tamper-detection for tool execution logs
qiushi-dsh-evidence-audit DSH plugin limitations
- Hashes do not prove author identity and are not digital signatures or external anchors
- Multiple DSH processes must not write to the same output file concurrently; detection is only on later verification, not recovery
- No fsync guarantee after writeSync; a power loss can lose the last receipt
- Startup verification is linear in the existing file size and adds latency to event publishing
- Compatibility is only tested against a specific DSH commit; model-backed DSH turns were not tested
qiushi-dsh-evidence-audit DSH plugin: from the repository README
Quoted from the 030611/qiushi-dsh-evidence-audit README, the upstream source of the qiushi-dsh-evidence-audit DSH plugin. Copyright remains with the original authors.
English | [简体中文](README.zh-CN.md) [](https://www.npmjs.com/package/qiushi-dsh-evidence-audit) [](https://github.com/030611/qiushi-dsh-evidence-audit/actions/workflows/ci.yml) [](LICENSE) [](https://whyihaveyou.github.io/dsh-suite/)  **Leave a locally checkable execution trail without storing prompts, tool arguments, tool results, or session IDs in plaintext.** ```sh dsh plugin --profile web add qiushi-dsh-evidence-audit ``` > Community-maintained and not an official DeepSeek project. Related trust-layer plugins: [Telemetry Redactor](https://github.com/030611/dsh-telemetry-redactor), [Verification Receipt](https://github.com/030611/dsh-verification-receipt), and [Context Provenance](https://github.com/030611/dsh-context-provenance). Qiushi DSH Evidence Audit is an observe-only DeepSeek Harness
Read the full READMERepository license: MIT
qiushi-dsh-evidence-audit DSH plugin questions
How do I install Qiushi DSH Evidence Audit?
Run `dsh plugin --profile <profile> add qiushi-dsh-evidence-audit` in your terminal. You need Node.js ^22.19.0 || >=24.0.0 and a DSH installation built from the tested commit. After installation, run `dsh --profile <profile> --dump-config` to confirm the plugin is loaded.
What does the evidence receipt file contain?
Each line is a JSON object with fields: schemaVersion, sequence, collectedAt, previousRecordHash, and recordHash. The recordHash is SHA-256 over canonical JSON of all other fields. The file stores session-event receipts (hashed session ID, event type, event data hash) and tool-result receipts (tool name, hashed IDs, argument hash, outcome hash). Plaintext is never stored.
Can the plugin detect if someone edited the receipt file?
Yes, it can detect edits to a retained line, removal of an untouched prefix, and partial final lines at startup or verification. However, it cannot detect deletion of the entire file, removal of a complete suffix, or a full rewrite and re-chain of records by an attacker.
Can I use the same output file for multiple DSH processes?
No, multiple DSH processes must not write to the same file concurrently. The plugin does not implement cross-process locking. Concurrent writes will cause chain corruption that is only detected later, not prevented. Use one output file per process or profile.
How do I change the output path of the evidence receipts?
Override the outputPath in the plugin configuration. The path must be absolute. In your profile patch, provide the full row config like: `- id: qiushi-evidence-audit\n name: qiushi-dsh-evidence-audit\n config:\n outputPath: '/absolute/path/to/receipts.jsonl'`. The plugin does not create or change permissions of the parent directory.