dsh-decision-effect-proof

Across a multi-layer security stack, approval engines, policy evaluators, and action runtimes each guard their own boundary, yet a narrow gap remains that none of them can address on their own: authorized does not mean executed. dsh-decision-effect-proof exists to close that gap. It performs an offline, deterministic reconciliation between a recorded authorization decision and its recorded effect envelope, surfacing denied actions that carry effects, authorized actions that never settled, request-state-policy mismatches, missing confirmations, replayed idempotency digests, duplicates, and out-of-order evidence, each flagged by a stable finding code so audits remain reproducible.

By design the plugin does not cross into adjacent territory. It is not an approval engine, policy evaluator, action runtime, signature format, or prompt wrapper. It consumes only explicit body-free evidence, namely SHA-256 digests and bounded identifiers, and never touches request arguments, tool output, business text, prompts, or secrets. Reports are content-addressed and verified by read-back after publication, guaranteeing that what you archive is exactly what was produced.

Teams that have already layered DSH approval and permission-rule plugins and now need a tamper-evident, offline consistency proof for compliance will find a natural slot for this tool. Security analysts doing incident retrospectives can also use it to determine, in seconds, whether a given authorization trajectory shows an execution break, rather than relying on guesswork.