dsh-config-origin-proof

DeepSeek Harness composes its configuration from multiple precedence domains, and when several sources are present, determining which one ultimately wins and why is rarely traceable. dsh-config-origin-proof adds a redacted, reproducible evidence layer that turns a structured recording produced by dsh --dump-config or another trusted source into an auditable receipt.

The plugin does not reimplement the DSH composer, collect live configuration, or compare policy changes. It only converts an existing structured recording into a reproducible receipt. Reports contain exclusively stable IDs, SHA-256 digests, and verdicts; raw values, secrets, credentials, and free-text fields are rejected outright. The verifier fails closed whenever a higher-priority source remains unobserved, ensuring evidence integrity is never silently weakened. Recordings are revision-bound, so future DSH model upgrades cannot retroactively rewrite archived evidence.

The plugin exposes three invocation surfaces: DSH commands, a CLI, and MCP. The MCP interface is strictly inline with no filesystem, network, or process side-effects, making it suitable for controlled pipelines. It is well suited for security administrators, compliance reviewers, and ops engineers who must demonstrate to auditors exactly which recorded source won and why across multi-environment deployments.