dsh-duty-separation-proof

Segregation of duties is a core compliance requirement in any DSH workflow, yet proving offline and deterministically that a single supplied receipt chain actually kept the declared duty sets apart is far from trivial. dsh-duty-separation-proof answers one tightly scoped question: did the supplied hash-linked receipts satisfy the declared duty-conflict policy?

The plugin strictly validates the request, approve, execute, observe ordering, verifies hash-bound object and workflow identity, receipt-chain continuity, disjoint principal sets, approval quorum, principal and observer diversity, and freshness, then writes only a redacted, content-addressed JSON verdict. It is explicitly not an authorization layer: it grants no roles, approves no requests, executes no changes, inspects no live systems, and makes no claim of ledger exhaustiveness. The report hard-codes authenticatesReceipts to false, provesLedgerExhaustive to false, and provesAbsenceOfUndeclaredActions to false, leaving the boundary unambiguous.

Compliance auditors, security engineers, and platform teams already standardizing on DSH who need a reproducible, offline-verifiable piece of duty-separation evidence alongside other proof layers such as dsh-guarded-hcl or dsh-decision-effect-proof will find this plugin purpose-built for that job.