dsh-change-window-proof

In change-management practice, both AWS and Azure model maintenance windows around a fixed time boundary, a maximum duration, and a task-cutoff point. Yet proving that a change actually settled inside that window still lacks an offline, reproducible audit trail. dsh-change-window-proof answers one narrow question: does the hash-linked change ledger you supply settle within one declared UTC maintenance window, with every step bound to a single change receipt, artifact, environment, policy, and plan? It does not schedule, approve, or query live infrastructure; it performs deterministic verification against the ledger you provide.

The checks cover window existence with exact start-and-finish matching, a contiguous monotonically increasing UTC timestamp sequence, maximum-duration and no-new-step cutoff enforcement, per-event consistency of window, receipt, artifact, and environment bindings, SHA-256 event-chain integrity against the declared ledger head, observer diversity, and evidence freshness. Inputs containing secret-shaped values or raw log fields are rejected outright. Writes use workspace-relative, non-symlink paths with exclusive content-addressed storage and mandatory read-back, making the report itself tamper-evident. The same headless core is exposed through a DSH bundle, an MCP stdio server, a JavaScript API, and a CLI, so teams can embed the check in a pipeline or invoke it standalone.

It serves as the time-boundary compliance piece of the 2Origin evidence stack, complementing dsh-action-parity (interface-binding consistency), dsh-policy-waiver-proof (explicit exception chains), and dsh-artifact-promotion-proof (immutable digest promotion) rather than duplicating them. It suits operations and compliance teams that need to present an offline window-adherence proof to auditors, as well as SRE engineers who want a CI/CD gate confirming that a change ledger respected the declared maintenance boundary.