dsh-canary-decision-proof

Auditing canary release decisions often hits two walls: the evidence chain is scattered and hard to re-verify offline, and the judgment criteria are ambiguous enough that two reviewers can reach different conclusions from the same numbers. dsh-canary-decision-proof does one narrow thing: it takes a complete canary evidence manifest, runs a deterministic fixed-point comparison, produces the single valid verdict (promote, abort, or pause), and checks it against the recorded decision. It never starts, stops, promotes, or rolls back anything, never queries live metrics, and never performs statistical inference.

The core mechanism follows a fixed decision precedence: incomplete, stale, unbound, under-sampled, or chronologically invalid evidence always yields pause; otherwise any metric reaching its declared failure limit triggers abort; otherwise the verdict is promote. All metric values are positive fixed-point integers (valueMicros), regression is expressed in integer basis points, so identical inputs always produce identical outputs. Reports contain only hashes, counts, timestamps, fixed-point comparisons, and verdicts with no raw business text or secrets. Writes are confined to an explicit workspace directory, reject path escapes and symlinks, and are verified by read-back.

Best for teams that need a closed, auditable canary evidence loop: the plugin is controller-neutral, sits alongside Argo Rollouts, DSH, or custom orchestration, and is callable via DSH native tools or an independent stdio MCP server, turning the question of whether a release should have been allowed through into an offline, replayable hash-chain proof.