dsh-build-hermeticity-proof

In supply-chain build audits, the most frequently asked question is: did this build quietly read undeclared files, touch the network, or depend on unrecorded environment variables or randomness? dsh-build-hermeticity-proof supplies an offline, deterministic evidence layer that answers exactly that. It accepts a single hash-only build access receipt and checks, line by line, whether every file read/write, environment read, network call, clock value, and randomness draw fell inside the declared closure. Any observed undeclared access fails immediately; a denied undeclared attempt is retained as containment evidence without breaching the closure.

Core capabilities include a v1 deny-only network policy where any observed network traffic is an automatic failure; hash-binding of source revision, invocation, clock value, random seed, and allowed environment values so internal consistency is verifiable; and reports that contain only hashes, counts, booleans, classifications, and verdicts, explicitly rejecting secret-shaped material and raw logs. The verifier has zero runtime dependencies, spawns no processes, makes no network requests, and runs on Node.js 22 or newer.

The plugin does not execute a build, enforce a sandbox, authenticate the receipt, or prove reproducibility; its scope is to determine whether a recorded build receipt is internally complete and policy-conformant. It is suited for supply-chain security auditors, build-compliance reviewers, and any team that needs to verify isolation boundaries offline without re-running the build.