dsh-deployment-rollback-proof

After a deployment rollback, operations and security teams face a deceptively hard question: how do you prove to auditors that every declared target truly stopped serving the failed artifact and converged to the same last-known-good digest within the agreed RTO? dsh-deployment-rollback-proof is built for exactly this. It does not execute rollbacks, read live infrastructure, or authenticate credentials. Instead it performs an offline, deterministic policy check against an explicit hash-only manifest and emits a machine-readable settlement verdict.

The verifier enforces a tight set of invariants. Each declared target must carry one observation that binds a rollback receipt and a health-probe hash to the incident and plan. Every target must converge to a single last-known-good digest, and the active replica count of the failed artifact must be zero. Incident binding, plan binding, chronology, RTO limits, and evidence freshness all have to satisfy the declared constraints. Any field whose name resembles secret, authorization, raw, body, content, log, prompt, or chat, as well as any secret-shaped value, is rejected outright so that only hashes, counts, timestamps, and verdicts ever reach the final report.

It is well suited for post-incident convergence audits, compliance evidence retention, and cross-team deployment settlements where a reproducible, offline-verifiable record is required. It does not replace rollback execution, isolated recovery-drill verification, or application-layer correctness checks. What it does provide is a structured, deterministic evidence chain for one specific claim: the failed version has been removed and the last-known-good version is in place across every declared target.