dsh-retention-settlement-proof

DSH today ships no general delete or retention API, and community archive-delete plugins each implement their own mutation strategies. After a retention or deletion request is issued, there is no dedicated layer to prove offline and in an auditable way that the request actually settled across every declared storage projection and remained absent after a restart. dsh-retention-settlement-proof fills exactly that gap: it deletes nothing, consumes only pre-recorded approval receipts and absence observations, and renders a deterministic verdict on whether one opaque subject stayed absent across declared surfaces and restart epochs.

The evidence contract anchors on a SHA-256 pseudonymous subject, never a raw session ID. It binds an approval-receipt hash, a tombstone tied to the exact request bytes, body-free absence observations for explicit surfaces such as persistence-list, session-index, and workspace-index, plus a fixed evaluation time, freshness window, and minimum complete post-restart epochs. Any later present:true signal, stale receipt, missing surface, pre-restart-only evidence, identity or digest mismatch, unsafe path, or incomplete threshold fails closed. The CLI reads only workspace-relative regular files, rejects symlinks and traversal, performs no network requests or subprocesses, and writes a single content-addressed JSON report whose contents are hashes and verdicts alone-never session text, receipt bodies, filesystem paths, credentials, or secrets.

It suits compliance teams, security auditors, and operators who need offline, reproducible evidence without touching session content. The plugin is complementary to dsh-recovery-proof (restore drills), dsh-decision-effect-proof (authorization-effect reconciliation), and deletion UIs, each answering a different question. The DSH bundle exposes inspect and verify entry points, and an independent stdio MCP server provides proof-only inline equivalents; both call the same interface-free core. MIT licensed.