dsh-artifact-promotion-proof

In a DeepSeek Harness supply chain, confirming that an artifact digest traversed a complete, ordered, and evidence-backed path from build to production is often left without an offline, deterministic check. dsh-artifact-promotion-proof exists precisely for that role: it deploys nothing, calls no registry, and mutates no environment. Its single question is whether the supplied hash-only records are internally complete, correctly ordered, and policy-conformant across the declared build, staging, and production stages.

The core capability is strict chained-continuity verification. Every stage must appear exactly once and in fixed order; the artifact digest, stage or environment hash, and predecessor deployment receipt must remain continuous end to end. Required gate types must bind to the same artifact, precede promotion, and satisfy the stage's distinct-authority threshold. Missing, stale, reordered, cross-artifact, or extra gate evidence causes the verdict to fail closed. Reports contain only hashes, counts, booleans, gate classifications, and a final verdict, rejecting all secret-shaped material and raw log, body, or content fields. The verifier has zero runtime dependencies, spawns no process, and makes no network request, so results are fully reproducible and audit-ready.

If you own promotion auditing, compliance evidence, or offline forensics in a Harness supply chain and do not want verification to depend on an external signing service or network reachability, this plugin delivers a deterministic hash-chain integrity baseline. It complements sibling modules such as dsh-release-proof, dsh-attestation-proof, and dsh-reproducible-build-proof, together covering the full trust chain of the supply chain.