dsh-engineering-control-plane

Letting an Agent modify code used to mean issue a prompt, run it, and hope for the best. Teams that value auditability need more than that—who made the change, what verification it passed, and why it was approved or sent back all need a durable record. dsh-engineering-control-plane pins every implementation, fix, refactor, or release-validation request into a Mission, and the host owns planning, execution, verification, and quality gates, turning Agent coding from a black-box operation into a traceable, governed workflow.

The core mechanism centres on a deterministic quality gate. Each Mission advances through a single ordered sequence: plan, develop, test, review. Role permissions are strictly separated—planner, tester, and reviewer are read-only; the developer cannot commit, switch branches, or rewrite history. Verification commands come from host-owned configuration, never invented by the model on the fly. Digest-bound evidence feeds the deterministic Quality Gate, which is the sole path to APPROVED; missing, corrupt, truncated, or indeterminate evidence fails closed. Revision CAS and execution/write leases reject concurrent drift, and cancellation and resume must go through a persisted protocol. State is durably stored in SQLite with immutable Receipts and versioned Snapshots.

This plugin is suited to teams that want to bring Agent coding under formal engineering governance: projects that need a release-validation gate, that pair with the Security Assurance plugin to freeze byte-exact change fingerprints, or that must recover from BLOCKED or REWORK_REQUIRED states without losing attempt context. It does not replace a vulnerability scanner; it provides the engineering-governance skeleton so that every APPROVED carries a complete, inspectable evidence chain.