dsh-vulnerability-remediation-proof

Vulnerability-remediation teams often must demonstrate to auditors that a given campaign covered every declared asset, deployed a fixed artifact, completed a post-deployment rescan, hit its deadline, and reached fresh zero-residual closure. Assembling that evidence by hand from scattered logs and scan exports is slow and frequently leaks hostnames, internal addresses, or even full scan bodies into the final report.

This plugin takes a deliberately constrained path: it performs no discovery, scanning, installation, mitigation, or live-system query. It only recomputes a redacted settlement verdict from the explicit receipts you supply. Inputs and reports carry hashes and bounded public metadata—never hostnames, addresses, scan bodies, or secrets. The reports also explicitly retain authenticatesReceipts: false, provesAssetSetExhaustive: false, and provesAbsenceOfOtherVulnerabilities: false, so the proof boundary is stated up front rather than left to assumption.

It is built for security-compliance teams, SOC operators, or any organization that must produce remediation-closure evidence under the NIST SP 800-40 Rev. 4 and NIST SP 1800-31 frameworks. Feed in the receipts you already have; get back a deterministic, re-computable, and leak-free proof you can attach directly to an audit packet without ever re-scanning a live system.