dsh-break-glass-settlement-proof

Emergency break-glass access is the most sensitive entry point in privileged operations. The hardest question after the fact is narrow but critical: did the session close within its declared lifetime, did it execute only allowlisted actions and resource receipts, and did every declared grant receive a revocation receipt before a fresh closure observation? dsh-break-glass-settlement-proof does not grant, activate, or revoke any access, nor does it query live identity infrastructure. It takes a supplied settlement record and, entirely offline and deterministically, verifies internal consistency and produces a redacted, content-addressed, post-write-verifiable evidence report.

The verification spans six dimensions: the full chronology from request through closure and its maximum allowed duration; contiguous, ordered action receipts within the active interval; explicit action and resource allowlists; a common session and principal binding across actions, grants, and closure; a non-zero revocation receipt with valid grant/revoke timestamps for every declared grant; and the supplied residual grant count, observer diversity, and evidence freshness. Built-in protections include secret and raw-data rejection, workspace confinement, symlink defense, and content-addressed read-back so the report itself never becomes a new leakage surface.

It is designed for security operations and compliance teams that must demonstrate to internal governance or external auditors that a break-glass engagement was executed under least privilege and fully closed. The plugin generates a stand-alone, independently verifiable offline evidence package without relying on any runtime identity service or live query.