dsh-change-window-proof

Offline, deterministic evidence for one narrow question: does the supplied hash-linked change ledger settle inside one declared UTC maintenance window while staying bound to one change receipt, artifact, environment, policy and plan?

It provides the same headless core through a DSH bundle, standalone MCP stdio server, JavaScript API and CLI. Reports are content-addressed, redacted and verified after writing.

Why this is separate

AWS models a maintenance window with a schedule, maximum duration, targets and tasks, and defines a cutoff after which new tasks may not start. Azure likewise separates start time, duration, recurrence and disallowed dates. This plugin verifies a supplied settlement against those fixed-window ideas; it is not a scheduler.

It complements rather than duplicates the 2Origin evidence stack:

• dsh-action-parity proves interface bindings share one action core.
• dsh-policy-waiver-proof verifies an explicit exception chain.
• dsh-artifact-promotion-proof verifies immutable digest promotion across stages.
• dsh-change-window-proof verifies one supplied action ledger stayed within one declared time boundary and cutoff.

It does not approve, grant a waiver, schedule or execute a change; authenticate the recorder or receipts; query live infrastructure; or prove that no unrecorded action occurred.

Checks

• one declared window exists and contains the exact settlement start/finish;
• contiguous start → step* → finish sequence and monotonically ordered UTC timestamps;
• maximum duration and no-new-step cutoff;
• every event binds the same window, change receipt, artifact and environment;
• event SHA-256 chain and declared ledger head;
• observer diversity and evidence freshness;
• secret-shaped values and raw business/log fields are rejected;
• workspace-relative, non-symlink input and output paths; exclusive content-addressed write with read-back.

Use

npm test
npm run check
node bin/dsh-change-window-proof.mjs inspect examples/compliant.json
node bin/dsh-change-window-proof.mjs verify examples/compliant.json

Install as a DSH bundle from a path or a fixed public commit:

dsh plugin install /absolute/path/to/dsh-change-window-proof
dsh plugin install github:dongsheng123132/dsh-change-window-proof#<commit>

DSH tools:

• dsh_change_window_inspect accepts inline manifestJson and returns bounded hashes/counts.
• dsh_change_window_verify accepts workspace-relative manifestPath and artifactDir, then writes and re-reads a content-addressed JSON verdict.

MCP tools are change_window_inspect and change_window_verify; launch with node mcp-server.mjs using newline-delimited JSON-RPC.

Manifest

See examples/compliant.json. Only identifiers, timestamps, counts and SHA-256 bindings belong in the manifest. Do not place credentials, raw logs, prompts, bodies, chat text or source documents in it.

References: AWS Systems Manager Maintenance Windows, AWS scheduling and active-period options, Azure AKS maintenance window schema.

MIT licensed. See SECURITY.md for the trust boundary.