dsh-vulnerability-remediation-proof

Offline, deterministic evidence that a supplied vulnerability-remediation campaign covered every declared asset, deployed one fixed artifact, rescanned after deployment, met its remediation deadline and reached fresh zero-residual closure. Inputs and reports contain hashes and bounded public metadata only—never hostnames, addresses, scan bodies or secrets.

This is deliberately not a scanner or patch manager. DeepSec scans DSH code and upstream-radar monitors dependency vulnerabilities; operational platforms deploy patches. This plugin performs no discovery, scanning, installation, mitigation or live-system query. It only recomputes a redacted settlement verdict from explicit receipts.

npm test
npm run check
node bin/dsh-vulnerability-remediation-proof.mjs verify examples/closed.json

DSH tools: dsh_vulnerability_remediation_inspect and dsh_vulnerability_remediation_verify. MCP exposes equivalent proof-only inline tools. Reports explicitly retain authenticatesReceipts: false, provesAssetSetExhaustive: false, and provesAbsenceOfOtherVulnerabilities: false.

References: NIST SP 800-40 Rev. 4 and NIST SP 1800-31.

MIT licensed.