# dsh-vulnerability-remediation-proof

Offline, deterministic evidence that a **supplied** vulnerability-remediation campaign covered every declared asset, deployed one fixed artifact, rescanned after deployment, met its remediation deadline and reached fresh zero-residual closure. Inputs and reports contain hashes and bounded public metadata only—never hostnames, addresses, scan bodies or secrets.

This is deliberately not a scanner or patch manager. DeepSec scans DSH code and `upstream-radar` monitors dependency vulnerabilities; operational platforms deploy patches. This plugin performs no discovery, scanning, installation, mitigation or live-system query. It only recomputes a redacted settlement verdict from explicit receipts.

```sh
npm test
npm run check
node bin/dsh-vulnerability-remediation-proof.mjs verify examples/closed.json
```

DSH tools: `dsh_vulnerability_remediation_inspect` and `dsh_vulnerability_remediation_verify`. MCP exposes equivalent proof-only inline tools. Reports explicitly retain `authenticatesReceipts: false`, `provesAssetSetExhaustive: false`, and `provesAbsenceOfOtherVulnerabilities: false`.

References: [NIST SP 800-40 Rev. 4](https://csrc.nist.gov/pubs/sp/800/40/r4/final) and [NIST SP 1800-31](https://csrc.nist.gov/pubs/sp/1800/31/final).

MIT licensed.