Security Model

Assets

• DSH credentials and session contents.
• Private repository paths, identities and fixtures.
• Evaluation/canary integrity.
• Active Skill correctness and rollback lineage.
• DSH sandbox, approval and plugin configuration.

Trust boundaries

DSH core services and the immutable Evolution Lab policy are trusted. Session text, tool output, model responses, candidate Markdown, xskill bridge responses and project configuration are untrusted. Deterministic project verifiers are trusted only within their declared isolated task fixture.

Non-weakenable invariants

V1 accepts exactly one regular SKILL.md up to 16 KiB, fixed model/user invocation, and no additional files or symlinks. It rejects credential shapes, path leaks, remote includes, bidi/NUL/data URL/HTML-comment tricks and instructions to change DSH policy, configuration, hidden tests or proof data. Project config can disable promotion or tighten budgets, but cannot create an exception.

Two local privacy passes run before persistence or an engine boundary. Stable sensitive identifiers use keyed HMAC pseudonyms. The key lives outside the project. Candidate output is scanned again.

Arena arms have distinct workspaces and DSH state, explicit environment allowlists, process timeouts and bounded output. The verifier is not shown to the model. A malformed/timeout verifier invalidates the run instead of favoring either side.

Proofs bind exact candidate, predecessor, task, fixture, model route, DSH version, reports and policy. The proof is durable before the active pointer changes. Provider activation is compare-and-swap and recovery rejects active content without a readable proof.

Residual risk

Markdown instructions can still cause undesirable model behavior that static scanning does not understand. Deterministic evaluations can be incomplete. Model providers receive redacted prompts and may have their own retention policy. A malicious project owner can change its own verifiers or delete rollback history. OS-level containment depends on DSH and the host platform.

Disable the plugin and use /evolution rollback <skill> at the first sign of regression. Preserve .dsh/evolution/proofs and .dsh/evolution/versions for investigation.