dsh-local-regulation: Local Data Regulation Compliance Checks in DeepSeek Harness

What Does It Do?

Local Data Regulation Guard is a DSH plugin for DeepSeek Harness that turns the extra requirements of Shanghai's Data Regulation and the Shenzhen Special Economic Zone Data Regulation into 7 statically checkable rules, then scans your codebase to tell you what may have been missed at that layer. It solves the problem of local rules beyond national law being easy to overlook, covering prominent signage and alternative verification at face-collection sites, de-identification before providing personal data externally, disclosure and opt-out paths for user profiling, designated security officers for sensitive data, data source and processing records, sharing and external interface policies, and data destruction procedures. It only reads code and documents in the repository, performs no dynamic inspection, and does not determine where you actually operate, so applicability must be confirmed by legal or compliance staff.

Core Features

• Seven local rules: each maps to Shanghai Article 23 and Shenzhen Articles 26, 29, 73, 75, 79 and 80, and every hit reports the file, the evidence, the legal basis and how to confirm it.
• Scenario gating: rules run only when the project matches their trigger conditions, such as face-detection dependencies or calls, so unrelated projects are not flagged.
• No fake green: rules whose triggers do not match are listed as not run for this project instead of pretending they passed, and project-level absence findings state how many files were actually inspected.
• Multiple report formats: terminal output, an HTML report for archiving, and a quiet mode for CI that exits with code 1 when high-severity findings appear.
• In-session invocation: asking the DSH session to check a project against the Shanghai and Shenzhen data regulations routes to the same checking capability through a bundled skill.

How to Use This Plugin?

After enabling it in DSH, run the check on the current project to get findings grouped by high and medium severity; you can also point it at another directory, or use the built-in demo to see what a sample project operating in Shanghai and Shenzhen with none of the local requirements implemented would report. To review the rules first, list all seven with their legal sources; produce an HTML report when you need a record, and use quiet mode in CI so high-severity hits fail the pipeline. The report header and footer repeat that coverage is limited to Shanghai and Shenzhen and that applicability needs human confirmation, so local extras are not mistaken for nationwide requirements.

How to Troubleshoot This Plugin?

If a result is empty or a rule did not run, first check whether the project meets that rule's trigger conditions; when it does not, the rule is listed as not run for this project rather than raising an error. If a finding looks like a false positive, review the reported file and legal basis by hand, then adjust the project's documentation or handling logic as the official guidance describes. When your operations are outside Shanghai and Shenzhen, the findings do not apply to you, so confirm applicability before acting on them.