dsh-contract-stance 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## 0.2.1
+
+- Ship `CHANGELOG.md` and `SECURITY.md` inside the package. `files` is an
+  allowlist and neither was on it, so no release note had ever reached anyone
+  who installed this package, and npm had no changelog section to show.
+## 0.2.0
+
+- Release infrastructure brought to the family standard: `verify:self-contained`,
+  `check:lockfile`, `check:readmes` and `check:citations` gates, a `prepublishOnly` that
+  re-runs the whole chain, SECURITY.md, dependabot, and the OpenSSF Scorecard workflow.
+- `check:citations` enforces the rule this pack's own header states: every `excerpt`
+  must be a verbatim quotation, findable in `rules/evidence/`. Rules that are not
+  traceable yet are listed in `rules/citations-baseline.json`, and that file can only
+  shrink - anything new has to be sourced before it can land.
+- The README install command now names the published package instead of a local tarball.
+- Five-language READMEs hold the same section count and the same configuration keys.
+- Rule pack: 7 rules across CS-001..CS-007.
+- Licensed Apache-2.0.

package/SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security vulnerabilities **privately** through GitHub's private
+vulnerability reporting:
+
+**Security → Report a vulnerability** at
+https://github.com/PerryLink/dsh-contract-stance/security/advisories/new
+
+Do **not** open a public issue for security findings.
+
+Before reporting, **sanitize everything you paste**: remove tokens, API keys,
+credentials, authorization headers, session contents, and personal data. Logs
+without secrets only.
+
+## Scope note
+
+This plugin is an offline checker. It reads the material you hand it and
+compares it against a versioned rule pack; it makes no network calls and no
+model calls, and it stores nothing.
+
+## What to include
+
+- affected package version (and DeepSeek Harness runtime version)
+- a minimal reproduction
+- your impact assessment
+
+## Response expectations
+
+- acknowledgement within **7 days**
+- status updates at least every **14 days** until resolution
+- coordinated disclosure: the fix and advisory are prepared first; the finding
+  is disclosed publicly after the fix ships
+
+## Credits and disclosure
+
+- reporters are credited in the advisory and CHANGELOG unless they ask to stay anonymous
+- advisories follow GitHub's advisory workflow and are published together with the fix

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-contract-stance",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "合同条款立场台账核对（按立场、风险等级与退让底线核对台账自洽，仅提示差异，不作出定性结论）",
   "type": "module",
   "main": "lib/index.mjs",
@@ -23,7 +23,9 @@
     "README-hi.md",
     "locale/*.json",
     "icon.svg",
-    "rules"
+    "rules",
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "scripts": {
     "build": "tsdown",
@@ -32,7 +34,7 @@
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
     "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "check:readmes": "node scripts/check-readme-sync.mjs",
-    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:readmes && pnpm run check:citations",
+    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:lockfile && pnpm run check:readmes && pnpm run check:citations",
     "prepare": "tsdown",
     "check:citations": "node scripts/check-citations.mjs"
   },