dsh-medrec-qc 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+## 0.2.2
+
+- Ship `CHANGELOG.md` and `SECURITY.md` inside the package. `files` is an
+  allowlist and neither was on it, so no release note had ever reached anyone
+  who installed this package, and npm had no changelog section to show.
+## 0.2.1
+
+- Citation pass: every `excerpt` was checked against this repository's own
+  `rules/evidence/` record, and the record was completed for the clauses the
+  rules quote.
+- Adds `rules/citations-baseline.json`, which the `check:citations` gate reads:
+  it lists any excerpt not yet traceable to the evidence, and that list can
+  only shrink.
+## 0.2.0
+
+- Release infrastructure brought to the family standard: `verify:self-contained`,
+  `check:lockfile`, `check:readmes` and `check:citations` gates, a `prepublishOnly` that
+  re-runs the whole chain, SECURITY.md, dependabot, and the OpenSSF Scorecard workflow.
+- `check:citations` enforces the rule this pack's own header states: every `excerpt`
+  must be a verbatim quotation, findable in `rules/evidence/`. Rules that are not
+  traceable yet are listed in `rules/citations-baseline.json`, and that file can only
+  shrink - anything new has to be sourced before it can land.
+- The README install command now names the published package instead of a local tarball.
+- Five-language READMEs hold the same section count and the same configuration keys.
+- Rule pack: 15 rules across MR-001..MR-015.
+- Licensed Apache-2.0.

package/SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security vulnerabilities **privately** through GitHub's private
+vulnerability reporting:
+
+**Security → Report a vulnerability** at
+https://github.com/PerryLink/dsh-medrec-qc/security/advisories/new
+
+Do **not** open a public issue for security findings.
+
+Before reporting, **sanitize everything you paste**: remove tokens, API keys,
+credentials, authorization headers, session contents, and personal data. Logs
+without secrets only.
+
+## Scope note
+
+This plugin is an offline checker. It reads the material you hand it and
+compares it against a versioned rule pack; it makes no network calls and no
+model calls, and it stores nothing.
+
+## What to include
+
+- affected package version (and DeepSeek Harness runtime version)
+- a minimal reproduction
+- your impact assessment
+
+## Response expectations
+
+- acknowledgement within **7 days**
+- status updates at least every **14 days** until resolution
+- coordinated disclosure: the fix and advisory are prepared first; the finding
+  is disclosed publicly after the fix ships
+
+## Credits and disclosure
+
+- reporters are credited in the advisory and CHANGELOG unless they ask to stay anonymous
+- advisories follow GitHub's advisory workflow and are published together with the fix

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-medrec-qc",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "病案首页形式质控与逻辑矛盾提示（依据国卫办医发〔2016〕24号等公开文件，仅提示差异，不作出定性结论）",
   "type": "module",
   "main": "lib/index.mjs",
@@ -23,7 +23,9 @@
     "README-hi.md",
     "locale/*.json",
     "icon.svg",
-    "rules"
+    "rules",
+    "CHANGELOG.md",
+    "SECURITY.md"
   ],
   "scripts": {
     "build": "tsdown",
@@ -32,7 +34,7 @@
     "verify:self-contained": "node scripts/verify-self-contained.mjs",
     "check:lockfile": "node scripts/check-lockfile-drift.mjs",
     "check:readmes": "node scripts/check-readme-sync.mjs",
-    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:readmes && pnpm run check:citations",
+    "prepublishOnly": "pnpm run typecheck && pnpm test && pnpm run build && pnpm run verify:self-contained && pnpm run check:lockfile && pnpm run check:readmes && pnpm run check:citations",
     "prepare": "tsdown",
     "check:citations": "node scripts/check-citations.mjs"
   },

package/rules/citations-baseline.json

@@ -1,6 +1,4 @@
 {
   "note": "Excerpt segments that are not yet traceable to this repository's rules/evidence/ record. The check:citations gate fails on anything new and on any entry that has become traceable, so this list can only shrink.",
-  "untraceable": [
-    "MR-014:ec7e8ee1e000"
-  ]
+  "untraceable": []
 }

package/rules/evidence/clause-verification-nhsa-liangku.md

@@ -0,0 +1,77 @@
+# 条文核查报告 —— dsh-medrec-qc（病案质控核对）
+
+- **核查日期**：2026-10-07
+- **核查对象**：`MR-014` 引用的国家医疗保障局智能监管"两库"知识点
+- **核查方法**：取回**发布机关本站**（国家医疗保障局）页面及其**附件**，逐字复制表头。
+- **结论**：**取得逐字内容**，并**把来源从未经核实的转载页换成发布机关本站**。
+
+---
+
+## 一、本轮更正：来源换成了发布机关
+
+`MR-014` 原先的 `source` 指向 `http://ywc.jlu.edu.cn/info/1037/1405.htm`
+（**某高校学院转载页**），而这条引文的实际出处是**国家医疗保障局**公开发布的"两库"知识点明细。
+
+已换为发布机关本站：
+
+- **公告页**：<https://www.nhsa.gov.cn/art/2026/9/8/art_109_22052.html>
+  《国家医保局发布第二十一批智能监管"两库"规则和知识点》
+- **知识点明细附件（xlsx）**：
+  <https://www.nhsa.gov.cn/module/download/downfile.jsp?classid=0&filename=c16ad58707df4d4cb93f685d04e57a78.xlsx>
+
+**版本事实**：索引号 `2026-04-00085`，发布日期 **2026-09-08**，发布机构**国家医疗保障局**。
+公告说明本次公开的是"诊断与患者性别不符"规则下"某些传染病和寄生虫病"等 **9 章**的对应知识点明细；
+并载明《国家医保基金智能监管知识库、规则库（2025 年版）》已出版发行。
+
+---
+
+## 二、已取得逐字内容的文件
+
+### 第二十一批"诊断与患者性别不符"规则对应知识点明细（xlsx 附件）
+
+- **表头（逐字，`MR-014` 所引）**：
+  > 序号 ｜ 诊断代码（ICD-10医保2.0版）｜ 诊断名称（ICD-10医保2.0版）｜ 限定性别 ｜ 检出逻辑 ｜ 逻辑依据
+
+  （附件中该表头单元格内含换行，原文为
+  `诊断代码\n（ICD-10医保2.0版）` 与 `诊断名称\n（ICD-10医保2.0版）`。）
+
+- **数据行示例（逐字）**：
+  > A06.800x003 ｜ 阿米巴精囊炎 ｜ 男 ｜ 与限定性别不符 ｜ 男性泌尿生殖器官疾病相关诊断
+  > A06.800x004+N51.2* ｜ 阿米巴龟头炎 ｜ 男 ｜ …
+
+- **取得方式**：下载附件 xlsx → 解包 `xl/sharedStrings.xml` → 提取字符串表，逐字复制。
+
+⚠️ 该附件为**结构化数据表**（768 条字符串、含大量诊断编码），本插件**不内置该表**；
+本记录只证明 `MR-014` 所引表头与"与限定性别不符"这一检出逻辑确有官方出处。
+
+---
+
+## 三、边界说明（沿用并确认）
+
+本插件核对的是**病案首页与结算清单的字段齐备与代码形式自洽**，
+**不判定某条诊断在临床上是否正确、是否应当计入**。
+
+"两库"知识点本身是**医保基金智能监管规则**，其适用主体是**定点医药机构的事前提醒与自查自纠**；
+把它读成"临床诊断规范"即为越界。
+
+⚠️ 本规则库的 `kind`、`severity`、`excerpt` **一律未改动**（`excerpt` 本就是逐字表头）。
+
+## 四、仍未取得的部分（如实标注）
+
+| 文件 | 状态 |
+|---|---|
+| 《国家医保基金智能监管知识库、规则库（2025年版）》 | **未取得**；公告称已出版发行，本插件不内置。 |
+| 本批其余 8 章的知识点明细 | 已随附件取得，但本插件规则未逐项引用，故不全录。 |
+| 同页 PDF 附件 | **未取得**（本轮以 xlsx 为准，二者应内容一致但未逐页比对）。 |
+
+## 五、复现方法
+
+```sh
+# 公告页
+curl -sL -A 'Mozilla/5.0' 'https://www.nhsa.gov.cn/art/2026/9/8/art_109_22052.html' \
+  | sed 's/<[^>]*>//g' | tr -s ' ' | grep -o '第二十一批[^。]*'
+# 附件表头
+curl -sL -o kp.xlsx -A 'Mozilla/5.0' \
+  'https://www.nhsa.gov.cn/module/download/downfile.jsp?classid=0&filename=c16ad58707df4d4cb93f685d04e57a78.xlsx'
+unzip -p kp.xlsx xl/sharedStrings.xml | sed 's/<[^>]*>/\n/g' | grep -A1 -B1 '限定性别'
+```