dsh-policy-ledger 0.2.0-alpha.10 → 0.2.0-alpha.11

package/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 
-## [0.2.0-alpha.10] — 2026-11-01
+## [0.2.0-alpha.11] — 2026-11-01
+
+### Added
+
+- `trust.risk_matrix`: fleet-level risk view over named snapshots — counts per R0-R3, the highest level and the R2/R3 names to review. Read-only. Verified by `node --test test/*.test.mjs` (10/10).
+
+## [Unreleased]
 
 ### Added
 

package/lib/core/trust.d.ts

@@ -64,3 +64,15 @@ export interface Diagnosis {
     evidence_lines: string[];
 }
 export declare function classifyInstallLog(logText: string): Diagnosis;
+export interface RiskRow {
+    name: string;
+    risk: Risk;
+}
+export interface RiskMatrix {
+    total: number;
+    by_risk: Record<Risk, number>;
+    highest: Risk | null;
+    attention: string[];
+}
+/** Fleet-level view of declared risks: counts by level, the highest level and the R2/R3 rows. */
+export declare function riskMatrix(rows: RiskRow[]): RiskMatrix;

package/lib/core/trust.js

@@ -107,3 +107,17 @@ export function classifyInstallLog(logText) {
         evidence_lines: lines.slice(0, 2),
     };
 }
+/** Fleet-level view of declared risks: counts by level, the highest level and the R2/R3 rows. */
+export function riskMatrix(rows) {
+    const by_risk = { R0: 0, R1: 0, R2: 0, R3: 0 };
+    let highest = null;
+    const attention = [];
+    for (const row of rows) {
+        by_risk[row.risk] += 1;
+        if (highest === null || RISK_ORDER[row.risk] > RISK_ORDER[highest])
+            highest = row.risk;
+        if (row.risk === 'R2' || row.risk === 'R3')
+            attention.push(row.name);
+    }
+    return { total: rows.length, by_risk, highest, attention: attention.sort() };
+}

package/lib/plugin/tools.js

@@ -3,7 +3,7 @@ import { access, readFile, realpath, stat, statfs } from 'node:fs/promises';
 import path from 'node:path';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { zipSync } from 'fflate';
-import { TrustError, canonicalJson, classifyInstallLog, diffSnapshots, riskBreakdown } from '../core/trust.js';
+import { TrustError, canonicalJson, classifyInstallLog, diffSnapshots, riskBreakdown, riskMatrix } from '../core/trust.js';
 import { inspectPackageTarball } from '../adapters/tarball.js';
 import { newId, sha256Buffer, writeBundle, } from './storage.js';
 function text(value) {
@@ -323,5 +323,12 @@ export function createTools(deps) {
         output: { schema: { type: 'object', additionalProperties: false, properties: { risk: { type: 'string', required: true }, score: { type: 'number', required: true }, capped: { type: 'boolean', required: true }, factors: { type: 'array', required: true, items: { type: 'object', additionalProperties: false, properties: { factor: { type: 'string', required: true }, points: { type: 'number', required: true } } } } } }, render: (_a, v) => text(`risk ${v.risk} score ${v.score}`) },
         async execute(args) { return riskBreakdown(args.caps, args.hosts ?? [], args.build_scripts ?? [], args.cred_refs ?? []); },
     });
-    return [snapshot, diff, assert, legacyAssert, diagnose, probe, bundle, riskReport];
+    const riskMatrixTool = defineTool({
+        name: 'trust.risk_matrix',
+        description: 'Fleet-level risk view over named snapshots: counts per R0-R3, the highest level and the R2/R3 names to review. Read-only.',
+        parameters: { rows: { type: 'array', required: true, items: { type: 'object', additionalProperties: false, properties: { name: { type: 'string', required: true }, risk: { type: 'string', required: true } } } } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { total: { type: 'number', required: true }, highest: { type: 'string' }, attention: { type: 'array', required: true, items: { type: 'string' } }, by_risk: { type: 'json', required: true } } }, render: (_a, v) => text(`risk matrix ${v.total} rows, highest ${v.highest ?? 'n/a'}`) },
+        async execute(args) { const m = riskMatrix(args.rows); return { total: m.total, highest: m.highest ?? undefined, attention: m.attention, by_risk: m.by_risk }; },
+    });
+    return [snapshot, diff, assert, legacyAssert, diagnose, probe, bundle, riskReport, riskMatrixTool];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-policy-ledger",
-  "version": "0.2.0-alpha.10",
+  "version": "0.2.0-alpha.11",
   "description": "Read-only install doctor: capability snapshot, tarball assert and install diagnosis.",
   "type": "module",
   "main": "./lib/plugin/index.js",

package/screenshots.json

@@ -16,5 +16,11 @@
     "kind": "capability",
     "alt": "dsh-policy-ledger real test run",
     "caption": "Real command: node --test test/risk-report.test.mjs — 4 tests passed, 0 failed (capability risk breakdown). Run 2026-11-01; the image is rendered from the captured terminal output."
+  },
+  {
+    "path": "docs/assets/dsh-policy-ledger-capability2.png",
+    "kind": "capability",
+    "alt": "dsh-policy-ledger second capability run",
+    "caption": "Real command: node --test test/risk-matrix.test.mjs — 3 tests passed, 0 failed (Fleet risk matrix: counts per level, highest level, review list.) Run 2026-11-01; rendered from the captured terminal output."
   }
 ]