dsh-policy-ledger 0.2.0-alpha.3 → 0.2.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README-es.md ADDED
@@ -0,0 +1,117 @@
1
+ <div align="center">
2
+
3
+ # dsh-policy-ledger
4
+
5
+ > **Status: KEEP — install-only companion.** Not a duplicate of `dsh-plugin-doctor`: this answers "what is installed, what does the tarball contain, why did the install fail?" with a read-only capability snapshot, tarball assertions and install-log diagnosis. `dsh-plugin-doctor` does package-structure, cordis and sandbox-smoke checks. Use both when you need both questions answered.
6
+
7
+ [![npm](https://img.shields.io/npm/v/dsh-policy-ledger)](https://www.npmjs.com/package/dsh-policy-ledger)
8
+ [![CI](https://github.com/PerryLink/dsh-policy-ledger/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-policy-ledger/actions)
9
+ [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
10
+ [![dsh-plugin](https://img.shields.io/badge/dsh--plugin-%E2%9C%93-green)](https://github.com/topics/dsh-plugin)
11
+ [![docs](https://img.shields.io/badge/docs-domain%20index-0b5fff)](https://perrylink.github.io/dsh-plugins/)
12
+
13
+ **Doctor de instalación de solo lectura: instantánea de capacidades, verificación de tarball y diagnóstico.**
14
+
15
+ > **Estado: alpha / synthetic público / parcial / no contabilizado / no GA.** Sin evidencia de clientes, datos de clientes ni promesa de producción.
16
+
17
+ [English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
18
+
19
+ ```sh
20
+ dsh plugin --profile <profile> add dsh-policy-ledger
21
+ ```
22
+
23
+ </div>
24
+
25
+ ![Workflow diagram for dsh-policy-ledger: local input, plugin, local output.](docs/assets/dsh-policy-ledger-flow.svg)
26
+
27
+ *Flujo: entrada local → plugin → salida local. No requiere llamada a un modelo.*
28
+
29
+ ## Instalación
30
+
31
+ Instalar y verificar:
32
+
33
+ ```sh
34
+ dsh plugin --profile <profile> add dsh-policy-ledger
35
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
36
+ ```
37
+
38
+ Desinstalar:
39
+
40
+ ```sh
41
+ dsh plugin --profile <profile> remove dsh-policy-ledger
42
+ ```
43
+
44
+ ## Qué hace
45
+
46
+ Doctor de instalación de solo lectura: instantánea de capacidades, verificación de tarball y diagnóstico. Se ejecuta localmente en DeepSeek Harness. La tabla siguiente es la superficie exacta de herramientas; los ejemplos usan la interfaz real.
47
+
48
+ La entrada y la salida permanecen locales; no se sube nada.
49
+
50
+ ## Herramientas
51
+
52
+ Los nombres y descripciones de herramientas se mantienen en inglés para coincidir con la salida runtime.
53
+
54
+ | Herramienta | Propósito (en inglés) | Riesgo |
55
+ |---|---|---|
56
+ | `trust.capability_snapshot` | Extract declared capabilities and R0–R3 risk from a local npm `.tgz`: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references | R0 local read |
57
+ | `trust.diff` | Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
58
+ | `trust.assert_tarball` | Re-read a tarball and compare it with a stored snapshot: pass/missing/extra/changed/unknown | R0 |
59
+ | `install.diagnose` | Classify an install log into stage, root cause and three actions; return unknown rather than guess | R0 |
60
+ | `install.probe` | Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
61
+ | `install.bundle` | Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
62
+
63
+ ## Inicio rápido
64
+
65
+ ```sh
66
+ dsh plugin --profile <profile> add dsh-policy-ledger
67
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
68
+ ```
69
+
70
+ ## Límites
71
+
72
+ - Solo público/sintético; sin datos ni evidencia de clientes.
73
+ - Alpha/parcial, no contabilizado, sin GA ni promesa de producción.
74
+ - Sin modelo ni red salvo que una herramienta lo indique.
75
+ - Los límites exactos están en la tabla y en `ACCEPTANCE.csv`.
76
+
77
+ ## Muestra pública
78
+
79
+ Las fixtures públicas/sintéticas están en `test/fixtures/`; `ACCEPTANCE.csv` registra las comprobaciones con `counted=false`.
80
+
81
+ ## Desarrollo
82
+
83
+ ```sh
84
+ pnpm install --frozen-lockfile
85
+ pnpm build && pnpm lint && pnpm typecheck && pnpm test
86
+ ```
87
+
88
+ ## Familia
89
+
90
+ <details>
91
+ <summary>Familia de plugins DSH (15 paquetes + 2 suites)</summary>
92
+
93
+ | Package | npm |
94
+ |---|---|
95
+ | **[dsh-einvoice](https://github.com/PerryLink/dsh-einvoice)** | [npm](https://www.npmjs.com/package/dsh-einvoice) |
96
+ | **[dsh-docx-redline](https://github.com/PerryLink/dsh-docx-redline)** | [npm](https://www.npmjs.com/package/dsh-docx-redline) |
97
+ | **[dsh-policy-ledger](https://github.com/PerryLink/dsh-policy-ledger)** | [npm](https://www.npmjs.com/package/dsh-policy-ledger) |
98
+ | **[dsh-ghg](https://github.com/PerryLink/dsh-ghg)** | [npm](https://www.npmjs.com/package/dsh-ghg) |
99
+ | **[dsh-bankrec](https://github.com/PerryLink/dsh-bankrec)** | [npm](https://www.npmjs.com/package/dsh-bankrec) |
100
+ | **[dsh-ap-three-way](https://github.com/PerryLink/dsh-ap-three-way)** | [npm](https://www.npmjs.com/package/dsh-ap-three-way) |
101
+ | **[dsh-ifc-qto](https://github.com/PerryLink/dsh-ifc-qto)** | [npm](https://www.npmjs.com/package/dsh-ifc-qto) |
102
+ | **[dsh-qms-capa](https://github.com/PerryLink/dsh-qms-capa)** | [npm](https://www.npmjs.com/package/dsh-qms-capa) |
103
+ | **[dsh-legal-intake](https://github.com/PerryLink/dsh-legal-intake)** | [npm](https://www.npmjs.com/package/dsh-legal-intake) |
104
+ | **[dsh-legal-clause](https://github.com/PerryLink/dsh-legal-clause)** | [npm](https://www.npmjs.com/package/dsh-legal-clause) |
105
+ | **[dsh-freight-audit](https://github.com/PerryLink/dsh-freight-audit)** | [npm](https://www.npmjs.com/package/dsh-freight-audit) |
106
+ | **[dsh-hs-candidate](https://github.com/PerryLink/dsh-hs-candidate)** | [npm](https://www.npmjs.com/package/dsh-hs-candidate) |
107
+ | **[dsh-travel-recon](https://github.com/PerryLink/dsh-travel-recon)** | [npm](https://www.npmjs.com/package/dsh-travel-recon) |
108
+ | **[dsh-pim-lint](https://github.com/PerryLink/dsh-pim-lint)** | [npm](https://www.npmjs.com/package/dsh-pim-lint) |
109
+ | **[dsh-eval-pack](https://github.com/PerryLink/dsh-eval-pack)** | [npm](https://www.npmjs.com/package/dsh-eval-pack) |
110
+ | **[dsh-finops-suite](https://github.com/PerryLink/dsh-finops-suite)** | [npm](https://www.npmjs.com/package/dsh-finops-suite) |
111
+ | **[dsh-contract-suite](https://github.com/PerryLink/dsh-contract-suite)** | [npm](https://www.npmjs.com/package/dsh-contract-suite) |
112
+
113
+ </details>
114
+
115
+ ## Licencia
116
+
117
+ Apache-2.0. See `LICENSE`, `NOTICE`, `THIRD-PARTY-NOTICES`.
package/README-hi.md ADDED
@@ -0,0 +1,117 @@
1
+ <div align="center">
2
+
3
+ # dsh-policy-ledger
4
+
5
+ > **Status: KEEP — install-only companion.** Not a duplicate of `dsh-plugin-doctor`: this answers "what is installed, what does the tarball contain, why did the install fail?" with a read-only capability snapshot, tarball assertions and install-log diagnosis. `dsh-plugin-doctor` does package-structure, cordis and sandbox-smoke checks. Use both when you need both questions answered.
6
+
7
+ [![npm](https://img.shields.io/npm/v/dsh-policy-ledger)](https://www.npmjs.com/package/dsh-policy-ledger)
8
+ [![CI](https://github.com/PerryLink/dsh-policy-ledger/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-policy-ledger/actions)
9
+ [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
10
+ [![dsh-plugin](https://img.shields.io/badge/dsh--plugin-%E2%9C%93-green)](https://github.com/topics/dsh-plugin)
11
+ [![docs](https://img.shields.io/badge/docs-domain%20index-0b5fff)](https://perrylink.github.io/dsh-plugins/)
12
+
13
+ **केवल-पढ़ने वाला इंस्टॉल डॉक्टर: क्षमता स्नैपशॉट, tarball जाँच और इंस्टॉल निदान।**
14
+
15
+ > **स्थिति: alpha / सार्वजनिक-सिंथेटिक / आंशिक / गिना नहीं गया / GA नहीं।** ग्राहक साक्ष्य, ग्राहक डेटा या उत्पादन-तैयारी का दावा नहीं।
16
+
17
+ [English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
18
+
19
+ ```sh
20
+ dsh plugin --profile <profile> add dsh-policy-ledger
21
+ ```
22
+
23
+ </div>
24
+
25
+ ![Workflow diagram for dsh-policy-ledger: local input, plugin, local output.](docs/assets/dsh-policy-ledger-flow.svg)
26
+
27
+ *वर्कफ़्लो: स्थानीय इनपुट → प्लगइन → स्थानीय आउटपुट। मॉडल कॉल आवश्यक नहीं।*
28
+
29
+ ## इंस्टॉल
30
+
31
+ इंस्टॉल और सत्यापन:
32
+
33
+ ```sh
34
+ dsh plugin --profile <profile> add dsh-policy-ledger
35
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
36
+ ```
37
+
38
+ अनइंस्टॉल:
39
+
40
+ ```sh
41
+ dsh plugin --profile <profile> remove dsh-policy-ledger
42
+ ```
43
+
44
+ ## यह क्या करता है
45
+
46
+ केवल-पढ़ने वाला इंस्टॉल डॉक्टर: क्षमता स्नैपशॉट, tarball जाँच और इंस्टॉल निदान। DeepSeek Harness पर स्थानीय रूप से चलता है। नीचे दी गई तालिका ही सटीक टूल सतह है; उदाहरण वास्तविक कमांड का उपयोग करते हैं।
47
+
48
+ इनपुट और आउटपुट स्थानीय रहते हैं; कुछ अपलोड नहीं होता।
49
+
50
+ ## टूल्स
51
+
52
+ टूल नाम और विवरण runtime आउटपुट से मेल खाने के लिए अंग्रेज़ी में रखे गए हैं।
53
+
54
+ | टूल | उद्देश्य (अंग्रेज़ी) | जोखिम |
55
+ |---|---|---|
56
+ | `trust.capability_snapshot` | Extract declared capabilities and R0–R3 risk from a local npm `.tgz`: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references | R0 local read |
57
+ | `trust.diff` | Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
58
+ | `trust.assert_tarball` | Re-read a tarball and compare it with a stored snapshot: pass/missing/extra/changed/unknown | R0 |
59
+ | `install.diagnose` | Classify an install log into stage, root cause and three actions; return unknown rather than guess | R0 |
60
+ | `install.probe` | Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
61
+ | `install.bundle` | Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
62
+
63
+ ## त्वरित शुरुआत
64
+
65
+ ```sh
66
+ dsh plugin --profile <profile> add dsh-policy-ledger
67
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
68
+ ```
69
+
70
+ ## सीमाएँ
71
+
72
+ - केवल सार्वजनिक/सिंथेटिक; ग्राहक डेटा या साक्ष्य नहीं।
73
+ - alpha/आंशिक, गिना नहीं गया, GA या उत्पादन-तैयारी का दावा नहीं।
74
+ - जब तक टूल स्पष्ट न कहे, मॉडल या नेटवर्क कॉल नहीं।
75
+ - सटीक सीमाएँ तालिका और `ACCEPTANCE.csv` में हैं।
76
+
77
+ ## सार्वजनिक नमूना
78
+
79
+ सार्वजनिक/सिंथेटिक fixtures `test/fixtures/` में हैं; `ACCEPTANCE.csv` सार्वजनिक जाँचों को `counted=false` के साथ दर्ज करता है।
80
+
81
+ ## विकास
82
+
83
+ ```sh
84
+ pnpm install --frozen-lockfile
85
+ pnpm build && pnpm lint && pnpm typecheck && pnpm test
86
+ ```
87
+
88
+ ## परिवार
89
+
90
+ <details>
91
+ <summary>DSH डोमेन प्लगइन परिवार (15 पैकेज + 2 suites)</summary>
92
+
93
+ | Package | npm |
94
+ |---|---|
95
+ | **[dsh-einvoice](https://github.com/PerryLink/dsh-einvoice)** | [npm](https://www.npmjs.com/package/dsh-einvoice) |
96
+ | **[dsh-docx-redline](https://github.com/PerryLink/dsh-docx-redline)** | [npm](https://www.npmjs.com/package/dsh-docx-redline) |
97
+ | **[dsh-policy-ledger](https://github.com/PerryLink/dsh-policy-ledger)** | [npm](https://www.npmjs.com/package/dsh-policy-ledger) |
98
+ | **[dsh-ghg](https://github.com/PerryLink/dsh-ghg)** | [npm](https://www.npmjs.com/package/dsh-ghg) |
99
+ | **[dsh-bankrec](https://github.com/PerryLink/dsh-bankrec)** | [npm](https://www.npmjs.com/package/dsh-bankrec) |
100
+ | **[dsh-ap-three-way](https://github.com/PerryLink/dsh-ap-three-way)** | [npm](https://www.npmjs.com/package/dsh-ap-three-way) |
101
+ | **[dsh-ifc-qto](https://github.com/PerryLink/dsh-ifc-qto)** | [npm](https://www.npmjs.com/package/dsh-ifc-qto) |
102
+ | **[dsh-qms-capa](https://github.com/PerryLink/dsh-qms-capa)** | [npm](https://www.npmjs.com/package/dsh-qms-capa) |
103
+ | **[dsh-legal-intake](https://github.com/PerryLink/dsh-legal-intake)** | [npm](https://www.npmjs.com/package/dsh-legal-intake) |
104
+ | **[dsh-legal-clause](https://github.com/PerryLink/dsh-legal-clause)** | [npm](https://www.npmjs.com/package/dsh-legal-clause) |
105
+ | **[dsh-freight-audit](https://github.com/PerryLink/dsh-freight-audit)** | [npm](https://www.npmjs.com/package/dsh-freight-audit) |
106
+ | **[dsh-hs-candidate](https://github.com/PerryLink/dsh-hs-candidate)** | [npm](https://www.npmjs.com/package/dsh-hs-candidate) |
107
+ | **[dsh-travel-recon](https://github.com/PerryLink/dsh-travel-recon)** | [npm](https://www.npmjs.com/package/dsh-travel-recon) |
108
+ | **[dsh-pim-lint](https://github.com/PerryLink/dsh-pim-lint)** | [npm](https://www.npmjs.com/package/dsh-pim-lint) |
109
+ | **[dsh-eval-pack](https://github.com/PerryLink/dsh-eval-pack)** | [npm](https://www.npmjs.com/package/dsh-eval-pack) |
110
+ | **[dsh-finops-suite](https://github.com/PerryLink/dsh-finops-suite)** | [npm](https://www.npmjs.com/package/dsh-finops-suite) |
111
+ | **[dsh-contract-suite](https://github.com/PerryLink/dsh-contract-suite)** | [npm](https://www.npmjs.com/package/dsh-contract-suite) |
112
+
113
+ </details>
114
+
115
+ ## लाइसेंस
116
+
117
+ Apache-2.0. See `LICENSE`, `NOTICE`, `THIRD-PARTY-NOTICES`.
package/README-pt.md ADDED
@@ -0,0 +1,117 @@
1
+ <div align="center">
2
+
3
+ # dsh-policy-ledger
4
+
5
+ > **Status: KEEP — install-only companion.** Not a duplicate of `dsh-plugin-doctor`: this answers "what is installed, what does the tarball contain, why did the install fail?" with a read-only capability snapshot, tarball assertions and install-log diagnosis. `dsh-plugin-doctor` does package-structure, cordis and sandbox-smoke checks. Use both when you need both questions answered.
6
+
7
+ [![npm](https://img.shields.io/npm/v/dsh-policy-ledger)](https://www.npmjs.com/package/dsh-policy-ledger)
8
+ [![CI](https://github.com/PerryLink/dsh-policy-ledger/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-policy-ledger/actions)
9
+ [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
10
+ [![dsh-plugin](https://img.shields.io/badge/dsh--plugin-%E2%9C%93-green)](https://github.com/topics/dsh-plugin)
11
+ [![docs](https://img.shields.io/badge/docs-domain%20index-0b5fff)](https://perrylink.github.io/dsh-plugins/)
12
+
13
+ **Doutor de instalação somente leitura: snapshot de capacidades, verificação de tarball e diagnóstico.**
14
+
15
+ > **Status: alpha / sintético público / parcial / não contabilizado / não GA.** Sem evidência de clientes, dados de clientes ou promessa de produção.
16
+
17
+ [English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
18
+
19
+ ```sh
20
+ dsh plugin --profile <profile> add dsh-policy-ledger
21
+ ```
22
+
23
+ </div>
24
+
25
+ ![Workflow diagram for dsh-policy-ledger: local input, plugin, local output.](docs/assets/dsh-policy-ledger-flow.svg)
26
+
27
+ *Fluxo: entrada local → plugin → saída local. Não exige chamada a modelo.*
28
+
29
+ ## Instalação
30
+
31
+ Instalar e verificar:
32
+
33
+ ```sh
34
+ dsh plugin --profile <profile> add dsh-policy-ledger
35
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
36
+ ```
37
+
38
+ Desinstalar:
39
+
40
+ ```sh
41
+ dsh plugin --profile <profile> remove dsh-policy-ledger
42
+ ```
43
+
44
+ ## O que faz
45
+
46
+ Doutor de instalação somente leitura: snapshot de capacidades, verificação de tarball e diagnóstico. Executa localmente no DeepSeek Harness. A tabela abaixo é a superfície exata de ferramentas; os exemplos usam a interface real.
47
+
48
+ Entrada e saída permanecem locais; nada é enviado.
49
+
50
+ ## Ferramentas
51
+
52
+ Nomes e descrições de ferramentas ficam em inglês para corresponder à saída runtime.
53
+
54
+ | Ferramenta | Finalidade (em inglês) | Risco |
55
+ |---|---|---|
56
+ | `trust.capability_snapshot` | Extract declared capabilities and R0–R3 risk from a local npm `.tgz`: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references | R0 local read |
57
+ | `trust.diff` | Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
58
+ | `trust.assert_tarball` | Re-read a tarball and compare it with a stored snapshot: pass/missing/extra/changed/unknown | R0 |
59
+ | `install.diagnose` | Classify an install log into stage, root cause and three actions; return unknown rather than guess | R0 |
60
+ | `install.probe` | Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
61
+ | `install.bundle` | Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
62
+
63
+ ## Início rápido
64
+
65
+ ```sh
66
+ dsh plugin --profile <profile> add dsh-policy-ledger
67
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
68
+ ```
69
+
70
+ ## Limites
71
+
72
+ - Apenas público/sintético; sem dados ou evidência de clientes.
73
+ - Alpha/parcial, não contabilizado, sem GA ou promessa de produção.
74
+ - Sem modelo ou rede, a menos que uma ferramenta indique.
75
+ - Os limites exatos estão na tabela e em `ACCEPTANCE.csv`.
76
+
77
+ ## Amostra pública
78
+
79
+ As fixtures públicas/sintéticas ficam em `test/fixtures/`; `ACCEPTANCE.csv` registra as verificações com `counted=false`.
80
+
81
+ ## Desenvolvimento
82
+
83
+ ```sh
84
+ pnpm install --frozen-lockfile
85
+ pnpm build && pnpm lint && pnpm typecheck && pnpm test
86
+ ```
87
+
88
+ ## Família
89
+
90
+ <details>
91
+ <summary>Família de plugins DSH (15 pacotes + 2 suites)</summary>
92
+
93
+ | Package | npm |
94
+ |---|---|
95
+ | **[dsh-einvoice](https://github.com/PerryLink/dsh-einvoice)** | [npm](https://www.npmjs.com/package/dsh-einvoice) |
96
+ | **[dsh-docx-redline](https://github.com/PerryLink/dsh-docx-redline)** | [npm](https://www.npmjs.com/package/dsh-docx-redline) |
97
+ | **[dsh-policy-ledger](https://github.com/PerryLink/dsh-policy-ledger)** | [npm](https://www.npmjs.com/package/dsh-policy-ledger) |
98
+ | **[dsh-ghg](https://github.com/PerryLink/dsh-ghg)** | [npm](https://www.npmjs.com/package/dsh-ghg) |
99
+ | **[dsh-bankrec](https://github.com/PerryLink/dsh-bankrec)** | [npm](https://www.npmjs.com/package/dsh-bankrec) |
100
+ | **[dsh-ap-three-way](https://github.com/PerryLink/dsh-ap-three-way)** | [npm](https://www.npmjs.com/package/dsh-ap-three-way) |
101
+ | **[dsh-ifc-qto](https://github.com/PerryLink/dsh-ifc-qto)** | [npm](https://www.npmjs.com/package/dsh-ifc-qto) |
102
+ | **[dsh-qms-capa](https://github.com/PerryLink/dsh-qms-capa)** | [npm](https://www.npmjs.com/package/dsh-qms-capa) |
103
+ | **[dsh-legal-intake](https://github.com/PerryLink/dsh-legal-intake)** | [npm](https://www.npmjs.com/package/dsh-legal-intake) |
104
+ | **[dsh-legal-clause](https://github.com/PerryLink/dsh-legal-clause)** | [npm](https://www.npmjs.com/package/dsh-legal-clause) |
105
+ | **[dsh-freight-audit](https://github.com/PerryLink/dsh-freight-audit)** | [npm](https://www.npmjs.com/package/dsh-freight-audit) |
106
+ | **[dsh-hs-candidate](https://github.com/PerryLink/dsh-hs-candidate)** | [npm](https://www.npmjs.com/package/dsh-hs-candidate) |
107
+ | **[dsh-travel-recon](https://github.com/PerryLink/dsh-travel-recon)** | [npm](https://www.npmjs.com/package/dsh-travel-recon) |
108
+ | **[dsh-pim-lint](https://github.com/PerryLink/dsh-pim-lint)** | [npm](https://www.npmjs.com/package/dsh-pim-lint) |
109
+ | **[dsh-eval-pack](https://github.com/PerryLink/dsh-eval-pack)** | [npm](https://www.npmjs.com/package/dsh-eval-pack) |
110
+ | **[dsh-finops-suite](https://github.com/PerryLink/dsh-finops-suite)** | [npm](https://www.npmjs.com/package/dsh-finops-suite) |
111
+ | **[dsh-contract-suite](https://github.com/PerryLink/dsh-contract-suite)** | [npm](https://www.npmjs.com/package/dsh-contract-suite) |
112
+
113
+ </details>
114
+
115
+ ## Licença
116
+
117
+ Apache-2.0. See `LICENSE`, `NOTICE`, `THIRD-PARTY-NOTICES`.
package/README-zh.md ADDED
@@ -0,0 +1,117 @@
1
+ <div align="center">
2
+
3
+ # dsh-policy-ledger
4
+
5
+ > **状态:保留 — 仅安装诊断的伴生工具。** 与 `dsh-plugin-doctor` 不重复:本包回答“装了什么、tarball 里有什么、为什么安装失败”,只读能力快照、tarball 断言和安装日志诊断;`dsh-plugin-doctor` 做包结构、Cordis 和 sandbox smoke。需要两类问题时同时用。
6
+
7
+ [![npm](https://img.shields.io/npm/v/dsh-policy-ledger)](https://www.npmjs.com/package/dsh-policy-ledger)
8
+ [![CI](https://github.com/PerryLink/dsh-policy-ledger/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-policy-ledger/actions)
9
+ [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
10
+ [![dsh-plugin](https://img.shields.io/badge/dsh--plugin-%E2%9C%93-green)](https://github.com/topics/dsh-plugin)
11
+ [![docs](https://img.shields.io/badge/docs-domain%20index-0b5fff)](https://perrylink.github.io/dsh-plugins/)
12
+
13
+ **只读安装诊断:能力快照、tarball 断言与安装日志分类。**
14
+
15
+ > **状态:alpha / 公开合成 / partial / not counted / 非 GA。** 不含客户证据、客户数据,也不作生产可用声明。
16
+
17
+ [English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
18
+
19
+ ```sh
20
+ dsh plugin --profile <profile> add dsh-policy-ledger
21
+ ```
22
+
23
+ </div>
24
+
25
+ ![Workflow diagram for dsh-policy-ledger: local input, plugin, local output.](docs/assets/dsh-policy-ledger-flow.svg)
26
+
27
+ *工作流:本地输入 → 插件 → 本地输出;不需要调用模型。*
28
+
29
+ ## 安装
30
+
31
+ 安装并验证:
32
+
33
+ ```sh
34
+ dsh plugin --profile <profile> add dsh-policy-ledger
35
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
36
+ ```
37
+
38
+ 卸载:
39
+
40
+ ```sh
41
+ dsh plugin --profile <profile> remove dsh-policy-ledger
42
+ ```
43
+
44
+ ## 它做什么
45
+
46
+ 只读安装诊断:能力快照、tarball 断言与安装日志分类。 在 DeepSeek Harness 本地运行;下表就是实际工具面,示例使用真实命令面。
47
+
48
+ 输入和输出都留在本地,不上传。
49
+
50
+ ## 工具
51
+
52
+ 工具名和说明保留英文,以对应运行输出。
53
+
54
+ | 工具 | 用途(英文对应运行输出) | 风险 |
55
+ |---|---|---|
56
+ | `trust.capability_snapshot` | Extract declared capabilities and R0–R3 risk from a local npm `.tgz`: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references | R0 local read |
57
+ | `trust.diff` | Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
58
+ | `trust.assert_tarball` | Re-read a tarball and compare it with a stored snapshot: pass/missing/extra/changed/unknown | R0 |
59
+ | `install.diagnose` | Classify an install log into stage, root cause and three actions; return unknown rather than guess | R0 |
60
+ | `install.probe` | Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
61
+ | `install.bundle` | Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
62
+
63
+ ## 快速开始
64
+
65
+ ```sh
66
+ dsh plugin --profile <profile> add dsh-policy-ledger
67
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
68
+ ```
69
+
70
+ ## 边界
71
+
72
+ - 仅公开/合成样例;不含客户数据或客户证据。
73
+ - alpha/partial、not counted,不作 GA 或生产可用声明。
74
+ - 除非工具明确说明,否则不调用模型、不联网。
75
+ - 每个工具的精确边界见工具表与 `ACCEPTANCE.csv`。
76
+
77
+ ## 公开样例
78
+
79
+ 公开/合成 fixture 在 `test/fixtures/`;`ACCEPTANCE.csv` 记录公开检查,全部 `counted=false`。
80
+
81
+ ## 开发
82
+
83
+ ```sh
84
+ pnpm install --frozen-lockfile
85
+ pnpm build && pnpm lint && pnpm typecheck && pnpm test
86
+ ```
87
+
88
+ ## 家族
89
+
90
+ <details>
91
+ <summary>DSH 领域插件家族(15 个包 + 2 个 suite)</summary>
92
+
93
+ | Package | npm |
94
+ |---|---|
95
+ | **[dsh-einvoice](https://github.com/PerryLink/dsh-einvoice)** | [npm](https://www.npmjs.com/package/dsh-einvoice) |
96
+ | **[dsh-docx-redline](https://github.com/PerryLink/dsh-docx-redline)** | [npm](https://www.npmjs.com/package/dsh-docx-redline) |
97
+ | **[dsh-policy-ledger](https://github.com/PerryLink/dsh-policy-ledger)** | [npm](https://www.npmjs.com/package/dsh-policy-ledger) |
98
+ | **[dsh-ghg](https://github.com/PerryLink/dsh-ghg)** | [npm](https://www.npmjs.com/package/dsh-ghg) |
99
+ | **[dsh-bankrec](https://github.com/PerryLink/dsh-bankrec)** | [npm](https://www.npmjs.com/package/dsh-bankrec) |
100
+ | **[dsh-ap-three-way](https://github.com/PerryLink/dsh-ap-three-way)** | [npm](https://www.npmjs.com/package/dsh-ap-three-way) |
101
+ | **[dsh-ifc-qto](https://github.com/PerryLink/dsh-ifc-qto)** | [npm](https://www.npmjs.com/package/dsh-ifc-qto) |
102
+ | **[dsh-qms-capa](https://github.com/PerryLink/dsh-qms-capa)** | [npm](https://www.npmjs.com/package/dsh-qms-capa) |
103
+ | **[dsh-legal-intake](https://github.com/PerryLink/dsh-legal-intake)** | [npm](https://www.npmjs.com/package/dsh-legal-intake) |
104
+ | **[dsh-legal-clause](https://github.com/PerryLink/dsh-legal-clause)** | [npm](https://www.npmjs.com/package/dsh-legal-clause) |
105
+ | **[dsh-freight-audit](https://github.com/PerryLink/dsh-freight-audit)** | [npm](https://www.npmjs.com/package/dsh-freight-audit) |
106
+ | **[dsh-hs-candidate](https://github.com/PerryLink/dsh-hs-candidate)** | [npm](https://www.npmjs.com/package/dsh-hs-candidate) |
107
+ | **[dsh-travel-recon](https://github.com/PerryLink/dsh-travel-recon)** | [npm](https://www.npmjs.com/package/dsh-travel-recon) |
108
+ | **[dsh-pim-lint](https://github.com/PerryLink/dsh-pim-lint)** | [npm](https://www.npmjs.com/package/dsh-pim-lint) |
109
+ | **[dsh-eval-pack](https://github.com/PerryLink/dsh-eval-pack)** | [npm](https://www.npmjs.com/package/dsh-eval-pack) |
110
+ | **[dsh-finops-suite](https://github.com/PerryLink/dsh-finops-suite)** | [npm](https://www.npmjs.com/package/dsh-finops-suite) |
111
+ | **[dsh-contract-suite](https://github.com/PerryLink/dsh-contract-suite)** | [npm](https://www.npmjs.com/package/dsh-contract-suite) |
112
+
113
+ </details>
114
+
115
+ ## 许可证
116
+
117
+ Apache-2.0. See `LICENSE`, `NOTICE`, `THIRD-PARTY-NOTICES`.
package/README.md CHANGED
@@ -1,34 +1,57 @@
1
+ <div align="center">
2
+
1
3
  # dsh-policy-ledger
2
4
 
3
- Read-only capability snapshot, tarball assert and install diagnosis for DeepSeek Harness.
5
+ > **Status: KEEP — install-only companion.** Not a duplicate of `dsh-plugin-doctor`: this answers "what is installed, what does the tarball contain, why did the install fail?" with a read-only capability snapshot, tarball assertions and install-log diagnosis. `dsh-plugin-doctor` does package-structure, cordis and sandbox-smoke checks. Use both when you need both questions answered.
6
+
7
+ [![npm](https://img.shields.io/npm/v/dsh-policy-ledger)](https://www.npmjs.com/package/dsh-policy-ledger)
8
+ [![CI](https://github.com/PerryLink/dsh-policy-ledger/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-policy-ledger/actions)
9
+ [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
10
+ [![dsh-plugin](https://img.shields.io/badge/dsh--plugin-%E2%9C%93-green)](https://github.com/topics/dsh-plugin)
11
+ [![docs](https://img.shields.io/badge/docs-domain%20index-0b5fff)](https://perrylink.github.io/dsh-plugins/)
12
+
13
+ **Read-only install doctor: capability snapshot, tarball assert and install diagnosis.**
14
+
15
+ > **Status: alpha / public-synthetic / partial / not counted / not GA.** No customer evidence, customer data, or production-readiness claim.
16
+
17
+ [English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
18
+
19
+ ```sh
20
+ dsh plugin --profile <profile> add dsh-policy-ledger
21
+ ```
22
+
23
+ </div>
24
+
25
+ ![Workflow diagram for dsh-policy-ledger: local input, plugin, local output.](docs/assets/dsh-policy-ledger-flow.svg)
4
26
 
5
- > **Status: alpha / public-synthetic / partial / not counted / not GA.** No customer evidence, customer data, or production-readiness claim. All acceptance rows are `counted=false`.
27
+ *Workflow: local input → plugin → local output. No model call is required.*
6
28
 
7
29
  ## Install
8
30
 
31
+ Install and verify:
32
+
9
33
  ```sh
10
34
  dsh plugin --profile <profile> add dsh-policy-ledger
11
35
  dsh --profile <profile> --dump-config | grep dsh-policy-ledger
12
36
  ```
13
37
 
14
- CLI:
38
+ Uninstall:
15
39
 
16
40
  ```sh
17
- dsh-policy-ledger doctor ./some-package.tgz --json
41
+ dsh plugin --profile <profile> remove dsh-policy-ledger
18
42
  ```
19
43
 
20
- Requires DSH `>=0.2.1-rc.3 <0.3.0` and Node `>=24.9 <25`.
21
-
22
- <details>
23
- <summary>中文摘要</summary>
44
+ ## What it does
24
45
 
25
- 只读安装诊断:能力快照、tarball 断言与安装日志分类。 安装:`dsh plugin --profile <profile> add dsh-policy-ledger`。公开/合成、alpha、非 GA。
46
+ Read-only install doctor: capability snapshot, tarball assert and install diagnosis. Runs locally on DeepSeek Harness. The table below is the exact tool surface; the examples use the real command surface.
26
47
 
27
- </details>
48
+ Input and output stay local; nothing is uploaded.
28
49
 
29
50
  ## Tools
30
51
 
31
- | Tool | What it does | Risk |
52
+ Tool names and descriptions are kept in English to match the runtime output.
53
+
54
+ | Tool | Purpose | Risk |
32
55
  |---|---|---|
33
56
  | `trust.capability_snapshot` | Extract declared capabilities and R0–R3 risk from a local npm `.tgz`: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references | R0 local read |
34
57
  | `trust.diff` | Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
@@ -37,36 +60,58 @@ Requires DSH `>=0.2.1-rc.3 <0.3.0` and Node `>=24.9 <25`.
37
60
  | `install.probe` | Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
38
61
  | `install.bundle` | Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
39
62
 
40
- ## Input / output
41
-
42
- **Input:** a local npm `.tgz`, a stored snapshot, an install log, or the local environment. **Output:** a capability snapshot, snapshot diff, tarball assert result, install diagnosis, environment probe, or redacted incident ZIP. The CLI exposes `dsh-policy-ledger doctor <tgz> --json`.
43
-
44
- ## Configuration
63
+ ## Quick start
45
64
 
46
- | Env | Default | Meaning |
47
- |---|---|---|
48
- | `DSH_TRUST_HOME` | `$DSH_HOME/storages/dsh-policy-ledger` | bundles and local storage |
49
- | `DSH_TRUST_INPUT_ROOTS` | `current working directory` | tarball allowlist |
65
+ ```sh
66
+ dsh plugin --profile <profile> add dsh-policy-ledger
67
+ dsh --profile <profile> --dump-config | grep dsh-policy-ledger
68
+ ```
50
69
 
51
- ## Limits / non-claims
70
+ ## Limits
52
71
 
53
- - This is **not** a policy ledger, Gate, ledger, rollback, retry, or profile five-state product; the package name is retained for npm continuity.
54
- - No signing root, no policy evaluation/apply/rollback/receipt, no Client, Skill, or Bundle surface.
55
- - No customer profile, registry token, or private package is included.
56
- - `install.bundle` writes a local redacted ZIP; it does not upload anything.
57
- - No customer evidence, customer data, or production-readiness claim; all fixtures are public/synthetic.
72
+ - Public/synthetic only; no customer data or customer evidence.
73
+ - Alpha/partial, not counted, no GA or production-readiness claim.
74
+ - No model or network call unless a tool explicitly says so.
75
+ - The exact per-tool boundaries are in the table and `ACCEPTANCE.csv`.
58
76
 
59
77
  ## Public sample
60
78
 
61
- Public/synthetic tarballs and install-log fixtures; `ACCEPTANCE.csv` lists 4 public checks. No customer profile is included.
79
+ Public/synthetic fixtures live in `test/fixtures/`; `ACCEPTANCE.csv` records the public checks with `counted=false`.
62
80
 
63
81
  ## Development
64
82
 
65
83
  ```sh
66
84
  pnpm install --frozen-lockfile
67
- pnpm build && pnpm lint && pnpm typecheck && pnpm test && pnpm gate:sku03
85
+ pnpm build && pnpm lint && pnpm typecheck && pnpm test
68
86
  ```
69
87
 
88
+ ## Family
89
+
90
+ <details>
91
+ <summary>DSH domain plugin family (15 packages + 2 suites)</summary>
92
+
93
+ | Package | npm |
94
+ |---|---|
95
+ | **[dsh-einvoice](https://github.com/PerryLink/dsh-einvoice)** | [npm](https://www.npmjs.com/package/dsh-einvoice) |
96
+ | **[dsh-docx-redline](https://github.com/PerryLink/dsh-docx-redline)** | [npm](https://www.npmjs.com/package/dsh-docx-redline) |
97
+ | **[dsh-policy-ledger](https://github.com/PerryLink/dsh-policy-ledger)** | [npm](https://www.npmjs.com/package/dsh-policy-ledger) |
98
+ | **[dsh-ghg](https://github.com/PerryLink/dsh-ghg)** | [npm](https://www.npmjs.com/package/dsh-ghg) |
99
+ | **[dsh-bankrec](https://github.com/PerryLink/dsh-bankrec)** | [npm](https://www.npmjs.com/package/dsh-bankrec) |
100
+ | **[dsh-ap-three-way](https://github.com/PerryLink/dsh-ap-three-way)** | [npm](https://www.npmjs.com/package/dsh-ap-three-way) |
101
+ | **[dsh-ifc-qto](https://github.com/PerryLink/dsh-ifc-qto)** | [npm](https://www.npmjs.com/package/dsh-ifc-qto) |
102
+ | **[dsh-qms-capa](https://github.com/PerryLink/dsh-qms-capa)** | [npm](https://www.npmjs.com/package/dsh-qms-capa) |
103
+ | **[dsh-legal-intake](https://github.com/PerryLink/dsh-legal-intake)** | [npm](https://www.npmjs.com/package/dsh-legal-intake) |
104
+ | **[dsh-legal-clause](https://github.com/PerryLink/dsh-legal-clause)** | [npm](https://www.npmjs.com/package/dsh-legal-clause) |
105
+ | **[dsh-freight-audit](https://github.com/PerryLink/dsh-freight-audit)** | [npm](https://www.npmjs.com/package/dsh-freight-audit) |
106
+ | **[dsh-hs-candidate](https://github.com/PerryLink/dsh-hs-candidate)** | [npm](https://www.npmjs.com/package/dsh-hs-candidate) |
107
+ | **[dsh-travel-recon](https://github.com/PerryLink/dsh-travel-recon)** | [npm](https://www.npmjs.com/package/dsh-travel-recon) |
108
+ | **[dsh-pim-lint](https://github.com/PerryLink/dsh-pim-lint)** | [npm](https://www.npmjs.com/package/dsh-pim-lint) |
109
+ | **[dsh-eval-pack](https://github.com/PerryLink/dsh-eval-pack)** | [npm](https://www.npmjs.com/package/dsh-eval-pack) |
110
+ | **[dsh-finops-suite](https://github.com/PerryLink/dsh-finops-suite)** | [npm](https://www.npmjs.com/package/dsh-finops-suite) |
111
+ | **[dsh-contract-suite](https://github.com/PerryLink/dsh-contract-suite)** | [npm](https://www.npmjs.com/package/dsh-contract-suite) |
112
+
113
+ </details>
114
+
70
115
  ## License
71
116
 
72
117
  Apache-2.0. See `LICENSE`, `NOTICE`, `THIRD-PARTY-NOTICES`.
@@ -0,0 +1,11 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" width="960" height="240" viewBox="0 0 960 240" role="img" aria-label="dsh-policy-ledger workflow">
2
+ <rect width="960" height="240" rx="18" fill="#0b1020"/>
3
+ <rect x="24" y="24" width="912" height="192" rx="14" fill="#111a2e" stroke="#27314a"/>
4
+ <g><rect x="40" y="56" width="44" height="52" rx="5" fill="none" stroke="#6ea8fe" stroke-width="2"/><path d="M50 68h24M50 76h24M50 84h16" stroke="#6ea8fe" stroke-width="2"/></g>
5
+ <path d="M220 120h100" stroke="#6ea8fe" stroke-width="2" marker-end="url(#a)"/>
6
+ <rect x="330" y="76" width="300" height="88" rx="12" fill="#0b1020" stroke="#6ea8fe"/>
7
+ <text x="480" y="124" text-anchor="middle" fill="#e8edf7" font-family="ui-monospace,monospace" font-size="20" font-weight="700">dsh-policy-ledger</text>
8
+ <path d="M640 120h100" stroke="#6ea8fe" stroke-width="2" marker-end="url(#a)"/>
9
+ <g transform="translate(810,0)"><rect x="46" y="58" width="40" height="46" rx="4" fill="none" stroke="#6ea8fe" stroke-width="2"/><path d="M54 68h24M54 76h24M54 84h18M54 92h12" stroke="#6ea8fe" stroke-width="2"/></g>
10
+ <defs><marker id="a" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="6" markerHeight="6" orient="auto"><path d="M0 0L10 5L0 10z" fill="#6ea8fe"/></marker></defs>
11
+ </svg>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-policy-ledger",
3
- "version": "0.2.0-alpha.3",
3
+ "version": "0.2.0-alpha.5",
4
4
  "description": "Read-only install doctor: capability snapshot, tarball assert and install diagnosis.",
5
5
  "type": "module",
6
6
  "main": "./lib/plugin/index.js",
@@ -21,7 +21,12 @@
21
21
  "README.md",
22
22
  "LICENSE",
23
23
  "NOTICE",
24
- "THIRD-PARTY-NOTICES"
24
+ "THIRD-PARTY-NOTICES",
25
+ "README-zh.md",
26
+ "README-es.md",
27
+ "README-pt.md",
28
+ "README-hi.md",
29
+ "docs/assets"
25
30
  ],
26
31
  "dsh": {
27
32
  "bundle": {