dsh-policy-ledger
Verifieddsh-policy-ledger · v0.2.0-alpha.14 · Apache-2.0
Read-only install doctor: capability snapshot, tarball assert and install diagnosis.
Install
dsh plugin add dsh-policy-ledger Confirm the layer applied with dsh --profile default --dump-config — see the install guide.
Source
Tags
Readme
dsh-policy-ledger
Official repository. The only official repository of this package, maintained by PerryLink. Same-name repositories under other accounts are not affiliated. Apache-2.0.
Status: KEEP — install-only companion. Not a duplicate of
dsh-plugin-doctor: this answers "what is installed, what does the tarball contain, why did the install fail?" with a read-only capability snapshot, tarball assertions and install-log diagnosis.dsh-plugin-doctordoes package-structure, cordis and sandbox-smoke checks. Use both when you need both questions answered.
Read-only install doctor: capability snapshot, tarball assert and install diagnosis.
Status: alpha / public-synthetic / partial / not counted / not GA. No customer evidence, customer data, or production-readiness claim.
English · 简体中文 · Español · Português · हिन्दी
dsh plugin --profile <profile> add dsh-policy-ledger
⭐ If this helps, a star makes it easier for the next person to find it. Nothing is gated behind it.
Workflow: local input → plugin → local output. No model call is required.
Real local test run; no model or network call.
Install
Install and verify:
dsh plugin --profile <profile> add dsh-policy-ledger
dsh --profile <profile> --dump-config | grep dsh-policy-ledger
Uninstall:
dsh plugin --profile <profile> remove dsh-policy-ledger
Install channels
npm is the recommended channel; the others are for pinning or offline use.
- npm (recommended):
dsh plugin --profile <profile> add dsh-policy-ledger - git channel:
dsh plugin --profile <profile> add github:PerryLink/dsh-policy-ledger - tarball:
pnpm packthendsh plugin --profile <profile> add ./dsh-policy-ledger-<version>.tgz - 1024 store:
npm i -g dsh1024thendsh1024 plugin --profile <profile> add dsh-policy-ledger
What it does
Read-only install doctor: capability snapshot, tarball assert and install diagnosis. Runs locally on DeepSeek Harness. The table below is the exact tool surface; the examples use the real command surface.
Input and output stay local; nothing is uploaded.
Tools
Tool names and descriptions are kept in English to match the runtime output.
| Tool | Purpose | Risk |
|---|---|---|
trust.capability_snapshot |
Extract declared capabilities and R0–R3 risk from a local npm .tgz: tools, bundle/client/bin/skill, build scripts, outbound hosts, credential references |
R0 local read |
trust.diff |
Compare two stored snapshots: added/removed capabilities, risk escalation, blockers | R0 |
trust.assert_tarball |
Re-read a tarball and compare it with a stored snapshot: pass/missing/extra/changed/unknown | R0 |
install.diagnose |
Classify an install log into stage, root cause and three actions; return unknown rather than guess | R0 |
install.probe |
Check disk free, write permission, proxy, optional registry RTT, node/pnpm | R0 |
install.bundle |
Write a redacted incident ZIP (diagnosis + evidence lines) | R1 local write |
Quick start
dsh plugin --profile <profile> add dsh-policy-ledger
dsh --profile <profile> --dump-config | grep dsh-policy-ledger
Examples
Fixture-backed example
Input: ACCEPTANCE.csv
Command: pnpm test
Acceptance row:
| req_id | metric | threshold | actual | pass | source | counted |
|---|---|---|---|---|---|---|
| SKU-03-A01 | 能力快照抽取（3 包） | 3/3 | 3 | true | public/synthetic | false |
This is a fixture-backed acceptance row, not a customer run; no output is invented.
Limits
- Public/synthetic only; no customer data or customer evidence.
- Alpha/partial, not counted, no GA or production-readiness claim.
- No model or network call unless a tool explicitly says so.
- The exact per-tool boundaries are in the table and
ACCEPTANCE.csv.
Public sample
Public/synthetic fixtures live in fixtures/; ACCEPTANCE.csv records the public checks with counted=false.
Development
pnpm install --frozen-lockfile
pnpm build && pnpm lint && pnpm typecheck && pnpm test
Compatibility
| Surface | Status |
|---|---|
| Harness | dsh >=0.2.1-rc.3 <0.3.0 |
| Node | >=24.9.0 <25 |
| Platforms | All; local files only |
| Data | No network, no model call, no upload |
Permissions & data
- Runs locally; no network, no model call, no upload.
- Public/synthetic fixtures only; no customer data, no customer evidence.
- Alpha/partial; not counted, no GA or production-readiness claim.
Related work
Sibling packages and family indexes: dsh-pim-lint · dsh-eval-pack
Related tools
Each entry is a separate package with its own tool surface and version; install only the ones you need.
| Package | Why it is relevant |
|---|---|
dsh-plugin-doctor |
Package structure, Cordis wiring and sandbox smoke checks. |
dsh-plugin-kit |
Plugin authoring and scaffolding kit. |
Family
DSH domain plugin family (15 packages + 2 suites)
Mainline family — 92 current install specs
License
Apache-2.0. See LICENSE, NOTICE, THIRD-PARTY-NOTICES.