Observability for DeepSeek Harness (dsh)

Key features

• This plugin ships no redaction rules.
• With no waterfall listener mounted, records reach the exporter exactly as captured, so a deployment exporting beyond a trusted boundary mounts its own rules.
• Provider API keys are structurally absent: adapter credentials are constructor parameters, never session events, so they never enter the session log and therefore never reach telemetry.
• Serialized payloads are clipped at maxAttributeChars per attribute
• the canonical log keeps the full bytes.