feat(dlp-phase1): add policy-based incident pipeline and capability gap analysis

windows/deploy-single-user.ps1

@@ -15,7 +15,8 @@ param(
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
-    [string]$CustomRulesPath
+    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath
 )
 
 Set-StrictMode -Version Latest
@@ -34,6 +35,7 @@ $launchScriptPath = Join-Path $StateRoot 'launch-watchers.ps1'
 $recoveryScriptPath = Join-Path $StateRoot 'recovery-loop.ps1'
 $collectorSource = Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1'
 $exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
+$examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
 
 New-ActivityWatchDirectory -Path $StateRoot
 New-ActivityWatchDirectory -Path $logsRoot
@@ -42,7 +44,13 @@ $archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -Package
 Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $InstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null
 Get-ActivityWatchExecutableMap -InstallRoot $InstallRoot | Out-Null
 
-$assetResult = Copy-ActivityWatchCollectorAssets -CollectorScriptSource $collectorSource -ExampleRulesSource $exampleRulesSource -StateRoot $StateRoot -CustomRulesSource $CustomRulesPath
+$assetResult = Copy-ActivityWatchCollectorAssets `
+    -CollectorScriptSource $collectorSource `
+    -ExampleRulesSource $exampleRulesSource `
+    -ExamplePolicySource $examplePolicySource `
+    -StateRoot $StateRoot `
+    -CustomRulesSource $CustomRulesPath `
+    -CustomPolicySource $CustomPolicyPath
 $taskDefinitions = New-ActivityWatchUserTaskDefinitions -Users @($TargetUser)
 
 Write-ActivityWatchLaunchScript -Path $launchScriptPath -ConfigPath $configPath
@@ -57,6 +65,7 @@ $config = New-ActivityWatchDeploymentConfig `
     -LogsRoot $logsRoot `
     -CollectorScript $assetResult.CollectorScript `
     -RulesPath $assetResult.ActiveRules `
+    -PolicyPath $assetResult.ActivePolicy `
     -PollSeconds $PollSeconds `
     -PulseSeconds $PulseSeconds `
     -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
@@ -77,3 +86,4 @@ Write-Host "Server: $ServerScheme://$ServerHost`:$ServerPort"
 Write-Host "Install root: $InstallRoot"
 Write-Host "State root: $StateRoot"
 Write-Host "Rules file: $($assetResult.ActiveRules)"
+Write-Host "Policy file: $($assetResult.ActivePolicy)"