DobermanCore/Doberman-Core

docs/CLI.md covers every registered command except two: doberman plugins and doberman policy-file don't appear at all. What to do Add a section for each, in the same shape as the others (what it does, its options, an example). Add a test that walks the registered commands the way tests/unit/test_cli_help.py:116 already does and asserts every non-hidden command appears in docs/CLI.md. It fails today on exactly those two, and it keeps the doc from drifting again.

setup, install-hooks, uninstall-hooks and uninstall all have --dry-run. decision-log-prune (src/doberman/cli/main.py:3055-3088) deletes audit rows with no way to preview how many. What to do Add dry_run to prune_decisions (src/doberman/storage/log.py:459-480): run the same deletes, count the rows, then conn.rollback() instead of committing. Add --dry-run to the command and print Would prune N row(s) (A by age, B over --max-rows). The delete predicate doesn't change, so pending AUTH rows are still never counted. Test (next to the prune tests in tests/integration/test_decision_log.py): the dry-run count matches what a real prune then removes, and the row count is unchanged after the dry run.

doberman plugins enable no_such_plugin succeeds, since plugin_config.enable (src/doberman/engine/plugin_config.py:130) only checks the name's format. After that nothing mentions that no installed package provides it, and doberman doctor has no plugin row (src/doberman/cli/doctor.py:584-601). What to do: add a non-critical "Plugins" check to run_checks that compares the enabled names with the installed entry points and shows [warn] enabled but not installed: <name>. Find installed names through _iter_entry_points only. The check must never import or load a plugin. Test (tests/unit/test_cli_doctor.py): enable a made-up name (point DOBERMAN_PLUGINS_FILE at tmp_path so the real config isn't touched) and assert the warn row. With nothing enabled the row passes. Stretch: plugins enable prints the same warning to stderr when the name matches nothing installed. This is separate from #638, which is about the allowlist trusting a name under every entry-point group.

docs/CLI.md promises every --json document is compact (CLI.md:109-119), and #431 fixed the same drift for tune. doberman policy-versions --show <id> --json still prints with indent=2 (src/doberman/cli/main.py:3052), because _policy_versions_show never receives as_json. What to do: pass as_json into _policy_versions_show and print compact, sorted JSON when it's set. The human view without --json keeps its indentation. Test: --show <id> --json prints one line that parses, and running it twice gives identical bytes. Stretch: one parametrized test that checks the CLI.md guarantees (parses, compact, sorted, identical on a rerun) across the --json modes of status, scan, doctor, policy-history, policy-versions and tune, so the next one can't drift.

doberman message-tone bogus prints: error: unknown message tone 'bogus'; choose one of ('human', 'technical') The tuple comes from formatting MESSAGE_TONES straight into the f-string at src/doberman/config.py:429. Sibling errors print a plain list (valid modes: light, balanced, …). What to do: join the names so it reads choose one of: human, technical. Test (tests/unit/test_message_tone.py): the error lists both tones and doesn't contain ('.