[cfi-dkgv10-r1] Add OriginTrail DKG for Obsidian

[jakepel03]

What this PR does

Adds OriginTrail DKG for Obsidian (obsidian-dkg) as a community integration — an Obsidian plugin that syncs a local-first Markdown vault into a local DKG v10 node. Notes are private in Working Memory by default and shared per-note or per-folder into collaborative projects (Shared Memory). DKG v10 Round 1 submission (cfi-dkgv10-r1).

Integration links

• Repo: https://github.com/jakepel03/obsidian-dkg-plugin
• Commit pinned: c935e06481bf83bd45356346ca8f6d6a38c1a3ef
• Published package: n/a — distributed as an Obsidian plugin (prebuilt main.js / manifest.json / styles.css committed to the repo); install.kind: manual.
• Design brief: https://github.com/jakepel03/obsidian-dkg-plugin/blob/main/docs/DESIGN_BRIEF.md
• Demo (recorded walkthrough): https://youtu.be/3zPkJOdnC38

Scope & faithfulness

• Integration uses only the supported public interfaces (HTTP API). It does not import internal DKG packages, patch node source, or write to SPARQL directly (bypassing the assertion lifecycle / Curator).
• memoryLayers correctly reflects which layer(s) the integration touches — WM by default; SWM only on an explicit per-note/per-folder share.
• v10PrimitivesUsed correctly reflects which primitives are exercised (ContextGraph, Assertion, Entity, Curator, UAL).
• Terminology matches the v10 vocabulary (Context Graph, Assertion, Curator, Entity, WM/SWM/VM, SHARE). The UI uses end-user words (project / share / private) mapped 1:1 to the v10 terms in the design brief.

Security declarations (Section 8a)

• security.networkEgress is empty — the plugin only contacts the local DKG node (default http://127.0.0.1:9200).
• security.writeAuthority lists every DKG write. The only Curator-authority SHARE — POST /api/knowledge-assets/{name}/swm/share (WM→SWM) — is called out explicitly and runs only on an explicit user share, never automatically. Membership ops (approve-join / reject-join / add / remove participant) are Curator-authority and run only when the user manages their own project.
• security.credentialsHandled is empty — the DKG auth token is entered in plugin settings, stored only in the vault's local plugin data, and sent only as a Bearer header to the local node.
• No preinstall / install / postinstall scripts — distributed as an Obsidian plugin (committed build artifacts), not an npm/docker package.
• npm provenance N/A — not an npm package (install.kind: manual).
• The pinned git SHA is the exact main commit this entry represents (built main.js is committed; CI gates drift from source).

Contributor attestation

• This integration is my own work, MIT-licensed.
• It contains no intentional backdoors, malicious logic, or data-exfiltration paths beyond what is declared in security.networkEgress (which is empty).
• I understand that the integration may be delisted for any material misrepresentation in the registry entry.
• I commit to a minimum 6-month maintenance window post-acceptance.

Notes for the committee

What it is. The human-authoring on-ramp to the DKG: an Obsidian plugin (not an agent/CLI/MCP tool) that brings the place where people already write into the WM/SWM substrate. Round 1 scope is a clean fit — Working Memory by default, Shared Memory on explicit share, no Verified Memory.

Distinctness (per §10). Existing entries write the substrate from the agent side (cursor-mcp-dkg, claude-code-memory, langchain-dkg, github-dkg, dkg-wm-bridge). This is the only end-user GUI / human-authoring surface, targeting the large existing Obsidian PKM community: it resolves [[wikilinks]] to real assertion URIs, writes schema:mentions / schema:name triples so a vault becomes a connected graph, and exposes a per-note/per-folder privacy gradient mapped onto WM→SWM.

Verification. Verified end-to-end against a local two-node DKG v10 setup (rc.18): connect → import to WM → enrich → create project → share to SWM → a second node subscribes and receives the gossiped triples. The plugin's CI (lint + build + tests + main.js drift gate) is green at the pinned commit. One honest caveat: unsharing or deleting a note cleans your own node, but a copy already gossiped to a peer ages out only via the Shared-Memory TTL (~30 days), surfaced to the user on unshare.

Submission tag: cfi-dkgv10-r1