The Ledger Obsidian plugin

What you get

• Sign in with a DosanjhLabs access token, verified against the platform.
• Shared org vault sync — push your vault to / pull it from your team's cloud vault. It uses the same store as the Ledger web app, so they interoperate.
• Doc-review governance — stamp reviewed_on on the current note, and open a report of never-reviewed / stale notes.
• Compliance evidence — publish structural signals (never note bodies) into the shared evidence graph for Sightline.

Install

Until it's listed in Obsidian's Community Plugins directory, install it manually:

1. Get the plugin folder (the obsidian-plugin/ directory from Ledger — it must contain manifest.json and main.js).
2. Copy it into your vault at <your-vault>/.obsidian/plugins/ledger-enterprise/.
3. In Obsidian, go to Settings → Community plugins, and if needed turn off Restricted/Safe mode.
4. Find Ledger — enterprise governance in the installed list and enable it.
5. Open its settings (Settings → Ledger), paste your access token, and click Verify.

There's no build step — Obsidian loads main.js directly. It works on desktop and mobile (the manifest is not desktop-only).

The access token

Because Obsidian can't run the web app's redirect-based sign-in cleanly, the plugin authenticates with a pasted access token (the standard Obsidian-plugin pattern). The token is a long-lived bearer credential for your DosanjhLabs account.

1. Get a token from your DosanjhLabs account (the settings screen links to dosanjhlabs.com/ledger/account).
2. In Settings → Ledger → Access token, paste it (the field is masked).
3. Click Verify to confirm it works.

Verify (sign in)

Verify checks your token and shows who you are.

• Run it from Settings → Ledger → Verify, or from the Command Palette (Ctrl/Cmd+P → "Ledger: Sign in (verify access token)").
• On success, the status bar shows Ledger ✓ <your org> and a notice confirms your email and org.
• On failure, the status bar shows Ledger: sign-in failed with the error. See Sign-in failed.

The plugin re-verifies quietly on load if a token is present, so your status bar reflects sign-in state automatically.

The commands

All commands live in the Command Palette (Ctrl/Cmd+P, type "Ledger"). There's also a ribbon icon (book) for one-click push.

Push / Pull org vault — the model

The plugin's sync is a whole-vault push and a non-destructive pull:

• Push builds a KB object from your vault — for each note, its title (from frontmatter or filename), folder, tags, and body — and stores it under the same kb-state key the web app uses. That's why the web app and plugin share one org vault.
• Pull reads that org vault and writes notes back into your Obsidian vault: it updates a note only if the content differs, creates a note (and any needed folders) if it's missing, and never deletes a note that isn't in the cloud. You'll get a notice like "pulled 4 note(s) (2 already current). Nothing deleted."

Compared with the browser folder sync, the plugin's pull is intentionally simpler and safer (no deletes), and it talks to the cloud org vault rather than to a local folder.

Governance inside Obsidian

• Mark reviewed stamps reviewed_on: <today> into the current note's frontmatter — the same field the web app reads.
• Governance report reads owner and reviewed_on from every note's frontmatter and classifies each as fresh, stale (older than your stale threshold), or never reviewed, with counts at the top. It shows up to 200 notes; click any to open it.

Publish evidence

The same compliance evidence the web app emits, from inside Obsidian. It sends structural signals only — for each note, path, title, type, tags, reviewed_on, host; plus page counts and your org name; with secrets: none-stored. Note bodies are never sent.

Settings reference

Security & privacy of the token

• Your token is stored only in this vault's local plugin data (.obsidian/plugins/ledger-enterprise/data.json) — never inside a note, never logged. Treat that vault folder as sensitive.
• Never paste the token into a note, and never put secrets in notes — credential notes should link a password manager item.
• Network goes through Obsidian's requestUrl (so no browser CORS issues) to api.dosanjhlabs.com with the token as a bearer. The tenant is always derived server-side from your verified token — the client can't act as another organization.
• If a token is lost or compromised, revoke it in your DosanjhLabs account and paste a new one.

Related topics

• Browser folder sync
• The shared org vault & cloud tier
• Security & privacy