dsh-hazplan-check 0.0.0-stage → 0.2.1

package/LICENSE

@@ -0,0 +1,15 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README-es.md

@@ -0,0 +1,106 @@
+# dsh-hazplan-check
+
+**Boundary:** this plugin checks one **HAZOP worksheet** for what a sheet can be held to — that every row
+records the analysis content your template requires, that each 偏差 actually follows from the 工艺参数 and
+引导词 beside it, that risk levels come from your own vocabulary, that every node has rows, and that
+recommendations carry their closure fields. It does **not** judge whether the causes are complete, whether
+the consequences are analysed far enough, whether the safeguards are adequate, or whether a risk rating is
+correct. **Those four judgements are the study team's, and they are where HAZOP's value lies.**
+
+> ### ⚠️ Nothing here is `error`, and the clause wording is why
+>
+> **GB/T 35320-2017《危险与可操作性分析（HAZOP分析）应用指南》** is in force (published and effective
+> 2017-12-29, identical to IEC 61882:2001), and its clause text was obtained verbatim.
+>
+> **The standard is a *recommended* one (the number carries "/T"), and every clause this pack cites uses
+> 宜 — "should" — not 应.** That applies to the two clauses an earlier version of this pack rated as
+> `error`: **6.6.4** reads 「每一个危险和可操作性性问题都**宜**作为单项记录」 and **6.6.3** opens
+> 「HAZOP 分析输出**宜**包括：」. **A recommendation cannot support an error rating**, so both rules are
+> now `warn` and **this plugin reports no error at all** — consistent with how the family treats every
+> other recommended standard. A test pins this so a later edit cannot quietly re-escalate one.
+>
+> **Everything else is capped at `warn` or `info`, for three reasons the pack records:**
+>
+> 1. **Appendix A.2 — the one place a column list appears — is a 资料性附录.** Its wording is "表列的标题
+>    **可为**以下各项", it adds "**也可记录**其他信息", and it says outright that "工作表的版面设计**各有不同**".
+>    **There is no mandatory column list**, so a missing column can only ever be a suggestion.
+> 2. **Clause 4.2 gives no criterion for node granularity.** It says the size of a node "取决于系统的
+>    复杂性和危险的严重程度" and nothing quantitative follows. This plugin **does not** judge node size.
+> 3. **The standard fixes no risk-level scale.** 6.5 mentions a risk matrix as useful and defers the method
+>    to IEC 60300-3-9; GB/T 27921-2023's matrix description is likewise informative. Levels must come from
+>    your own risk criteria, so the vocabulary ships **empty**.
+>
+> Two further honesty notes are in the pack. The guide-word vocabulary uses the standard's own wording —
+> **「相反」, not the colloquial "相逆"** — and combines table 1 with table 2; a custom guide word is
+> **not** non-compliant, because 6.4.3 permits one "只要在分析开始前进行了定义". And **SH/T 3240-2025**
+> (the petrochemical HAZOP specification, in force 2025-11-01) had only its identity, status and glossary
+> verified — **its clause text was not obtained, so this pack cites none of it**.
+>
+> The four judgements this plugin does not make: whether the causes are complete, whether the consequences
+> are analysed far enough, whether the safeguards are adequate, whether a risk rating is correct.
+
+## Compatibility
+
+| Superficie | Estado |
+|---|---|
+| Harness | Rango de peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verificado para aceptar tanto `0.2.0-rc.2` como `0.2.1-alpha.1`. **No se declara `engines.dsh`**: no tiene lector y no puede rechazar ningún host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Plataformas | Todas (ESM puro; sin código nativo, sin red, sin llamada al modelo) |
+| Modo de herramienta | Funciona en `native`, `ptc` y `both`; para un directorio completo use `ptc` |
+
+## What it does
+
+La tabla de reglas, los campos y el comportamiento detallado están en [README.md](README.md#what-it-does) (versión principal en inglés). El plugin sólo enumera divergencias literales frente a las cláusulas citadas e indica en `skipped` cada comprobación que no pudo ejecutarse.
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-hazplan-check
+dsh --profile <name> --dump-config | grep 'dsh-hazplan-check'
+```
+
+## Configuration
+
+Todos los parámetros ajustables viven en el esquema Schemastery de `src/config.ts`, por lo que se cambian desde `cordis.yml` sin tocar el código; los umbrales por regla están en el paquete de reglas bajo `rules/`.
+
+| Clave | Tipo | Predeterminado | Descripción |
+|---|---|---|---|
+| `rulesFile` | string | `rules/hazplan-check.yaml` | Ruta del paquete de reglas, relativa a la raíz del paquete |
+| `disabledRules` | string[] | `[]` | Ids de reglas que se dejan de ejecutar; cada una aparece en `skipped` |
+| `onlyRules` | string[] | `[]` | Ejecutar solo estas reglas; vacío ejecuta todas |
+| `skipNotes` | string | `""` | Nota añadida a cada motivo de `skipped` |
+| `timeoutMs` | number | `120000` | Presupuesto de tiempo de espera cooperativo de la herramienta |
+
+## Material format
+
+Acepta JSON o YAML. El ejemplo completo de campos está en [README.md](README.md#material-format) (versión principal en inglés). Los campos son opcionales en la capa de lectura y los valida el motor, de modo que una exportación parcial produce hallazgos sobre lo que falta en lugar de un fallo.
+
+## Rule sources
+
+Los datos de las reglas están separados del código: cada regla lleva documento, número, cláusula en la numeración propia de la fuente, extracto literal y URL de origen. El cargador impone que el extracto sea una cita real de al menos ocho caracteres y que una comprobación basada sólo en un principio general (`kind: derived-from-principle`, tope `warn`) o en una política local (`kind: institutional-configuration`, tope `info`) nunca se declare `error`.
+
+Los límites verificados y las conclusiones deliberadamente **no** afirmadas están en [README.md](README.md#rule-sources) (versión principal en inglés) y en `rules/evidence/`.
+
+## Troubleshooting
+
+- **El plugin se instala pero la herramienta no aparece**: compruebe que `main` resuelve a `lib/index.mjs` y que `pnpm run build` lo generó.
+- **`dsh plugin add` rechaza el paquete**: la faixa de peers cubre `0.1.x` y `0.2.x`; fuera de ella, conceda una exención explícita con `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`.
+- **Una regla no se ejecutó**: lea el arreglo `skipped`.
+- **`check` informa `manifest-peers` como fallo**: es un problema conocido de `dsh-plugin-dev`; el runtime aplica la compatibilidad al instalar.
+- **Los horarios parecen desplazados**: toda la aritmética es de hora local sobre las cadenas entregadas.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-hazplan-check
+```
+
+El último comando copia el kit compartido de `../_shared` a `src/shared/`; vuelva a ejecutarlo tras cada cambio compartido.
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-hazplan-check contributors.

package/README-hi.md

@@ -0,0 +1,106 @@
+# dsh-hazplan-check
+
+**Boundary:** this plugin checks one **HAZOP worksheet** for what a sheet can be held to — that every row
+records the analysis content your template requires, that each 偏差 actually follows from the 工艺参数 and
+引导词 beside it, that risk levels come from your own vocabulary, that every node has rows, and that
+recommendations carry their closure fields. It does **not** judge whether the causes are complete, whether
+the consequences are analysed far enough, whether the safeguards are adequate, or whether a risk rating is
+correct. **Those four judgements are the study team's, and they are where HAZOP's value lies.**
+
+> ### ⚠️ Nothing here is `error`, and the clause wording is why
+>
+> **GB/T 35320-2017《危险与可操作性分析（HAZOP分析）应用指南》** is in force (published and effective
+> 2017-12-29, identical to IEC 61882:2001), and its clause text was obtained verbatim.
+>
+> **The standard is a *recommended* one (the number carries "/T"), and every clause this pack cites uses
+> 宜 — "should" — not 应.** That applies to the two clauses an earlier version of this pack rated as
+> `error`: **6.6.4** reads 「每一个危险和可操作性性问题都**宜**作为单项记录」 and **6.6.3** opens
+> 「HAZOP 分析输出**宜**包括：」. **A recommendation cannot support an error rating**, so both rules are
+> now `warn` and **this plugin reports no error at all** — consistent with how the family treats every
+> other recommended standard. A test pins this so a later edit cannot quietly re-escalate one.
+>
+> **Everything else is capped at `warn` or `info`, for three reasons the pack records:**
+>
+> 1. **Appendix A.2 — the one place a column list appears — is a 资料性附录.** Its wording is "表列的标题
+>    **可为**以下各项", it adds "**也可记录**其他信息", and it says outright that "工作表的版面设计**各有不同**".
+>    **There is no mandatory column list**, so a missing column can only ever be a suggestion.
+> 2. **Clause 4.2 gives no criterion for node granularity.** It says the size of a node "取决于系统的
+>    复杂性和危险的严重程度" and nothing quantitative follows. This plugin **does not** judge node size.
+> 3. **The standard fixes no risk-level scale.** 6.5 mentions a risk matrix as useful and defers the method
+>    to IEC 60300-3-9; GB/T 27921-2023's matrix description is likewise informative. Levels must come from
+>    your own risk criteria, so the vocabulary ships **empty**.
+>
+> Two further honesty notes are in the pack. The guide-word vocabulary uses the standard's own wording —
+> **「相反」, not the colloquial "相逆"** — and combines table 1 with table 2; a custom guide word is
+> **not** non-compliant, because 6.4.3 permits one "只要在分析开始前进行了定义". And **SH/T 3240-2025**
+> (the petrochemical HAZOP specification, in force 2025-11-01) had only its identity, status and glossary
+> verified — **its clause text was not obtained, so this pack cites none of it**.
+>
+> The four judgements this plugin does not make: whether the causes are complete, whether the consequences
+> are analysed far enough, whether the safeguards are adequate, whether a risk rating is correct.
+
+## Compatibility
+
+| सतह | स्थिति |
+|---|---|
+| Harness | peer रेंज `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — `0.2.0-rc.2` और `0.2.1-alpha.1` दोनों को स्वीकार करने के लिए सत्यापित। **`engines.dsh` जानबूझकर घोषित नहीं**: इसका कोई पाठक नहीं और यह किसी होस्ट को अस्वीकार नहीं कर सकता |
+| Node | `^22.19.0 || >=24.0.0` |
+| प्लेटफ़ॉर्म | सभी (शुद्ध ESM; कोई नेटिव कोड नहीं, कोई नेटवर्क नहीं, कोई मॉडल कॉल नहीं) |
+| टूल मोड | `native`, `ptc` और `both` में काम करता है; पूरे फ़ोल्डर के लिए `ptc` चुनें |
+
+## What it does
+
+नियम-सूची, फ़ील्ड और विस्तृत व्यवहार [README.md](README.md#what-it-does) (अंग्रेज़ी मुख्य संस्करण) में हैं। यह प्लगइन केवल उद्धृत धाराओं के सामने शाब्दिक अंतर सूचीबद्ध करता है और हर न चल पाई जाँच को `skipped` में बताता है।
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-hazplan-check
+dsh --profile <name> --dump-config | grep 'dsh-hazplan-check'
+```
+
+## Configuration
+
+सभी समायोज्य पैरामीटर `src/config.ts` की Schemastery स्कीमा में हैं, इसलिए कोड बदले बिना `cordis.yml` से बदले जा सकते हैं; प्रति-नियम सीमाएँ `rules/` के नियम-पैक में हैं।
+
+| कुंजी | प्रकार | डिफ़ॉल्ट | विवरण |
+|---|---|---|---|
+| `rulesFile` | string | `rules/hazplan-check.yaml` | नियम-पैक का पथ, पैकेज रूट के सापेक्ष |
+| `disabledRules` | string[] | `[]` | बंद करने वाले नियम id; प्रत्येक `skipped` में दिखता है |
+| `onlyRules` | string[] | `[]` | केवल ये नियम चलाएँ; खाली होने पर सभी नियम चलते हैं |
+| `skipNotes` | string | `""` | हर `skipped` कारण के आगे जोड़ी जाने वाली टिप्पणी |
+| `timeoutMs` | number | `120000` | उपकरण का सहकारी समय-सीमा बजट |
+
+## Material format
+
+JSON या YAML स्वीकार्य है। पूरा फ़ील्ड उदाहरण [README.md](README.md#material-format) (अंग्रेज़ी मुख्य संस्करण) में है। पढ़ने की परत में फ़ील्ड वैकल्पिक हैं और जाँच इंजन उन्हें सत्यापित करता है, इसलिए आंशिक निर्यात पर क्रैश के बजाय "अनुपस्थित" श्रेणी के निष्कर्ष मिलते हैं।
+
+## Rule sources
+
+नियम-डेटा कोड से अलग है: प्रत्येक नियम में दस्तावेज़, संख्या, स्रोत की अपनी क्रमांकन-प्रणाली के अनुसार धारा, शब्दशः उद्धरण और स्रोत URL होता है। लोडर लागू करता है कि उद्धरण कम से कम आठ अक्षरों का वास्तविक उद्धरण हो, और जिस जाँच का आधार केवल सामान्य सिद्धांत (`kind: derived-from-principle`, अधिकतम `warn`) या स्थानीय नीति (`kind: institutional-configuration`, अधिकतम `info`) हो, उसे कभी `error` घोषित न किया जाए।
+
+सत्यापित सीमाएँ और जान-बूझकर **न** कहे गए निष्कर्ष [README.md](README.md#rule-sources) (अंग्रेज़ी मुख्य संस्करण) और `rules/evidence/` में हैं।
+
+## Troubleshooting
+
+- **प्लगइन इंस्टॉल हो गया पर टूल दिखता नहीं**: जाँचें कि `main` `lib/index.mjs` पर जाता है और `pnpm run build` ने उसे बनाया है।
+- **`dsh plugin add` असंगत बताकर मना करता है**: peer range `0.1.x` और `0.2.x` दोनों को कवर करती है; बाहर होने पर स्पष्ट छूट दें: `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`।
+- **कोई नियम नहीं चला**: `skipped` सरणी देखें।
+- **`check` में `manifest-peers` विफल दिखता है**: यह `dsh-plugin-dev` की ज्ञात अपस्ट्रीम समस्या है; रनटाइम इंस्टॉल के समय अनुकूलता लागू करता है।
+- **समय खिसका हुआ लगता है**: सारी गणना दिए गए स्ट्रिंग पर वॉल-क्लॉक है।
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-hazplan-check
+```
+
+अंतिम कमांड `../_shared` का साझा किट `src/shared/` में कॉपी करता है; हर साझा बदलाव के बाद इसे दोबारा चलाएँ।
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-hazplan-check contributors.

package/README-pt.md

@@ -0,0 +1,106 @@
+# dsh-hazplan-check
+
+**Boundary:** this plugin checks one **HAZOP worksheet** for what a sheet can be held to — that every row
+records the analysis content your template requires, that each 偏差 actually follows from the 工艺参数 and
+引导词 beside it, that risk levels come from your own vocabulary, that every node has rows, and that
+recommendations carry their closure fields. It does **not** judge whether the causes are complete, whether
+the consequences are analysed far enough, whether the safeguards are adequate, or whether a risk rating is
+correct. **Those four judgements are the study team's, and they are where HAZOP's value lies.**
+
+> ### ⚠️ Nothing here is `error`, and the clause wording is why
+>
+> **GB/T 35320-2017《危险与可操作性分析（HAZOP分析）应用指南》** is in force (published and effective
+> 2017-12-29, identical to IEC 61882:2001), and its clause text was obtained verbatim.
+>
+> **The standard is a *recommended* one (the number carries "/T"), and every clause this pack cites uses
+> 宜 — "should" — not 应.** That applies to the two clauses an earlier version of this pack rated as
+> `error`: **6.6.4** reads 「每一个危险和可操作性性问题都**宜**作为单项记录」 and **6.6.3** opens
+> 「HAZOP 分析输出**宜**包括：」. **A recommendation cannot support an error rating**, so both rules are
+> now `warn` and **this plugin reports no error at all** — consistent with how the family treats every
+> other recommended standard. A test pins this so a later edit cannot quietly re-escalate one.
+>
+> **Everything else is capped at `warn` or `info`, for three reasons the pack records:**
+>
+> 1. **Appendix A.2 — the one place a column list appears — is a 资料性附录.** Its wording is "表列的标题
+>    **可为**以下各项", it adds "**也可记录**其他信息", and it says outright that "工作表的版面设计**各有不同**".
+>    **There is no mandatory column list**, so a missing column can only ever be a suggestion.
+> 2. **Clause 4.2 gives no criterion for node granularity.** It says the size of a node "取决于系统的
+>    复杂性和危险的严重程度" and nothing quantitative follows. This plugin **does not** judge node size.
+> 3. **The standard fixes no risk-level scale.** 6.5 mentions a risk matrix as useful and defers the method
+>    to IEC 60300-3-9; GB/T 27921-2023's matrix description is likewise informative. Levels must come from
+>    your own risk criteria, so the vocabulary ships **empty**.
+>
+> Two further honesty notes are in the pack. The guide-word vocabulary uses the standard's own wording —
+> **「相反」, not the colloquial "相逆"** — and combines table 1 with table 2; a custom guide word is
+> **not** non-compliant, because 6.4.3 permits one "只要在分析开始前进行了定义". And **SH/T 3240-2025**
+> (the petrochemical HAZOP specification, in force 2025-11-01) had only its identity, status and glossary
+> verified — **its clause text was not obtained, so this pack cites none of it**.
+>
+> The four judgements this plugin does not make: whether the causes are complete, whether the consequences
+> are analysed far enough, whether the safeguards are adequate, whether a risk rating is correct.
+
+## Compatibility
+
+| Superfície | Estado |
+|---|---|
+| Harness | Faixa de peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verificada para aceitar tanto `0.2.0-rc.2` quanto `0.2.1-alpha.1`. **`engines.dsh` não é declarado**: não tem leitor e não pode recusar nenhum host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Plataformas | Todas (ESM puro; sem código nativo, sem rede, sem chamada ao modelo) |
+| Modo de ferramenta | Funciona em `native`, `ptc` e `both`; para um diretório inteiro use `ptc` |
+
+## What it does
+
+A tabela de regras, os campos e o comportamento detalhado estão em [README.md](README.md#what-it-does) (versão principal em inglês). O plugin apenas lista divergências literais frente às cláusulas citadas e indica em `skipped` cada verificação que não pôde ser executada.
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-hazplan-check
+dsh --profile <name> --dump-config | grep 'dsh-hazplan-check'
+```
+
+## Configuration
+
+Todos os parâmetros ajustáveis ficam no esquema Schemastery de `src/config.ts`, portanto mudam pelo `cordis.yml` sem editar código; os limites por regra ficam no pacote de regras sob `rules/`.
+
+| Chave | Tipo | Padrão | Descrição |
+|---|---|---|---|
+| `rulesFile` | string | `rules/hazplan-check.yaml` | Caminho do pacote de regras, relativo à raiz do pacote |
+| `disabledRules` | string[] | `[]` | Ids de regras a desativar; cada uma aparece em `skipped` |
+| `onlyRules` | string[] | `[]` | Executar apenas estas regras; vazio executa todas |
+| `skipNotes` | string | `""` | Nota acrescentada a cada motivo de `skipped` |
+| `timeoutMs` | number | `120000` | Orçamento de tempo limite cooperativo da ferramenta |
+
+## Material format
+
+Aceita JSON ou YAML. O exemplo completo de campos está em [README.md](README.md#material-format) (versão principal em inglês). Os campos são opcionais na camada de leitura e validados pelo motor, de modo que uma exportação parcial gera achados sobre o que falta em vez de falhar.
+
+## Rule sources
+
+Os dados das regras ficam separados do código: cada regra traz documento, número, cláusula na numeração própria da fonte, trecho literal e URL de origem. O carregador impõe que o trecho seja citação real de pelo menos oito caracteres e que uma verificação baseada apenas em princípio geral (`kind: derived-from-principle`, teto `warn`) ou em política local (`kind: institutional-configuration`, teto `info`) nunca seja declarada `error`.
+
+Os limites verificados e as conclusões deliberadamente **não** afirmadas estão em [README.md](README.md#rule-sources) (versão principal em inglês) e em `rules/evidence/`.
+
+## Troubleshooting
+
+- **O plugin instala mas a ferramenta não aparece**: confirme que `main` resolve para `lib/index.mjs` e que `pnpm run build` o gerou.
+- **`dsh plugin add` recusa o pacote**: a faixa de peers cobre `0.1.x` e `0.2.x`; fora dela, conceda isenção explícita com `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`.
+- **Uma regra não executou**: leia o arranjo `skipped`.
+- **`check` informa `manifest-peers` como falha**: problema conhecido do `dsh-plugin-dev`; o runtime aplica a compatibilidade na instalação.
+- **Os horários parecem deslocados**: toda a aritmética é de hora local sobre as cadeias fornecidas.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-hazplan-check
+```
+
+O último comando copia o kit compartilhado de `../_shared` para `src/shared/`; execute-o novamente após cada alteração compartilhada.
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-hazplan-check contributors.

package/README-zh.md

@@ -0,0 +1,106 @@
+# dsh-hazplan-check
+
+**Boundary:** this plugin checks one **HAZOP worksheet** for what a sheet can be held to — that every row
+records the analysis content your template requires, that each 偏差 actually follows from the 工艺参数 and
+引导词 beside it, that risk levels come from your own vocabulary, that every node has rows, and that
+recommendations carry their closure fields. It does **not** judge whether the causes are complete, whether
+the consequences are analysed far enough, whether the safeguards are adequate, or whether a risk rating is
+correct. **Those four judgements are the study team's, and they are where HAZOP's value lies.**
+
+> ### ⚠️ Nothing here is `error`, and the clause wording is why
+>
+> **GB/T 35320-2017《危险与可操作性分析（HAZOP分析）应用指南》** is in force (published and effective
+> 2017-12-29, identical to IEC 61882:2001), and its clause text was obtained verbatim.
+>
+> **The standard is a *recommended* one (the number carries "/T"), and every clause this pack cites uses
+> 宜 — "should" — not 应.** That applies to the two clauses an earlier version of this pack rated as
+> `error`: **6.6.4** reads 「每一个危险和可操作性性问题都**宜**作为单项记录」 and **6.6.3** opens
+> 「HAZOP 分析输出**宜**包括：」. **A recommendation cannot support an error rating**, so both rules are
+> now `warn` and **this plugin reports no error at all** — consistent with how the family treats every
+> other recommended standard. A test pins this so a later edit cannot quietly re-escalate one.
+>
+> **Everything else is capped at `warn` or `info`, for three reasons the pack records:**
+>
+> 1. **Appendix A.2 — the one place a column list appears — is a 资料性附录.** Its wording is "表列的标题
+>    **可为**以下各项", it adds "**也可记录**其他信息", and it says outright that "工作表的版面设计**各有不同**".
+>    **There is no mandatory column list**, so a missing column can only ever be a suggestion.
+> 2. **Clause 4.2 gives no criterion for node granularity.** It says the size of a node "取决于系统的
+>    复杂性和危险的严重程度" and nothing quantitative follows. This plugin **does not** judge node size.
+> 3. **The standard fixes no risk-level scale.** 6.5 mentions a risk matrix as useful and defers the method
+>    to IEC 60300-3-9; GB/T 27921-2023's matrix description is likewise informative. Levels must come from
+>    your own risk criteria, so the vocabulary ships **empty**.
+>
+> Two further honesty notes are in the pack. The guide-word vocabulary uses the standard's own wording —
+> **「相反」, not the colloquial "相逆"** — and combines table 1 with table 2; a custom guide word is
+> **not** non-compliant, because 6.4.3 permits one "只要在分析开始前进行了定义". And **SH/T 3240-2025**
+> (the petrochemical HAZOP specification, in force 2025-11-01) had only its identity, status and glossary
+> verified — **its clause text was not obtained, so this pack cites none of it**.
+>
+> The four judgements this plugin does not make: whether the causes are complete, whether the consequences
+> are analysed far enough, whether the safeguards are adequate, whether a risk rating is correct.
+
+## Compatibility
+
+| 项目 | 状态 |
+|---|---|
+| Harness | 对等版本范围 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` —— 已实测同时接受 `0.2.0-rc.2` 与 `0.2.1-alpha.1`。**刻意不声明 `engines.dsh`**：它没有任何读取者，也无法拒装任何宿主 |
+| Node | `^22.19.0 || >=24.0.0` |
+| 平台 | 全平台（纯 ESM；无原生代码、无联网、不调用模型） |
+| 工具模式 | `native` / `ptc` / `both` 均可；批量校验整个目录时建议 `ptc`，schema 成本只付一次 |
+
+## What it does
+
+规则表、字段说明与行为细节见 [README.md](README.md#what-it-does)（英文主版本）。本插件只列出材料与所引条款之间的字面差异，并对无法执行的检查在 `skipped` 中逐项说明。
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-hazplan-check
+dsh --profile <name> --dump-config | grep 'dsh-hazplan-check'
+```
+
+## Configuration
+
+全部可调参数都在 `src/config.ts` 的 Schemastery schema 中，只改 `cordis.yml` 即可生效，无需改代码；逐条阈值在 `rules/` 下的规则库文件里。
+
+| 键 | 类型 | 默认值 | 说明 |
+|---|---|---|---|
+| `rulesFile` | string | `rules/hazplan-check.yaml` | 规则库文件路径，相对插件包根目录 |
+| `disabledRules` | string[] | `[]` | 要停用的规则 id 列表；每条都会出现在 `skipped` 中 |
+| `onlyRules` | string[] | `[]` | 只执行这些规则 id；留空表示执行全部规则 |
+| `skipNotes` | string | `""` | 附加到每条 `skipped` 说明后的备注 |
+| `timeoutMs` | number | `120000` | 工具协作式超时预算（毫秒） |
+
+## Material format
+
+支持 JSON 与 YAML。完整字段示例见 [README.md](README.md#material-format)（英文主版本）。字段在读取层是可选的，由检查引擎校验，因此部分导出的材料会产生"缺项"类差异，而不是让程序崩溃。
+
+## Rule sources
+
+规则数据与代码分离，每条规则都带文件名、文号、按原文自身编号体系的条款号、逐字摘录与来源地址。加载期强制：摘录必须是真实引文且不少于八个字符；依据仅为原则性条款（`kind: derived-from-principle`，严重级上限 `warn`）或本机构配置（`kind: institutional-configuration`，上限 `info`）的检查不得标为 `error`。夸大依据的规则库会在加载期失败，而不会产出一份看起来很有底气的报告。
+
+核验中确认的边界与"刻意没有作出的结论"见 [README.md](README.md#rule-sources)（英文主版本）与随包的 `rules/evidence/` 目录。
+
+## Troubleshooting
+
+- **插件装上了但工具不出现**：确认 `main` 指向 `lib/index.mjs` 且 `pnpm run build` 已生成该文件；`main` 写错会让加载器静默跳过该条目。
+- **`dsh plugin add` 报版本不兼容**：peer 范围覆盖 `0.1.x` 与 `0.2.x`；若运行时在其之外，可显式豁免：`dsh plugin --profile <name> allow-version <包名@版本> --dsh-version <runtime> --accept-risk`
+- **某条规则没有执行**：查看 `skipped` 数组，其中写明了规则 id 与原因。
+- **`check` 报 `manifest-peers` 失败**：静态检查器比对的是一份早于 0.2 世代的硬编码 peer 范围；安装期的 peer 校验以运行时为准。这是 `dsh-plugin-dev` 的已知上游问题。
+- **时间看起来偏移**：全部计算都是对输入字符串做墙上时钟运算，不做时区换算。
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-hazplan-check
+```
+
+第 4 项把 `../_shared` 的共享件同步进 `src/shared/`；每次改动共享件后都要重跑。
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-hazplan-check contributors.

package/README.md

@@ -1,3 +1,176 @@
-# Temporary Holding Version
+# dsh-hazplan-check
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Boundary:** this plugin checks one **HAZOP worksheet** for what a sheet can be held to — that every row
+records the analysis content your template requires, that each 偏差 actually follows from the 工艺参数 and
+引导词 beside it, that risk levels come from your own vocabulary, that every node has rows, and that
+recommendations carry their closure fields. It does **not** judge whether the causes are complete, whether
+the consequences are analysed far enough, whether the safeguards are adequate, or whether a risk rating is
+correct. **Those four judgements are the study team's, and they are where HAZOP's value lies.**
+
+> ### ⚠️ Nothing here is `error`, and the clause wording is why
+>
+> **GB/T 35320-2017《危险与可操作性分析（HAZOP分析）应用指南》** is in force (published and effective
+> 2017-12-29, identical to IEC 61882:2001), and its clause text was obtained verbatim.
+>
+> **The standard is a *recommended* one (the number carries "/T"), and every clause this pack cites uses
+> 宜 — "should" — not 应.** That applies to the two clauses an earlier version of this pack rated as
+> `error`: **6.6.4** reads 「每一个危险和可操作性性问题都**宜**作为单项记录」 and **6.6.3** opens
+> 「HAZOP 分析输出**宜**包括：」. **A recommendation cannot support an error rating**, so both rules are
+> now `warn` and **this plugin reports no error at all** — consistent with how the family treats every
+> other recommended standard. A test pins this so a later edit cannot quietly re-escalate one.
+>
+> **Everything else is capped at `warn` or `info`, for three reasons the pack records:**
+>
+> 1. **Appendix A.2 — the one place a column list appears — is a 资料性附录.** Its wording is "表列的标题
+>    **可为**以下各项", it adds "**也可记录**其他信息", and it says outright that "工作表的版面设计**各有不同**".
+>    **There is no mandatory column list**, so a missing column can only ever be a suggestion.
+> 2. **Clause 4.2 gives no criterion for node granularity.** It says the size of a node "取决于系统的
+>    复杂性和危险的严重程度" and nothing quantitative follows. This plugin **does not** judge node size.
+> 3. **The standard fixes no risk-level scale.** 6.5 mentions a risk matrix as useful and defers the method
+>    to IEC 60300-3-9; GB/T 27921-2023's matrix description is likewise informative. Levels must come from
+>    your own risk criteria, so the vocabulary ships **empty**.
+>
+> Two further honesty notes are in the pack. The guide-word vocabulary uses the standard's own wording —
+> **「相反」, not the colloquial "相逆"** — and combines table 1 with table 2; a custom guide word is
+> **not** non-compliant, because 6.4.3 permits one "只要在分析开始前进行了定义". And **SH/T 3240-2025**
+> (the petrochemical HAZOP specification, in force 2025-11-01) had only its identity, status and glossary
+> verified — **its clause text was not obtained, so this pack cites none of it**.
+>
+> The four judgements this plugin does not make: whether the causes are complete, whether the consequences
+> are analysed far enough, whether the safeguards are adequate, whether a risk rating is correct.
+
+## Compatibility
+
+| Surface | Status |
+|---|---|
+| Harness | Peer range `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verified to accept both `0.2.0-rc.2` and `0.2.1-alpha.1`. `engines.dsh` is deliberately not declared: it has no reader and cannot reject a host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Platforms | All (plain ESM; no native code, no network, no model call) |
+| Tool mode | Works in `native`, `ptc` and `both`; for several worksheets use `ptc` |
+
+## What it does
+
+Registers the `hazplan_check` tool. It reads one worksheet — rows keyed by the sheet's own column names,
+in Chinese or English — applies a versioned rule pack, and returns a report.
+
+| Rule | Check | Severity | Basis |
+|---|---|---|---|
+| `HZ-001` | every problem is its own row, with its cause | warn | 6.6.4 |
+| `HZ-002` | every analysed node is recorded on the sheet | warn | 6.6.3 |
+| `HZ-003` | guide words come from table 1 + table 2, or were declared first | warn | 表1、表2 + 6.4.3 |
+| `HZ-004` | the row shows which element the deviation came from | warn | 3.3 + 6.4.3 |
+| `HZ-005` | risk levels come from your risk criteria (off by default) | info | 6.5 + GB/T 27921 |
+| `HZ-006` | the sheet names its analysis subject | warn | 附录A.2（资料性） |
+| `HZ-007` | the deviation is the parameter read through its guide word | warn | 6.4.3 |
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-hazplan-check
+dsh --profile <name> --dump-config | grep 'dsh-hazplan-check'
+```
+
+## Configuration
+
+| Key | Type | Default | Description |
+|---|---|---|---|
+| `rulesFile` | string | `rules/hazplan-check.yaml` | Rule-pack path, relative to the package root |
+| `disabledRules` | string[] | `[]` | Rule ids to stop running; each appears in `skipped` |
+| `onlyRules` | string[] | `[]` | Run only these rule ids; empty runs every rule |
+| `skipNotes` | string | `""` | Note appended to every `skipped` reason |
+| `timeoutMs` | number | `120000` | Cooperative tool timeout budget |
+
+Rule-level parameters worth knowing:
+
+- `HZ-001` `requiredFields` — the columns every row must fill. Left empty it falls back to the pair the
+  clause itself names: `[偏差, 原因]`.
+- `HZ-005` `riskLevels` — your risk vocabulary, e.g. `[高, 中, 低]` or `[Ⅰ, Ⅱ, Ⅲ, Ⅳ]`. Empty means the
+  rule does not run. It can also be passed per call.
+- `HZ-003` `guideWords` — the guide-word list your study declared before the meeting, when it uses its
+  own under 6.4.3. Empty means the standard's tables 1 and 2 are used.
+- `HZ-006` `requireHeader` — set to `false` if your sheet legitimately carries no subject line.
+
+The plugin's own configuration also accepts `riskLevels` and `guideWords`, so a deployment can set the
+risk vocabulary and the declared guide words once for every call rather than passing them each time.
+
+## Material format
+
+The tool accepts JSON or YAML. Rows are keyed by the sheet's own column names; **Chinese and English names
+both work**, so an export from a commercial HAZOP tool loads without editing:
+
+```yaml
+subject: 某装置 HAZOP 分析
+revision: V1.0
+rows:
+  - { 节点: 进料单元, 设计意图: 将原料按设计流量送入反应器, 工艺参数: 流量, 引导词: 无,
+      偏差: 无流量, 原因: 进料泵故障, 后果: 反应器液位下降, 现有安全措施: 液位低报警,
+      建议措施: 增加进料泵备用泵, 风险等级: 中, 责任人: 张工, 完成期限: 2026-06-30 }
+  - { Node: N2, Parameter: Temperature, "Guide Word": High, Deviation: High temperature,
+      Causes: Cooling failure, Consequences: Runaway, Safeguards: High-temp trip }
+```
+
+Column names are matched case-insensitively and ignoring spaces, underscores and hyphens, so `Guide Word`,
+`guide_word` and `guideword` all resolve to the same field.
+
+`HZ-002` compares the deviation against the parameter+guide-word combination over a set of separators
+(`, `, `+`, `、`, `/`, `-`, `—`, `的`, `：`) and in both word orders, so `流量无`, `流量 + 无` and `无流量`
+all pass. It reports a mismatch as a likely copy-paste artefact — not as a claim that the deviation is
+technically wrong.
+
+## Rule sources
+
+Rule data lives in `rules/hazplan-check.yaml`. Every rule carries a document, a document number, a clause
+in the source's own numbering, a verbatim excerpt and the URL the excerpt was read from. The loader
+enforces that an excerpt is a real quotation of at least eight characters, and that a check resting on a
+general principle or a local policy can never be declared `error`.
+
+The clauses quoted come from **GB/T 35320-2017** — 3.3, 4.2, 6.4.3, 6.5, 6.6.3, 6.6.4, tables 1 and 2,
+and appendix A.2 — plus **GB/T 27921-2023** appendix B.10.3 for the risk-matrix description. The clause
+text was read from a full-text transcription whose structure cross-checks against the standard's official
+metadata; the pack records that the source is a transcription.
+
+Four findings shaped this pack and are recorded in its header:
+
+1. **Appendix A.2 is informative**, so its column list is a suggestion and never a requirement.
+2. **Clause 4.2 gives no criterion for node size**, so node granularity is not automatically judged.
+3. **The standard fixes no risk-level scale**, so levels are yours and the vocabulary ships empty.
+4. **SH/T 3240-2025 exists but its clause text was not obtained**, so no article of it is cited — only its
+   identity is noted, in the pack header.
+
+The full clause-verification report, including the sources that were checked and rejected, is in
+`rules/evidence/clause-verification.md`.
+
+## Troubleshooting
+
+- **`HZ-001`, `HZ-003` or `HZ-005` report themselves as skipped.** Their lists are empty. Fill in the ones
+  your template uses.
+- **`HZ-002` fires on a row that reads fine to me.** Your sheet may write a fuller deviation than
+  `参数+引导词`. The rule says "likely a copy-paste artefact"; either normalise the column or accept it as
+  noise. It never blocks anything.
+- **`HZ-002` reports nothing.** The sheet does not carry all three of 工艺参数, 引导词 and 偏差 — the rule
+  says so in `skipped` rather than guessing.
+- **The reader refuses a worksheet it used to accept.** It found none of the known column names; the error
+  names the columns it saw. Rename one column or add the name to `COLUMNS` in `src/model.ts`-adjacent
+  configuration.
+- **The plugin installs but the tool never appears.** Check that `main` resolves to `lib/index.mjs` and
+  that `pnpm run build` produced it; a wrong `main` makes the loader skip the entry silently.
+- **`dsh plugin add` refuses the package as incompatible.** The peer range covers `0.1.x` and `0.2.x`; if
+  your runtime sits outside it, grant an explicit exemption:
+  `dsh plugin --profile <name> allow-version dsh-hazplan-check@0.1.0 --dsh-version <runtime> --accept-risk`
+- **`check` reports `manifest-peers` as failed.** The static checker compares against a hard-coded peer
+  range that predates the 0.2 line. The runtime enforces peer compatibility at install time, so the
+  declared range is the correct one; this is a known upstream issue in `dsh-plugin-dev`.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck   # tsc --noEmit
+pnpm test            # vitest, paired fixtures per rule
+pnpm run build       # tsdown -> lib/index.mjs + lib/index.d.mts
+node ../scripts/sync-shared.mjs dsh-hazplan-check   # refresh src/shared from ../_shared
+```
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-hazplan-check contributors.

package/cordis.patch.yml

@@ -0,0 +1,8 @@
+# dsh-hazplan-check bundle layer: register this plugin as a bundle row.
+# This file is the `dsh.bundle.patch` layer (see package.json#dsh.bundle.patch).
+# Layer semantics: a YAML array of row verbs; `insert` adds plugin rows to the
+# composed config. A row's `id` must be unique within the layer stack; `name`
+# resolves the plugin module through the installed package (package.json#main).
+- insert:
+    - id: dsh-hazplan-check
+      name: dsh-hazplan-check

package/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="HAZOP worksheet check">
+  <rect width="64" height="64" rx="12" fill="#0f766e"/>
+  <path d="M16 20h32M16 32h22M16 44h26" stroke="#ffffff" stroke-width="4" stroke-linecap="round"/>
+  <circle cx="50" cy="46" r="9" fill="#ffffff"/>
+  <path d="M46 46l3 3 5-6" stroke="#0f766e" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
+</svg>