dsh-nsfc-form-check 0.0.0-stage → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## 0.2.1
+
+- Ship `CHANGELOG.md` and `SECURITY.md` inside the package. `files` is an
+  allowlist and neither was on it, so no release note had ever reached anyone
+  who installed this package, and npm had no changelog section to show.
+## 0.2.0
+
+- Release infrastructure brought to the family standard: `verify:self-contained`,
+  `check:lockfile`, `check:readmes` and `check:citations` gates, a `prepublishOnly` that
+  re-runs the whole chain, SECURITY.md, dependabot, and the OpenSSF Scorecard workflow.
+- `check:citations` enforces the rule this pack's own header states: every `excerpt`
+  must be a verbatim quotation, findable in `rules/evidence/`. Rules that are not
+  traceable yet are listed in `rules/citations-baseline.json`, and that file can only
+  shrink - anything new has to be sourced before it can land.
+- The README install command now names the published package instead of a local tarball.
+- Five-language READMEs hold the same section count and the same configuration keys.
+- Rule pack: 15 rules across NF-001..NF-015.
+- Licensed Apache-2.0.

package/LICENSE

@@ -0,0 +1,15 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README-es.md

@@ -0,0 +1,94 @@
+# dsh-nsfc-form-check
+
+**Boundary:** this plugin checks an **NSFC proposal's text and electronic document properties** and
+reports the identity clues it finds, alongside the length and form-review items a deployment
+configures. It is not `dsh-rulefile-check` (which audits the legality of a regulatory document), not
+`dsh-policy-brief-draft` (which drafts a policy explainer), and not `dsh-review-reply-check` (which
+tracks reviewer comments). It reads one proposal and reports literal matches against cited clauses.
+
+> ### ⚠️ Read this before using the anonymity checks
+>
+> **There is no current national provision that forbids an applicant's name, institution or advisor
+> from appearing in an NSFC proposal.** Three independent texts were read in full for this plugin —
+> 《国家自然科学基金条例》(国务院令第796号), the 2026 年度《项目指南·申请规定》, and the 2019 年度
+> guidelines — and none contains 匿名, 盲审, 活页, or any "must not appear" wording about identity.
+> The regulation does not contain the word 匿名 at all. Its **avoidance** clause (第二十条) requires a
+> reviewer from the applicant's own legal entity to recuse, which presupposes that the system knows
+> the applicant's institution — the opposite of an anonymous process.
+>
+> So every finding this plugin makes about a name or an institution is a **technical observation for
+> a human to weigh**, labelled 身份线索词 and never phrased as a violation. The plugin is useful for a
+> research-office self-check, and it is **wrong to use it as a compliance gate**. Two rules go further
+> and cite the guidance verbatim: `NF-014` checks that the advisor's name **is** filled in, because the
+> yearly guidelines require it, and `NF-015` checks 涉密与敏感信息, which is the one "must not appear"
+> requirement that really exists — and its object is classified information, not identity.
+
+## Compatibility
+
+| Superficie | Estado |
+|---|---|
+| Harness | Rango de peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verificado para aceptar tanto `0.2.0-rc.2` como `0.2.1-alpha.1`. **No se declara `engines.dsh`**: no tiene lector y no puede rechazar ningún host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Plataformas | Todas (ESM puro; sin código nativo, sin red, sin llamada al modelo) |
+| Modo de herramienta | Funciona en `native`, `ptc` y `both`; para un directorio completo use `ptc` |
+
+## What it does
+
+La tabla de reglas, los campos y el comportamiento detallado están en [README.md](README.md#what-it-does) (versión principal en inglés). El plugin sólo enumera divergencias literales frente a las cláusulas citadas e indica en `skipped` cada comprobación que no pudo ejecutarse.
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-nsfc-form-check
+dsh --profile <name> --dump-config | grep 'dsh-nsfc-form-check'
+```
+
+## Configuration
+
+Todos los parámetros ajustables viven en el esquema Schemastery de `src/config.ts`, por lo que se cambian desde `cordis.yml` sin tocar el código; los umbrales por regla están en el paquete de reglas bajo `rules/`.
+
+| Clave | Tipo | Predeterminado | Descripción |
+|---|---|---|---|
+| `rulesFile` | string | `rules/nsfc-form-check.yaml` | Ruta del paquete de reglas, relativa a la raíz del paquete |
+| `disabledRules` | string[] | `[]` | Ids de reglas que se dejan de ejecutar; cada una aparece en `skipped` |
+| `onlyRules` | string[] | `[]` | Ejecutar solo estas reglas; vacío ejecuta todas |
+| `skipNotes` | string | `""` | Nota añadida a cada motivo de `skipped` |
+| `authorNames` | string[] | `[]` | Nombres de solicitantes que se buscan |
+| `institutionNames` | string[] | `[]` | Nombres de instituciones y unidades que se buscan |
+| `advisorNames` | string[] | `[]` | Nombres de asesores que se buscan |
+| `allowList` | string[] | `[]` | Términos que se ignoran aunque coincidan |
+| `timeoutMs` | number | `120000` | Presupuesto de tiempo de espera cooperativo de la herramienta |
+
+## Material format
+
+Acepta JSON o YAML. El ejemplo completo de campos está en [README.md](README.md#material-format) (versión principal en inglés). Los campos son opcionales en la capa de lectura y los valida el motor, de modo que una exportación parcial produce hallazgos sobre lo que falta en lugar de un fallo.
+
+## Rule sources
+
+Los datos de las reglas están separados del código: cada regla lleva documento, número, cláusula en la numeración propia de la fuente, extracto literal y URL de origen. El cargador impone que el extracto sea una cita real de al menos ocho caracteres y que una comprobación basada sólo en un principio general (`kind: derived-from-principle`, tope `warn`) o en una política local (`kind: institutional-configuration`, tope `info`) nunca se declare `error`.
+
+Los límites verificados y las conclusiones deliberadamente **no** afirmadas están en [README.md](README.md#rule-sources) (versión principal en inglés) y en `rules/evidence/`.
+
+## Troubleshooting
+
+- **El plugin se instala pero la herramienta no aparece**: compruebe que `main` resuelve a `lib/index.mjs` y que `pnpm run build` lo generó.
+- **`dsh plugin add` rechaza el paquete**: la faixa de peers cubre `0.1.x` y `0.2.x`; fuera de ella, conceda una exención explícita con `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`.
+- **Una regla no se ejecutó**: lea el arreglo `skipped`.
+- **`check` informa `manifest-peers` como fallo**: es un problema conocido de `dsh-plugin-dev`; el runtime aplica la compatibilidad al instalar.
+- **Los horarios parecen desplazados**: toda la aritmética es de hora local sobre las cadenas entregadas.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-nsfc-form-check
+```
+
+El último comando copia el kit compartido de `../_shared` a `src/shared/`; vuelva a ejecutarlo tras cada cambio compartido.
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-nsfc-form-check contributors.

package/README-hi.md

@@ -0,0 +1,94 @@
+# dsh-nsfc-form-check
+
+**Boundary:** this plugin checks an **NSFC proposal's text and electronic document properties** and
+reports the identity clues it finds, alongside the length and form-review items a deployment
+configures. It is not `dsh-rulefile-check` (which audits the legality of a regulatory document), not
+`dsh-policy-brief-draft` (which drafts a policy explainer), and not `dsh-review-reply-check` (which
+tracks reviewer comments). It reads one proposal and reports literal matches against cited clauses.
+
+> ### ⚠️ Read this before using the anonymity checks
+>
+> **There is no current national provision that forbids an applicant's name, institution or advisor
+> from appearing in an NSFC proposal.** Three independent texts were read in full for this plugin —
+> 《国家自然科学基金条例》(国务院令第796号), the 2026 年度《项目指南·申请规定》, and the 2019 年度
+> guidelines — and none contains 匿名, 盲审, 活页, or any "must not appear" wording about identity.
+> The regulation does not contain the word 匿名 at all. Its **avoidance** clause (第二十条) requires a
+> reviewer from the applicant's own legal entity to recuse, which presupposes that the system knows
+> the applicant's institution — the opposite of an anonymous process.
+>
+> So every finding this plugin makes about a name or an institution is a **technical observation for
+> a human to weigh**, labelled 身份线索词 and never phrased as a violation. The plugin is useful for a
+> research-office self-check, and it is **wrong to use it as a compliance gate**. Two rules go further
+> and cite the guidance verbatim: `NF-014` checks that the advisor's name **is** filled in, because the
+> yearly guidelines require it, and `NF-015` checks 涉密与敏感信息, which is the one "must not appear"
+> requirement that really exists — and its object is classified information, not identity.
+
+## Compatibility
+
+| सतह | स्थिति |
+|---|---|
+| Harness | peer रेंज `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — `0.2.0-rc.2` और `0.2.1-alpha.1` दोनों को स्वीकार करने के लिए सत्यापित। **`engines.dsh` जानबूझकर घोषित नहीं**: इसका कोई पाठक नहीं और यह किसी होस्ट को अस्वीकार नहीं कर सकता |
+| Node | `^22.19.0 || >=24.0.0` |
+| प्लेटफ़ॉर्म | सभी (शुद्ध ESM; कोई नेटिव कोड नहीं, कोई नेटवर्क नहीं, कोई मॉडल कॉल नहीं) |
+| टूल मोड | `native`, `ptc` और `both` में काम करता है; पूरे फ़ोल्डर के लिए `ptc` चुनें |
+
+## What it does
+
+नियम-सूची, फ़ील्ड और विस्तृत व्यवहार [README.md](README.md#what-it-does) (अंग्रेज़ी मुख्य संस्करण) में हैं। यह प्लगइन केवल उद्धृत धाराओं के सामने शाब्दिक अंतर सूचीबद्ध करता है और हर न चल पाई जाँच को `skipped` में बताता है।
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-nsfc-form-check
+dsh --profile <name> --dump-config | grep 'dsh-nsfc-form-check'
+```
+
+## Configuration
+
+सभी समायोज्य पैरामीटर `src/config.ts` की Schemastery स्कीमा में हैं, इसलिए कोड बदले बिना `cordis.yml` से बदले जा सकते हैं; प्रति-नियम सीमाएँ `rules/` के नियम-पैक में हैं।
+
+| कुंजी | प्रकार | डिफ़ॉल्ट | विवरण |
+|---|---|---|---|
+| `rulesFile` | string | `rules/nsfc-form-check.yaml` | नियम-पैक का पथ, पैकेज रूट के सापेक्ष |
+| `disabledRules` | string[] | `[]` | बंद करने वाले नियम id; प्रत्येक `skipped` में दिखता है |
+| `onlyRules` | string[] | `[]` | केवल ये नियम चलाएँ; खाली होने पर सभी नियम चलते हैं |
+| `skipNotes` | string | `""` | हर `skipped` कारण के आगे जोड़ी जाने वाली टिप्पणी |
+| `authorNames` | string[] | `[]` | खोजे जाने वाले आवेदक नाम |
+| `institutionNames` | string[] | `[]` | खोजे जाने वाले संस्थान और इकाई नाम |
+| `advisorNames` | string[] | `[]` | खोजे जाने वाले सलाहकार नाम |
+| `allowList` | string[] | `[]` | मेल खाने पर भी अनदेखा किए जाने वाले शब्द |
+| `timeoutMs` | number | `120000` | उपकरण का सहकारी समय-सीमा बजट |
+
+## Material format
+
+JSON या YAML स्वीकार्य है। पूरा फ़ील्ड उदाहरण [README.md](README.md#material-format) (अंग्रेज़ी मुख्य संस्करण) में है। पढ़ने की परत में फ़ील्ड वैकल्पिक हैं और जाँच इंजन उन्हें सत्यापित करता है, इसलिए आंशिक निर्यात पर क्रैश के बजाय "अनुपस्थित" श्रेणी के निष्कर्ष मिलते हैं।
+
+## Rule sources
+
+नियम-डेटा कोड से अलग है: प्रत्येक नियम में दस्तावेज़, संख्या, स्रोत की अपनी क्रमांकन-प्रणाली के अनुसार धारा, शब्दशः उद्धरण और स्रोत URL होता है। लोडर लागू करता है कि उद्धरण कम से कम आठ अक्षरों का वास्तविक उद्धरण हो, और जिस जाँच का आधार केवल सामान्य सिद्धांत (`kind: derived-from-principle`, अधिकतम `warn`) या स्थानीय नीति (`kind: institutional-configuration`, अधिकतम `info`) हो, उसे कभी `error` घोषित न किया जाए।
+
+सत्यापित सीमाएँ और जान-बूझकर **न** कहे गए निष्कर्ष [README.md](README.md#rule-sources) (अंग्रेज़ी मुख्य संस्करण) और `rules/evidence/` में हैं।
+
+## Troubleshooting
+
+- **प्लगइन इंस्टॉल हो गया पर टूल दिखता नहीं**: जाँचें कि `main` `lib/index.mjs` पर जाता है और `pnpm run build` ने उसे बनाया है।
+- **`dsh plugin add` असंगत बताकर मना करता है**: peer range `0.1.x` और `0.2.x` दोनों को कवर करती है; बाहर होने पर स्पष्ट छूट दें: `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`।
+- **कोई नियम नहीं चला**: `skipped` सरणी देखें।
+- **`check` में `manifest-peers` विफल दिखता है**: यह `dsh-plugin-dev` की ज्ञात अपस्ट्रीम समस्या है; रनटाइम इंस्टॉल के समय अनुकूलता लागू करता है।
+- **समय खिसका हुआ लगता है**: सारी गणना दिए गए स्ट्रिंग पर वॉल-क्लॉक है।
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-nsfc-form-check
+```
+
+अंतिम कमांड `../_shared` का साझा किट `src/shared/` में कॉपी करता है; हर साझा बदलाव के बाद इसे दोबारा चलाएँ।
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-nsfc-form-check contributors.

package/README-pt.md

@@ -0,0 +1,94 @@
+# dsh-nsfc-form-check
+
+**Boundary:** this plugin checks an **NSFC proposal's text and electronic document properties** and
+reports the identity clues it finds, alongside the length and form-review items a deployment
+configures. It is not `dsh-rulefile-check` (which audits the legality of a regulatory document), not
+`dsh-policy-brief-draft` (which drafts a policy explainer), and not `dsh-review-reply-check` (which
+tracks reviewer comments). It reads one proposal and reports literal matches against cited clauses.
+
+> ### ⚠️ Read this before using the anonymity checks
+>
+> **There is no current national provision that forbids an applicant's name, institution or advisor
+> from appearing in an NSFC proposal.** Three independent texts were read in full for this plugin —
+> 《国家自然科学基金条例》(国务院令第796号), the 2026 年度《项目指南·申请规定》, and the 2019 年度
+> guidelines — and none contains 匿名, 盲审, 活页, or any "must not appear" wording about identity.
+> The regulation does not contain the word 匿名 at all. Its **avoidance** clause (第二十条) requires a
+> reviewer from the applicant's own legal entity to recuse, which presupposes that the system knows
+> the applicant's institution — the opposite of an anonymous process.
+>
+> So every finding this plugin makes about a name or an institution is a **technical observation for
+> a human to weigh**, labelled 身份线索词 and never phrased as a violation. The plugin is useful for a
+> research-office self-check, and it is **wrong to use it as a compliance gate**. Two rules go further
+> and cite the guidance verbatim: `NF-014` checks that the advisor's name **is** filled in, because the
+> yearly guidelines require it, and `NF-015` checks 涉密与敏感信息, which is the one "must not appear"
+> requirement that really exists — and its object is classified information, not identity.
+
+## Compatibility
+
+| Superfície | Estado |
+|---|---|
+| Harness | Faixa de peers `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verificada para aceitar tanto `0.2.0-rc.2` quanto `0.2.1-alpha.1`. **`engines.dsh` não é declarado**: não tem leitor e não pode recusar nenhum host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Plataformas | Todas (ESM puro; sem código nativo, sem rede, sem chamada ao modelo) |
+| Modo de ferramenta | Funciona em `native`, `ptc` e `both`; para um diretório inteiro use `ptc` |
+
+## What it does
+
+A tabela de regras, os campos e o comportamento detalhado estão em [README.md](README.md#what-it-does) (versão principal em inglês). O plugin apenas lista divergências literais frente às cláusulas citadas e indica em `skipped` cada verificação que não pôde ser executada.
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-nsfc-form-check
+dsh --profile <name> --dump-config | grep 'dsh-nsfc-form-check'
+```
+
+## Configuration
+
+Todos os parâmetros ajustáveis ficam no esquema Schemastery de `src/config.ts`, portanto mudam pelo `cordis.yml` sem editar código; os limites por regra ficam no pacote de regras sob `rules/`.
+
+| Chave | Tipo | Padrão | Descrição |
+|---|---|---|---|
+| `rulesFile` | string | `rules/nsfc-form-check.yaml` | Caminho do pacote de regras, relativo à raiz do pacote |
+| `disabledRules` | string[] | `[]` | Ids de regras a desativar; cada uma aparece em `skipped` |
+| `onlyRules` | string[] | `[]` | Executar apenas estas regras; vazio executa todas |
+| `skipNotes` | string | `""` | Nota acrescentada a cada motivo de `skipped` |
+| `authorNames` | string[] | `[]` | Nomes de solicitantes a procurar |
+| `institutionNames` | string[] | `[]` | Nomes de instituições e unidades a procurar |
+| `advisorNames` | string[] | `[]` | Nomes de orientadores a procurar |
+| `allowList` | string[] | `[]` | Termos a ignorar mesmo quando coincidem |
+| `timeoutMs` | number | `120000` | Orçamento de tempo limite cooperativo da ferramenta |
+
+## Material format
+
+Aceita JSON ou YAML. O exemplo completo de campos está em [README.md](README.md#material-format) (versão principal em inglês). Os campos são opcionais na camada de leitura e validados pelo motor, de modo que uma exportação parcial gera achados sobre o que falta em vez de falhar.
+
+## Rule sources
+
+Os dados das regras ficam separados do código: cada regra traz documento, número, cláusula na numeração própria da fonte, trecho literal e URL de origem. O carregador impõe que o trecho seja citação real de pelo menos oito caracteres e que uma verificação baseada apenas em princípio geral (`kind: derived-from-principle`, teto `warn`) ou em política local (`kind: institutional-configuration`, teto `info`) nunca seja declarada `error`.
+
+Os limites verificados e as conclusões deliberadamente **não** afirmadas estão em [README.md](README.md#rule-sources) (versão principal em inglês) e em `rules/evidence/`.
+
+## Troubleshooting
+
+- **O plugin instala mas a ferramenta não aparece**: confirme que `main` resolve para `lib/index.mjs` e que `pnpm run build` o gerou.
+- **`dsh plugin add` recusa o pacote**: a faixa de peers cobre `0.1.x` e `0.2.x`; fora dela, conceda isenção explícita com `dsh plugin --profile <name> allow-version <pkg@ver> --dsh-version <runtime> --accept-risk`.
+- **Uma regra não executou**: leia o arranjo `skipped`.
+- **`check` informa `manifest-peers` como falha**: problema conhecido do `dsh-plugin-dev`; o runtime aplica a compatibilidade na instalação.
+- **Os horários parecem deslocados**: toda a aritmética é de hora local sobre as cadeias fornecidas.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-nsfc-form-check
+```
+
+O último comando copia o kit compartilhado de `../_shared` para `src/shared/`; execute-o novamente após cada alteração compartilhada.
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-nsfc-form-check contributors.

package/README-zh.md

@@ -0,0 +1,94 @@
+# dsh-nsfc-form-check
+
+**Boundary:** this plugin checks an **NSFC proposal's text and electronic document properties** and
+reports the identity clues it finds, alongside the length and form-review items a deployment
+configures. It is not `dsh-rulefile-check` (which audits the legality of a regulatory document), not
+`dsh-policy-brief-draft` (which drafts a policy explainer), and not `dsh-review-reply-check` (which
+tracks reviewer comments). It reads one proposal and reports literal matches against cited clauses.
+
+> ### ⚠️ Read this before using the anonymity checks
+>
+> **There is no current national provision that forbids an applicant's name, institution or advisor
+> from appearing in an NSFC proposal.** Three independent texts were read in full for this plugin —
+> 《国家自然科学基金条例》(国务院令第796号), the 2026 年度《项目指南·申请规定》, and the 2019 年度
+> guidelines — and none contains 匿名, 盲审, 活页, or any "must not appear" wording about identity.
+> The regulation does not contain the word 匿名 at all. Its **avoidance** clause (第二十条) requires a
+> reviewer from the applicant's own legal entity to recuse, which presupposes that the system knows
+> the applicant's institution — the opposite of an anonymous process.
+>
+> So every finding this plugin makes about a name or an institution is a **technical observation for
+> a human to weigh**, labelled 身份线索词 and never phrased as a violation. The plugin is useful for a
+> research-office self-check, and it is **wrong to use it as a compliance gate**. Two rules go further
+> and cite the guidance verbatim: `NF-014` checks that the advisor's name **is** filled in, because the
+> yearly guidelines require it, and `NF-015` checks 涉密与敏感信息, which is the one "must not appear"
+> requirement that really exists — and its object is classified information, not identity.
+
+## Compatibility
+
+| 项目 | 状态 |
+|---|---|
+| Harness | 对等版本范围 `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` —— 已实测同时接受 `0.2.0-rc.2` 与 `0.2.1-alpha.1`。**刻意不声明 `engines.dsh`**：它没有任何读取者，也无法拒装任何宿主 |
+| Node | `^22.19.0 || >=24.0.0` |
+| 平台 | 全平台（纯 ESM；无原生代码、无联网、不调用模型） |
+| 工具模式 | `native` / `ptc` / `both` 均可；批量校验整个目录时建议 `ptc`，schema 成本只付一次 |
+
+## What it does
+
+规则表、字段说明与行为细节见 [README.md](README.md#what-it-does)（英文主版本）。本插件只列出材料与所引条款之间的字面差异，并对无法执行的检查在 `skipped` 中逐项说明。
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-nsfc-form-check
+dsh --profile <name> --dump-config | grep 'dsh-nsfc-form-check'
+```
+
+## Configuration
+
+全部可调参数都在 `src/config.ts` 的 Schemastery schema 中，只改 `cordis.yml` 即可生效，无需改代码；逐条阈值在 `rules/` 下的规则库文件里。
+
+| 键 | 类型 | 默认值 | 说明 |
+|---|---|---|---|
+| `rulesFile` | string | `rules/nsfc-form-check.yaml` | 规则库文件路径，相对插件包根目录 |
+| `disabledRules` | string[] | `[]` | 要停用的规则 id 列表；每条都会出现在 `skipped` 中 |
+| `onlyRules` | string[] | `[]` | 只执行这些规则 id；留空表示执行全部规则 |
+| `skipNotes` | string | `""` | 附加到每条 `skipped` 说明后的备注 |
+| `authorNames` | string[] | `[]` | 要检索的申请人姓名 |
+| `institutionNames` | string[] | `[]` | 要检索的依托单位与院系名称 |
+| `advisorNames` | string[] | `[]` | 要检索的导师姓名 |
+| `allowList` | string[] | `[]` | 即使命中也要忽略的词语 |
+| `timeoutMs` | number | `120000` | 工具协作式超时预算（毫秒） |
+
+## Material format
+
+支持 JSON 与 YAML。完整字段示例见 [README.md](README.md#material-format)（英文主版本）。字段在读取层是可选的，由检查引擎校验，因此部分导出的材料会产生"缺项"类差异，而不是让程序崩溃。
+
+## Rule sources
+
+规则数据与代码分离，每条规则都带文件名、文号、按原文自身编号体系的条款号、逐字摘录与来源地址。加载期强制：摘录必须是真实引文且不少于八个字符；依据仅为原则性条款（`kind: derived-from-principle`，严重级上限 `warn`）或本机构配置（`kind: institutional-configuration`，上限 `info`）的检查不得标为 `error`。夸大依据的规则库会在加载期失败，而不会产出一份看起来很有底气的报告。
+
+核验中确认的边界与"刻意没有作出的结论"见 [README.md](README.md#rule-sources)（英文主版本）与随包的 `rules/evidence/` 目录。
+
+## Troubleshooting
+
+- **插件装上了但工具不出现**：确认 `main` 指向 `lib/index.mjs` 且 `pnpm run build` 已生成该文件；`main` 写错会让加载器静默跳过该条目。
+- **`dsh plugin add` 报版本不兼容**：peer 范围覆盖 `0.1.x` 与 `0.2.x`；若运行时在其之外，可显式豁免：`dsh plugin --profile <name> allow-version <包名@版本> --dsh-version <runtime> --accept-risk`
+- **某条规则没有执行**：查看 `skipped` 数组，其中写明了规则 id 与原因。
+- **`check` 报 `manifest-peers` 失败**：静态检查器比对的是一份早于 0.2 世代的硬编码 peer 范围；安装期的 peer 校验以运行时为准。这是 `dsh-plugin-dev` 的已知上游问题。
+- **时间看起来偏移**：全部计算都是对输入字符串做墙上时钟运算，不做时区换算。
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck
+pnpm test
+pnpm run build
+node ../scripts/sync-shared.mjs dsh-nsfc-form-check
+```
+
+第 4 项把 `../_shared` 的共享件同步进 `src/shared/`；每次改动共享件后都要重跑。
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-nsfc-form-check contributors.

package/README.md

@@ -1,3 +1,177 @@
-# Temporary Holding Version
+# dsh-nsfc-form-check
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Boundary:** this plugin checks an **NSFC proposal's text and electronic document properties** and
+reports the identity clues it finds, alongside the length and form-review items a deployment
+configures. It is not `dsh-rulefile-check` (which audits the legality of a regulatory document), not
+`dsh-policy-brief-draft` (which drafts a policy explainer), and not `dsh-review-reply-check` (which
+tracks reviewer comments). It reads one proposal and reports literal matches against cited clauses.
+
+> ### ⚠️ Read this before using the anonymity checks
+>
+> **There is no current national provision that forbids an applicant's name, institution or advisor
+> from appearing in an NSFC proposal.** Three independent texts were read in full for this plugin —
+> 《国家自然科学基金条例》(国务院令第796号), the 2026 年度《项目指南·申请规定》, and the 2019 年度
+> guidelines — and none contains 匿名, 盲审, 活页, or any "must not appear" wording about identity.
+> The regulation does not contain the word 匿名 at all. Its **avoidance** clause (第二十条) requires a
+> reviewer from the applicant's own legal entity to recuse, which presupposes that the system knows
+> the applicant's institution — the opposite of an anonymous process.
+>
+> So every finding this plugin makes about a name or an institution is a **technical observation for
+> a human to weigh**, labelled 身份线索词 and never phrased as a violation. The plugin is useful for a
+> research-office self-check, and it is **wrong to use it as a compliance gate**. Two rules go further
+> and cite the guidance verbatim: `NF-014` checks that the advisor's name **is** filled in, because the
+> yearly guidelines require it, and `NF-015` checks 涉密与敏感信息, which is the one "must not appear"
+> requirement that really exists — and its object is classified information, not identity.
+
+## Compatibility
+
+| Surface | Status |
+|---|---|
+| Harness | Peer range `>=0.1.2-rc.1 <0.2.0 \|\| >=0.2.0-0 <0.3.0` — verified to accept both `0.2.0-rc.2` and `0.2.1-alpha.1`. `engines.dsh` is deliberately not declared: it has no reader and cannot reject a host |
+| Node | `^22.19.0 || >=24.0.0` |
+| Platforms | All (plain ESM; no native code, no network, no model call) |
+| Tool mode | Works in `native`, `ptc` and `both`; for a batch of proposals use `ptc` |
+
+## What it does
+
+Registers the `nsfc_form_check` tool. It reads one proposal — body text, document properties, and the
+institution's own roster of identity terms — applies a versioned rule pack, and returns a report in
+which every finding names the clause it came from and states whether that clause is a direct
+requirement, a principle, or a local configuration.
+
+| Rule | Check | Severity | Basis kind |
+|---|---|---|---|
+| `NF-001` | a roster is configured, otherwise the identity checks cannot run | warn | principle |
+| `NF-002` | the body mentions an applicant name | warn | principle |
+| `NF-003` | the body mentions an institution name | warn | principle |
+| `NF-004` | the body mentions an advisor name | warn | principle |
+| `NF-005` | the document title property contains an identity clue | info | principle |
+| `NF-006` | the author property is non-empty or names the applicant | info | principle |
+| `NF-007` | the company property names the institution | info | principle |
+| `NF-008` | the last-modified-by property names the applicant | info | principle |
+| `NF-009` | identity clues inside a configured line range | info | principle |
+| `NF-010` | the material fits the configured length limit | info | local |
+| `NF-011` | the material contains the configured form-review items | info | local |
+| `NF-012` | a repeat or follow-on proposal carries the configured disclosure | info | local |
+| `NF-013` | identity clues inside a configured scope | info | principle |
+| `NF-014` | the advisor's name **is** present, as the yearly guidelines require | info | local |
+| `NF-015` | the material contains no configured classified term | info | local |
+
+Rules whose thresholds are yearly or per-project-type ship **empty** on purpose. They report
+themselves in `skipped` until configured, so an unfilled threshold can never read as "nothing wrong".
+
+## Install
+
+```sh
+dsh plugin --profile <name> add dsh-nsfc-form-check
+dsh --profile <name> --dump-config | grep 'dsh-nsfc-form-check'
+```
+
+## Configuration
+
+Every tunable lives in the Schemastery schema in `src/config.ts`. The roster is the one thing this
+plugin cannot work without: an identity check needs a list of the terms to look for, and that list is
+institution-specific, so it stays in the deployment's own configuration rather than travelling with
+the package.
+
+| Key | Type | Default | Description |
+|---|---|---|---|
+| `rulesFile` | string | `rules/nsfc-form-check.yaml` | Rule-pack path, relative to the package root |
+| `disabledRules` | string[] | `[]` | Rule ids to stop running; each appears in `skipped` |
+| `onlyRules` | string[] | `[]` | Run only these rule ids; empty runs every rule |
+| `skipNotes` | string | `""` | Note appended to every `skipped` reason |
+| `authorNames` | string[] | `[]` | Applicant names to look for |
+| `institutionNames` | string[] | `[]` | Institution and unit names to look for |
+| `advisorNames` | string[] | `[]` | Advisor names to look for |
+| `allowList` | string[] | `[]` | Terms to ignore even when they match |
+| `timeoutMs` | number | `120000` | Cooperative tool timeout budget |
+
+Rule-level parameters worth knowing:
+
+- `NF-009` `coverLines` — how many leading lines count as the cover page. Empty means the plugin does
+  not assume any institution's template.
+- `NF-010` `maxLines` / `maxChars` — the length limit **for the year and project type you are filing
+  under**. `maxLines` counts extracted paragraphs, which is not the same as typeset pages.
+- `NF-011` `require` — your form-review item list, as `[{ label, match }]` pairs.
+- `NF-012` `markerPatterns` / `requiredDisclosure` — how a repeat proposal is recognised in your
+  template, and what it must disclose.
+- `NF-014` `requireMention` + `advisorNames` — the inverse check, off until you enable it for the year.
+- `NF-015` `secretTerms` — your confidentiality office's term list. The plugin ships none, because what
+  counts as classified is defined by state secrecy rules, not by this plugin.
+
+## Material format
+
+Point the tool at a `.docx` and it reads the body text and the document properties itself. A `.pdf` is
+**not** parsed: page-accurate extraction is a different problem with a different failure mode, and a
+wrong page number is worse than none, so pass the text you extracted with your own tool. `.txt`, `.md`
+and `.json` are accepted too; the JSON form carries both parts explicitly.
+
+```json
+{
+  "lines": ["申请代码：H0301", "一、立项依据与研究内容", "……"],
+  "metadata": { "title": "某信号通路机制研究", "author": "", "company": "", "lastModifiedBy": "" }
+}
+```
+
+Matching is literal and line-oriented, so every finding carries a line number you can jump to. A term
+shorter than two characters is ignored, and anything in `allowList` is ignored, because a common
+surname would otherwise flood the report.
+
+## Rule sources
+
+Rule data lives in `rules/nsfc-form-check.yaml`. Every rule carries a document, a document number, a
+clause in the source's own numbering, a verbatim excerpt and the URL the excerpt was read from. The
+loader enforces that an excerpt is a real quotation of at least eight characters, and that a check
+resting only on a general principle or a local policy can never be declared `error`.
+
+Four findings shaped this pack:
+
+1. **The regulation was revised.** 《国家自然科学基金条例》 is now **国务院令第796号** (revised
+   2024-11-08, in force 2025-01-01), superseding 国务院令第487号 (2007). Clause numbers moved: the
+   review-confidentiality duty is now 第二十一条, not the old 第二十四条. This pack cites only the
+   current revision, and a test asserts that the superseded order number never appears.
+2. **Anonymity has no legal basis**, as set out at the top of this file. The rules state this in their
+   own notes so a reader of the report sees it without consulting the README.
+3. **The advisor's name is *required*, not forbidden.** The yearly guidelines instruct applicants to
+   fill in their graduate and postdoctoral advisor names truthfully. `NF-014` therefore checks the
+   opposite of `NF-004`, and the pack explains why the two coexist.
+4. **Yearly policy is configuration, not code.** Page and word limits, the itemised limits on how many
+   proposals may be filed, which project types use a lump-sum budget, and the yearly list of
+   non-acceptance situations all change between years; every one of them ships empty.
+
+The full clause-verification report, including the sources that were checked and rejected, is in
+`rules/evidence/clause-verification.md`.
+
+## Troubleshooting
+
+- **The plugin installs but the tool never appears.** Check that `main` resolves to `lib/index.mjs`
+  and that `pnpm run build` produced it; a wrong `main` makes the loader skip the entry silently.
+- **Every identity check is skipped.** No roster is configured. Fill in `authorNames`,
+  `institutionNames` and `advisorNames`, and `NF-001` will stop reporting.
+- **The report is noisy with a common surname.** Add the term to `allowList`; the plugin refuses to
+  guess which matches are meaningful.
+- **A `.pdf` is refused.** By design. Extract the text with a tool you trust and pass it through
+  `text`, or convert the proposal to `.docx`.
+- **`dsh plugin add` refuses the package as incompatible.** The peer range covers `0.1.x` and `0.2.x`;
+  if your runtime sits outside it, grant an explicit exemption:
+  `dsh plugin --profile <name> allow-version dsh-nsfc-form-check@0.1.0 --dsh-version <runtime> --accept-risk`
+- **`check` reports `manifest-peers` as failed.** The static checker compares against a hard-coded peer
+  range that predates the 0.2 line. The runtime enforces peer compatibility at install time, so the
+  declared range is the correct one; this is a known upstream issue in `dsh-plugin-dev`.
+
+## Development
+
+```sh
+pnpm install
+pnpm run typecheck   # tsc --noEmit
+pnpm test            # vitest, paired fixtures per rule, plus a real .docx round trip
+pnpm run build       # tsdown -> lib/index.mjs + lib/index.d.mts
+node ../scripts/sync-shared.mjs dsh-nsfc-form-check   # refresh src/shared from ../_shared
+```
+
+`tests/docx-fixture.ts` builds real `.docx` packages in memory (a genuine ZIP with deflated entries),
+so the docx path is exercised end to end while the fixtures stay reviewable JSON.
+
+## License
+
+[Apache License 2.0](LICENSE) © 2026 dsh-nsfc-form-check contributors.

package/SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security vulnerabilities **privately** through GitHub's private
+vulnerability reporting:
+
+**Security → Report a vulnerability** at
+https://github.com/PerryLink/dsh-nsfc-form-check/security/advisories/new
+
+Do **not** open a public issue for security findings.
+
+Before reporting, **sanitize everything you paste**: remove tokens, API keys,
+credentials, authorization headers, session contents, and personal data. Logs
+without secrets only.
+
+## Scope note
+
+This plugin is an offline checker. It reads the material you hand it and
+compares it against a versioned rule pack; it makes no network calls and no
+model calls, and it stores nothing.
+
+## What to include
+
+- affected package version (and DeepSeek Harness runtime version)
+- a minimal reproduction
+- your impact assessment
+
+## Response expectations
+
+- acknowledgement within **7 days**
+- status updates at least every **14 days** until resolution
+- coordinated disclosure: the fix and advisory are prepared first; the finding
+  is disclosed publicly after the fix ships
+
+## Credits and disclosure
+
+- reporters are credited in the advisory and CHANGELOG unless they ask to stay anonymous
+- advisories follow GitHub's advisory workflow and are published together with the fix

package/cordis.patch.yml

@@ -0,0 +1,8 @@
+# dsh-nsfc-form-check bundle layer: register this plugin as a bundle row.
+# This file is the `dsh.bundle.patch` layer (see package.json#dsh.bundle.patch).
+# Layer semantics: a YAML array of row verbs; `insert` adds plugin rows to the
+# composed config. A row's `id` must be unique within the layer stack; `name`
+# resolves the plugin module through the installed package (package.json#main).
+- insert:
+    - id: dsh-nsfc-form-check
+      name: dsh-nsfc-form-check