dsh-report-card 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH Report Card contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,237 @@
-# Temporary Holding Version
+# DSH Report Card
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An independent, **dynamic** benchmark for DeepSeek Harness plugins. It installs
+one plugin into a throwaway profile, boots the real harness with it, runs one
+scripted turn against a local fixture endpoint, and reports what the plugin
+costs: boot time, per-turn hook overhead, the tokens it adds to the assembled
+prompt, the capability surface it contributes, and the static risk flags its
+package carries.
+
+Every number is a reading from a real harness process — wall clock, process CPU,
+or the exact bytes of the request it sent — none of it estimated from source
+code. Every card stores its samples, its digest, and the command that reproduces
+it.
+
+## What already exists, and why this is not a duplicate
+
+Searched 2026-11-10: the `dsh-plugin-catalog` 2026.1110.18259 (9,959 plugins)
+and npm. The adjacent tools are all **static scores or in-profile meters**:
+
+| Existing | What it actually does | Why it is a different thing |
+|---|---|---|
+| `dsh-plugin-scorecard` 0.3.2 | Static quality/security score, rankings, history across the whole catalog | Scores package *files*; never boots the plugin |
+| `dsh-quality-score` 0.1.4 | Static 0-100 from manifest, peers, dist-tags, docs | Same: a metadata rubric, no runtime |
+| `dsh-trust-check` 0.2.6 | Static capability disclosure with `file:line` evidence | Facts about source, not behaviour under load |
+| `dsh-xray` 0.11.0 | Per-plugin context-tax attribution, per-request token ledger | Prices what is **already loaded in your profile**; cannot evaluate a candidate |
+| `dsh-context-doctor` | Token costs of instruction chains, skill catalogs, tool schemas | Static accounting of the current context |
+| `dsh-agent-bench` 0.1.1 | Replays fixed agent cases and diffs scorecards | Measures *model behaviour*; the plugin is not the subject |
+| `dsh-workspace-switch-cost` | Cold-start cost of switching workspaces | Per-workspace, not per candidate plugin |
+
+**One line:** existing scorecards read a plugin's files, and the closest dynamic
+instruments price what is already in your profile — nothing installs a candidate
+into a disposable profile and times its boot, a scripted turn, and the exact
+request it produces; that is what this does, so it complements them.
+
+## What a card contains
+
+| Dimension | How it is measured |
+|---|---|
+| **Boot wall** | Process start (`performance.timeOrigin`) → the measurement probe reporting the plugin tree composed, with and without the plugin |
+| **Boot CPU** | The child's own CPU time (user + system) at that same dump: what composing the tree cost, independent of what else the machine was doing. This is the graded boot figure |
+| **Launch** | The same point measured from process spawn, including OS process startup |
+| **Turn / step** | `turn_start → turn_end` and `step_start → step_end` on one fixed scripted turn |
+| **Assembly** | `step/start` (from the child's own session log inside the captured request) to the request reaching the fixture endpoint: prompt assembly and request serialization — the phase plugin hooks run in. This is the graded per-turn figure |
+| **Context tax** | Model-visible bytes of the request the harness actually sent (`system` + `tools` + `messages`), in tokens at the documented 4-chars/token heuristic; harness extension fields are counted separately |
+| **Capability surface** | Tools and schemas the model is offered, prompt sections and their sizes, event listeners per event, loader entries, prompt variables — all as a diff against the same profile without the plugin |
+| **Static risk flags** | Install scripts, shipped binaries, network hosts, subprocess use, dynamic code, filesystem writes, `process.exit` — with file and line evidence. Nothing is executed to produce them |
+| **Health** | `ok`, `install-rejected`, `install-failed`, `boot-failed`, `turn-failed`, `entry-failed`, `entry-absent`. A plugin that fails to activate is a failed card, never a passing one |
+
+See [`docs/example-card.md`](docs/example-card.md) for a complete card of the
+test fixture.
+
+## How it measures
+
+```
+                    ┌──────────────── throwaway DSH_HOME ────────────────┐
+  subject package ► │ profile "rc-measured" ← shipped "headless" template │
+                    │   subject plugin: an insert row, or the bundle list │
+                    │   probe: inserted last, dumps the surface, exits    │
+                    └────────────┬───────────────────────────┬────────────┘
+                                 │ surface runs              │ turn runs
+                                 ▼                           ▼
+                    spawn → probe dump → exit     spawn → session → turn → exit
+                    boot wall/CPU + surface       assembly/step + exact request
+                                                 DEEPSEEK_BASE_URL → local fixture
+```
+
+* **Fresh state.** Each report gets a new `DSH_HOME`, a new profile copied from
+  the shipped `headless` template, and an empty working directory. Your real
+  profile is never opened, so a measured plugin cannot disturb it.
+* **No model calls.** `DEEPSEEK_BASE_URL` points at a loopback endpoint that
+  speaks the Anthropic-style Messages SSE stream the shipped adapter parses. The
+  reply is a fixed one-line text block, so the turn is deterministic — and the
+  *request* is captured verbatim, which is the context-tax measurement.
+* **No background noise.** The fixture overlay disables session-title generation
+  and telemetry, and a discarded warm-up pair primes the file cache before any
+  sample is recorded.
+* **Round-paired deltas.** Each subject run is paired with the baseline run
+  immediately before it; the delta is the median of those paired differences,
+  which cancels slow machine drift. Grades charge only the part of a delta that
+  clears the machine's measured noise (one standard error of the paired
+  differences), so a loaded machine cannot turn a free plugin into a bad grade —
+  and cannot hide real overhead either, because the raw numbers stay on the
+  card next to their floor.
+* **Integrity.** The card is hashed (`sha256` over canonical JSON, digest
+  excluded). Re-running the same subject compares against the previous card in
+  the same directory and prints drift.
+
+## Install
+
+The plugin ships as a bundle with metadata, `locale/en.json`, `locale/zh.json`
+and an icon. Install it from this directory with the plugin manager — it adds
+the dependency *and* enables the bundle in one step; removing it undoes both:
+
+```
+plugin_manager install_bundle  target: "file:C:/path/to/dsh-report-card"
+plugin_manager remove_bundle   target: "dsh-report-card"
+```
+
+`install_bundle` is the sanctioned path because a bundle is composed through the
+profile's bundle list, not just `node_modules`. The bundle inserts one entry,
+`dsh-report-card`, which contributes one tool. It was installed this way on dsh
+0.2.2-rc.1 and appears in the profile's bundle list beside the existing plugins
+without touching them.
+
+## Use
+
+From a session (the tool is model-facing):
+
+```
+report_card(pluginSpec: "dsh-trust-check@0.2.6", samples: 3)
+```
+
+From a terminal — the same code path, printable output:
+
+```powershell
+node harness/cli.mjs ./test/fixtures/fake-plugin              # local directory
+node harness/cli.mjs dsh-trust-check@0.2.6 --samples 3        # npm package
+node harness/cli.mjs dsh-quality-score --json                 # raw card
+```
+
+Cards are written to `./report-cards/<name>@<version>/<timestamp>.{json,md}` and
+indexed in `./report-cards/index.json`; set `DSH_REPORT_CARD_DIR` to move that.
+
+The tool takes **~60–90 s** for the default five samples: four harness boots per
+sample round (surface × 2, turn × 2) plus one discarded warm-up round. Pass
+`samples: 3` for a quick look and `samples: 8..10` when you need to resolve a
+few milliseconds.
+
+## Reading a card
+
+```
+**Grade D** · graded boot +6.3 ms CPU · graded turn 0 ms · context +76 tok · risk D
+```
+
+* The headline shows the two **graded** deltas plus the exact context delta and
+  the risk grade. Every raw number — wall boot, process CPU, turn, assembly,
+  step, launch — is in the tables below with its samples and noise floor.
+* Wall time is presented but never graded: it is hostage to whatever else the
+  machine is doing. The boot grade uses noise-adjusted **process CPU** at the
+  moment the plugin tree is ready; the turn grade uses the noise-adjusted
+  **assembly** time, the phase plugin hooks run in.
+* `context` is the median of the captured requests; it is exactly reproducible,
+  since the prompt is a function of the profile.
+* `risk` is disclosure, not a verdict: `A` none, `B` informational only,
+  `C` medium flags, `D` high flags. A postinstall script is a high flag.
+* The overall grade is the worst dimension. `F` means the card could not measure
+  a running plugin.
+
+| Dimension | A | B | C | D | F |
+|---|---|---|---|---|---|
+| Boot CPU (noise-adjusted) | ≤ 10 ms | ≤ 30 ms | ≤ 80 ms | ≤ 250 ms | > 250 ms |
+| Assembly (noise-adjusted) | ≤ 10 ms | ≤ 30 ms | ≤ 80 ms | ≤ 200 ms | > 200 ms |
+| Context token delta | ≤ 100 | ≤ 500 | ≤ 2000 | ≤ 8000 | > 8000 |
+| Risk | clean | info | medium | high | — |
+
+Numbers are comparable **only on the same machine identity** (platform, CPU
+count, dsh version) — the card prints it. A delta inside the printed noise floor
+is noise; the card says so in its notes.
+
+## Reproduce and verify
+
+Every card prints its own reproduce command. The harness's own repeatability
+check runs one subject several times and reports the spread:
+
+```powershell
+node harness/repeat.mjs ./test/fixtures/fake-plugin --runs 2 --samples 3
+```
+
+Measured while a harness session was actively running on the same machine (full
+output in [`docs/acceptance.md`](docs/acceptance.md)): the **context delta
+repeated at 0.00%**, the **graded boot CPU and assembly deltas at 0.00%**, and
+the raw round-paired wall deltas within 1.9% (boot) and 2.4% (assembly). Earlier
+in the same session, with a busier machine, raw wall deltas moved by up to 19%.
+The card publishes its own jitter and noise floor for exactly this reason.
+
+Tests:
+
+```powershell
+node test/unit.test.mjs      # units, ~1 s
+node test/harness.test.mjs   # real boots against fixtures, ~80 s
+```
+
+`test/harness.test.mjs` covers the whole harness with fake plugins: a healthy
+plugin (surface, context tax, risk flags, digest), a plugin that throws during
+activation (must be a failed card), a plugin that calls `process.exit` (must be
+a failed boot that still returns), and a second card that must show drift
+against the first.
+
+## Publishing
+
+The package is publish-ready: `npm publish` and the catalog PR are documented in
+[`docs/publishing.md`](docs/publishing.md), including the exact
+`data/plugins/<owner>__<repo>.yml` entry the awesome-dsh-plugin list expects, the
+`repository` field the catalog's npm mapping depends on, and the tarball-install
+check that was run against the packed artifact.
+## Safety and limits
+
+* **The subject executes.** It runs in a disposable profile with a read-only
+  file policy and a fresh `DSH_HOME`, as your user — that is enough to keep it
+  away from your real profile, but it is **not** a security sandbox. Read the
+  risk flags before measuring something you do not trust.
+* **No `app.asar` edits.** The harness only spawns the shipped CLI and writes
+  into a temp directory.
+* **Fail closed.** A package the runtime refuses to install (for example a peer
+  version gate) is reported as `install-rejected` or `install-failed`; the harness never grants a
+  version exemption and never bypasses the gate. A plugin that crashes the host
+  or hangs is bounded by a per-child timeout.
+* **The heuristic is not billing.** Context tokens use four characters per
+  token, the same heuristic the shipped token meter documents; CJK and JSON
+  schemas are underpriced by it. Extension fields (`dsh_session_log`,
+  `dsh_plugin_packages`) are measured separately and excluded.
+* **One turn, one profile shape.** The card does not measure multi-turn
+  behaviour, compaction, or client-side (browser) cost. Client slot
+  contributions are not observable host-side; only host-side surface is
+  reported.
+
+## Layout
+
+| Path | Role |
+|---|---|
+| `index.js` | The bundle entry: registers the `report_card` tool |
+| `harness/cli.mjs` | Command line entry |
+| `harness/generate.mjs` | measure → diff → grade → render → store |
+| `harness/measure.mjs` | The four-run loop, event parsing, request pricing |
+| `harness/mock-llm.mjs` | The local Messages endpoint and its SSE fixture |
+| `harness/probe/` | The fixture plugin that dumps a profile's surface |
+| `harness/risk.mjs` | Static disclosure scan |
+| `harness/report.mjs` | Grades, digest, drift, card assembly |
+| `harness/render.mjs` | Markdown card |
+| `harness/repeat.mjs` | Repeatability check for the harness itself |
+| `docs/` | An example card and the acceptance evidence |
+| `locale/`, `icon.svg`, `cordis.patch.yml` | Bundle metadata and its one insert row |
+| `test/` | Unit tests, end-to-end tests, fake plugins |
+
+## License
+
+MIT.

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+- insert:
+    - id: dsh-report-card
+      name: 'dsh-report-card'
+      config: {}

package/docs/acceptance.md

@@ -0,0 +1,127 @@
+# Acceptance evidence
+
+This file records what was actually measured when the v1 was built, on this
+machine, so the claims in the README can be checked rather than trusted.
+
+Machine: win32-x64, 8 logical CPUs, dsh 0.2.2-rc.1, Node v24.19.0 for the
+harness and Electron 44.7.0's Node v24.21.0 for the measured children.
+
+**The machine was not quiet.** A DeepSeek Harness Web session was running and
+actively issuing commands throughout, and several other builds shared the
+machine. That matters for the numbers below and is stated again where it
+changes their meaning.
+
+## 1. Same plugin, two runs
+
+Command:
+
+```powershell
+node harness/repeat.mjs ./test/fixtures/fake-plugin --runs 2 --samples 3
+```
+
+Result (raw output, 2026-11-10, final code):
+
+```
+metric                        run 1    run 2    spread   % of baseline
+boot CPU graded delta           0        0        0.0       0.00%
+boot CPU raw delta            -62     -172      110.0       4.24%
+boot wall graded delta        11.8      0       11.8       0.54%
+boot paired median delta      50.6     31.8      18.8       0.86%
+boot best-case delta          50.6    150.8     100.1       4.58%
+assembly graded delta          0.6      0        0.6       1.90%
+assembly paired median delta     5     -3        8.0      24.24%
+assembly best-case delta         3     -5        8.0      24.24%
+step best-case delta             7     -7       14.0      29.79%
+context token delta             76     76        0.0       0.00%
+baseline boot (median)       2186.1   2267.2     81.1       3.71%
+baseline assembly (median)      33       41        8.0      24.24%
+
+worst spread on a graded delta: 1.90% of its baseline (target: under 5%)
+PASS
+```
+
+Reading:
+
+* The **context delta is exact** (identical bytes, identical tokens) because the
+  prompt is a function of the profile, not of the machine.
+* The **graded deltas repeat inside 1.9% of their baseline**: boot CPU 0.00%,
+  assembly 1.90%. Both grades are noise-adjusted, so the fixture plugin (which
+  contributes one tool, one prompt section and two listeners) grades A in both
+  runs.
+* The **raw wall-clock deltas** also repeated well in this run — the round-paired
+  boot median moved 0.86%, the boot best case 4.58% — but that is luck, not a
+  guarantee: earlier in the same session, on a busier machine, baseline boot
+  medians moved by 19% between cards. The card prints its jitter and noise floor
+  so a reader can tell which situation they are in.
+* `step` (the whole `step_start → step_end` window) is the noisiest figure at
+  30% of a ~45 ms baseline; that is why it is reported but not graded. `assembly`
+  — the phase plugin hooks actually run in — is five times steadier.
+
+## 2. A measured plugin cannot touch the real profile
+
+Every report runs in a fresh tree and points the child at it:
+
+* `DSH_HOME` is a new `%TEMP%\dsh-report-card-*` directory, removed after the
+  report unless `--keep` is passed.
+* The profile is a fresh copy of the shipped `headless` template under that
+  home; the subject is copied or installed into *that* profile's
+  `node_modules`.
+* The working directory is an empty `workspace` directory under the same temp
+  tree.
+* The probe records the state it actually saw. A real card contains:
+
+```json
+"measuredEnvironment": {
+  "home": "C:\\Users\\conta\\AppData\\Local\\Temp\\dsh-report-card-XXXXXXXX\\home",
+  "cwd":  "C:\\Users\\conta\\AppData\\Local\\Temp\\dsh-report-card-XXXXXXXX\\workspace"
+}
+```
+
+so the isolation is part of the evidence, not a promise. `~/.dsh` is never
+passed to the child; the parent harness process never imports the subject.
+
+The one thing this does **not** do is sandbox the subject from the operating
+system: it runs as your user inside that disposable process. The README says so
+and the card lists the static risk flags before you install anything.
+
+## 3. Every number is reproducible from a command
+
+* The card prints its own command in the **Reproduce** section, e.g.
+  `node harness/cli.mjs "./test/fixtures/fake-plugin" --samples 3`.
+* `harness/cli.mjs --json` prints the same card as JSON, including every sample
+  and the digest.
+* `harness/repeat.mjs` runs a card N times and prints the spread (section 1).
+* A card's `digest` is the SHA-256 of the canonical JSON with the digest field
+  removed; `digestReport()` in `harness/report.mjs` recomputes it, and
+  `test/unit.test.mjs` proves the round-trip.
+
+## 4. `node test/*.mjs` covers the harness with fake plugins
+
+```
+$ node test/unit.test.mjs
+12 passed, 0 failed
+
+$ node test/harness.test.mjs
+ok   a fake plugin gets a complete, measured card
+ok   a plugin that fails to start is a failed card, not a crash
+ok   a plugin that kills the host is a failed boot, bounded
+ok   the second card compares with the first one for drift
+
+4 passed, 0 failed
+```
+
+The end-to-end test asserts the fixture's exact capability surface
+(`fixture_echo`, `tool:fixture_echo`, the `tools/pre-execute` listener, the
+loader entry and its `active` phase), the risk flags (install script, network
+host), the digest, the saved files, the failed-card path for a plugin that
+throws in `apply()`, the failed-boot path for a plugin that calls
+`process.exit()`, and drift on the second card.
+
+## 5. What v1 does not claim
+
+* Cross-machine comparability. Cards record the machine identity and are only
+  comparable within it.
+* Multi-turn, compaction, or client-side cost. One scripted turn, host side.
+* Sandboxing the subject. See section 2.
+* Billing-grade tokens. The estimate is the shipped token meter's documented
+  4-characters-per-token heuristic; CJK and JSON schemas are underpriced.

package/docs/example-card.md

@@ -0,0 +1,106 @@
+# Report card — @local/rc-fake-plugin@0.1.0
+
+**Grade D** · graded boot +6.3 ms CPU · graded turn 0 ms · context +76 tok · risk D
+
+> Fake plugin used by the report-card harness tests: one tool, one prompt section, one listener.
+
+## At a glance
+
+| Dimension | Baseline | Subject | Delta | Grade |
+| --- | --- | --- | --- | --- |
+| Boot wall (process → plugin tree) | 2397 / 2619 / 2734 ms | 2465 / 2625 / 2805 ms | +67.9 ms | — |
+| Boot CPU (process at ready) | 2780 / 2952 / 2953 ms | 2827 / 2921 / 2983 ms | +30 ms | A |
+| Turn (turn_start → turn_end) | 142 / 101 / 154 ms | 114 / 111 / 114 ms | -28 ms | — |
+| Assembly (step/start → request) | 88 / 38 / 60 ms | 48 / 46 / 45 ms | -15 ms | A |
+| Step (prompt → model answered) | 105 / 52 / 79 ms | 65 / 65 / 61 ms | -18 ms | — |
+| Context (model-visible tokens) | 6237 | 6313 | +76 tok | A |
+| Static risk flags | — | 3 | — | D |
+
+Samples: 3 per variant, medians shown. Boot jitter +2.5%; step jitter +67.1%.
+
+Grades charge only overhead above this machine's noise floor: boot CPU +6.3 ms graded from +30 ms raw (floor +23.7 ms), turn assembly 0 ms graded from -15 ms raw (floor +13.9 ms). Wall time is reported but never graded: it is hostage to whatever else the machine is doing.
+
+## Boot
+
+| Sample | Baseline | Subject |
+| --- | --- | --- |
+| 1 | 2397 ms | 2465 ms |
+| 2 | 2619 ms | 2625 ms |
+| 3 | 2734 ms | 2805 ms |
+
+Measured as process start (performance.timeOrigin) to the probe writing its dump (plugin tree composed). Deltas are round-paired medians (each subject run is paired with the baseline run before it), which cancels slow machine drift; the unpaired median difference was +6.3 ms. A negative delta means the subject booted sooner.
+
+Launch (spawn → the same dump, including process startup): baseline 2724 ms, subject 2734 ms, delta +36 ms.
+
+Boot CPU (the graded figure, total process CPU when the plugin tree is ready): baseline 2952 ms, subject 2921 ms, delta +30 ms raw, +6.3 ms after the noise floor. CPU time moves only when the plugin actually does work, so it stays stable on a loaded machine.
+
+## One scripted turn
+
+| Metric | Baseline | Subject | Delta |
+| --- | --- | --- | --- |
+| Turn | 142 / 101 / 154 ms | 114 / 111 / 114 ms | -28 ms |
+| Assembly (hook phase) | 88 / 38 / 60 ms | 48 / 46 / 45 ms | -15 ms |
+| Step (whole) | 105 / 52 / 79 ms | 65 / 65 / 61 ms | -18 ms |
+
+Best-case assembly delta +7 ms; graded assembly delta 0 ms — the per-turn figure that sets the turn grade.
+
+Measured as step_start to the first step_end on that turn, against local fixture endpoint, no network call.
+
+## Context tax
+
+| Field | Baseline | Subject | Delta |
+| --- | --- | --- | --- |
+| Model-visible chars | 24945 | 25249 | +304 |
+| · system prompt | 2758 | 2826 | +68 |
+| · tool schemas | 20369 | 20605 | +236 |
+| · conversation | 1818 | 1818 | 0 |
+| Estimated tokens | 6237 | 6313 | +76 |
+| Harness extension fields | 34142 | 34497 | +355 |
+
+Measured as model-visible bytes of the request the harness sent (system + tools + messages), tokens at 4 chars/token. Extension fields are request metadata the harness sends beside the model-visible prompt; they are listed separately and excluded from the token estimate.
+
+## Capability surface
+
+| Added | Detail |
+| --- | --- |
+| Tools | `fixture_echo` (235 schema chars) |
+| Prompt sections | `tool:fixture_echo` (66 chars) |
+| Event listeners | `tools/pre-execute` +1, `session/start` +1 |
+| Loader entries | `@local/rc-fake-plugin` |
+| Subject entry phase | active |
+| Prompt variables | none |
+| Profile size | 101 → 102 entries |
+
+## Static risk flags
+
+| Level | Flag | Detail |
+| --- | --- | --- |
+| high | `install-scripts` | runs code during install: postinstall |
+| medium | `file-write` | writes to the filesystem |
+| info | `network-hosts` | 1 host referenced: collector.example.test |
+
+Evidence:
+- `file-write` — index.js: `const writeReport = (file) => fs.writeFileSync(file, uploadUrl)`
+
+## Notes
+
+- Step samples vary by 67.1%; treat deltas below that as noise.
+
+## Method and limits
+
+Measured on win32-x64, 8 CPUs, dsh 0.2.2-rc.1, Node v24.19.0.
+
+- Profile: `headless` template, fresh profile copied from a shipped template, fresh DSH_HOME per report.
+- Isolation: empty workspace directory, read-only file policy; the subject never touches your real profile.
+- The subject still runs with your user privileges inside that disposable process. Read the risk flags before installing anything you did not write.
+- Numbers are comparable only on the same machine identity; the digest changes whenever any number does.
+
+## Reproduce
+
+```
+node harness/cli.mjs "./test/fixtures/fake-plugin" --samples 3
+```
+
+Digest: `sha256:55ffdbf5e230a5fbc258445d58a126290e97e0e2c47fe8cfbaae36bd122918c3`
+
+Generated 2026-11-10T16:27:44.348Z by `dsh-report-card` (dsh-report-card/1).