dsh-standards 0.0.2 → 1.0.0

package/40-checker/scripts/attestation-check.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+/**
+ * attestation-check.mjs — validate DSH attestation JSON.
+ *
+ * The attestation is a quality-grade document (A-E evidence, A-D grade). It is
+ * orthogonal to the adoption levels: a `level` field is a hard error.
+ *
+ * Usage:
+ *   node 40-checker/scripts/attestation-check.mjs --dir publish/attestations
+ *   node 40-checker/scripts/attestation-check.mjs --file path/to/cert.json --json
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const DEFAULT_ROOT = path.resolve(HERE, '..', '..')
+const STATUS = new Set(['draft', 'active', 'suspended', 'withdrawn', 'expired'])
+const GRADES = new Set(['A', 'B', 'C', 'D'])
+const DIMENSIONS = new Set(['A', 'B', 'C', 'D', 'E'])
+
+function date(value) {
+  return typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(value) && !Number.isNaN(Date.parse(value))
+}
+
+export function validateAttestation(cert) {
+  const errors = []
+  const warn = (m) => errors.push(`WARN ${m}`)
+  const err = (m) => errors.push(m)
+  if (!cert || typeof cert !== 'object') return { errors: ['attestation must be an object'] }
+  if (cert.schema !== 'dsh-attestation/1') err('schema must be dsh-attestation/1')
+  if ('level' in cert) err('attestation must not contain a level field (A-D is orthogonal to ENTRY/FLOW/BOOST)')
+  if (!/^DSH-ATT-\d{4}-\d{3}$/.test(cert.attestationId || '')) err('attestationId must match DSH-ATT-YYYY-NNN')
+  if (!cert.subject || !cert.subject.repo || !cert.subject.version) err('subject.repo and subject.version are required')
+  if (!GRADES.has(cert.grade)) err('grade must be A, B, C, or D')
+  if (!['self-reported', 'verified', 'peer-reviewed'].includes(cert.claimLevel)) {
+    err('claimLevel must be self-reported, verified, or peer-reviewed')
+  }
+  if (cert.selfAssessed === true && cert.claimLevel !== 'self-reported') {
+    err('a self-assessed record cannot claim verified or peer-reviewed')
+  }
+  if (!STATUS.has(cert.status)) err('status must be draft|active|suspended|withdrawn|expired')
+  if (!date(cert.issuedAt)) err('issuedAt must be YYYY-MM-DD')
+  if (!date(cert.expiresAt)) err('expiresAt must be YYYY-MM-DD')
+  if (date(cert.issuedAt) && date(cert.expiresAt) && Date.parse(cert.expiresAt) <= Date.parse(cert.issuedAt)) {
+    err('expiresAt must be after issuedAt')
+  }
+  if (date(cert.expiresAt) && Date.parse(cert.expiresAt) < Date.now() && cert.status === 'active') {
+    err('an expired attestation cannot be active; set status=expired')
+  }
+  if (!cert.scope || !Array.isArray(cert.scope.dimensions) || cert.scope.dimensions.length === 0) {
+    err('scope.dimensions must list A-E')
+  } else {
+    for (const dimension of cert.scope.dimensions) if (!DIMENSIONS.has(dimension)) err(`invalid scope dimension ${dimension}`)
+  }
+  if (!Array.isArray(cert.scope?.excluded) || cert.scope.excluded.length === 0) {
+    err('scope.excluded must state what the attestation does NOT cover')
+  }
+  if (!cert.scheme || cert.scheme.id !== 'dsh-certification' || !cert.scheme.version) err('scheme.id/version required')
+  if (!cert.assessor || !cert.assessor.handle) err('assessor.handle required')
+  if (cert.assessor && !['organizer', 'maintainer', 'reviewer', 'external-reviewer'].includes(cert.assessor.role)) {
+    err('assessor.role is invalid')
+  }
+  if (cert.assessor && !Array.isArray(cert.assessor.coi)) err('assessor.coi must be an array')
+  if (typeof cert.selfAssessed !== 'boolean') err('selfAssessed must be boolean')
+  if (cert.selfAssessed === true && !(cert.assessor?.coi || []).some((s) => /self|author|own/i.test(s))) {
+    warn('selfAssessed is true but assessor.coi does not mention the self/author conflict')
+  }
+  if (typeof cert.disclaimer !== 'string' || cert.disclaimer.length < 12) err('disclaimer must be a real sentence')
+  else if (!/非官方|not official|非认证|not a certification/i.test(cert.disclaimer)) {
+    err('disclaimer must say non-official and/or not a certification')
+  }
+  if (!/^https:\/\//.test(cert.verifyUrl || '')) err('verifyUrl must be https')
+  if (!Array.isArray(cert.evidence) || cert.evidence.length === 0) err('evidence must not be empty')
+  const ids = new Set()
+  for (const item of cert.evidence || []) {
+    if (!DIMENSIONS.has(item.id)) err(`evidence id ${item.id} must be A-E`)
+    if (ids.has(item.id)) err(`duplicate evidence id ${item.id}`)
+    ids.add(item.id)
+    if (!['PASS', 'FAIL', 'WARN', 'NOT-RUN'].includes(item.result)) err(`evidence ${item.id} result is invalid`)
+    if (!item.url && !item.sha256) err(`evidence ${item.id} needs a url or sha256`)
+    if (item.url && !/^https:\/\//.test(item.url)) err(`evidence ${item.id} url must be https`)
+  }
+  for (const item of cert.evidence || []) {
+    if (item.result === 'PASS' && !item.url && !item.sha256) err(`evidence ${item.id} cannot PASS without an artifact`)
+  }
+  return { errors: errors.filter((e) => !e.startsWith('WARN ')), warnings: errors.filter((e) => e.startsWith('WARN ')).map((e) => e.slice(5)) }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  let root = DEFAULT_ROOT
+  let dir = 'publish/attestations'
+  let file = null
+  let json = false
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--root') root = path.resolve(argv[++i])
+    else if (arg === '--dir') dir = argv[++i]
+    else if (arg === '--file') file = path.resolve(argv[++i])
+    else if (arg === '--json') json = true
+    else if (arg === '--help' || arg === '-h') {
+      console.log('usage: attestation-check.mjs [--root <dir>] [--dir <dir>] [--file <json>] [--json]')
+      return 0
+    } else {
+      console.error(`unknown argument: ${arg}`)
+      return 2
+    }
+  }
+  let files = []
+  if (file) files = [file]
+  else {
+    const full = path.join(root, dir)
+    if (!fs.existsSync(full)) {
+      console.error(`attestation-check: directory not found: ${full}`)
+      return 2
+    }
+    files = fs.readdirSync(full).filter((name) => name.endsWith('.json') && name !== 'index.json').map((name) => path.join(full, name)).sort()
+  }
+  if (files.length === 0) {
+    console.error('attestation-check: no attestation JSON found')
+    return 2
+  }
+  const results = []
+  let failed = 0
+  for (const item of files) {
+    try {
+      const cert = JSON.parse(fs.readFileSync(item, 'utf8'))
+      const result = validateAttestation(cert)
+      if (result.errors.length > 0) failed += 1
+      results.push({ file: path.relative(root, item), attestationId: cert.attestationId, ...result })
+    } catch (error) {
+      failed += 1
+      results.push({ file: path.relative(root, item), errors: [`parse error: ${error.message}`], warnings: [] })
+    }
+  }
+  if (json) {
+    console.log(JSON.stringify({ ok: failed === 0, results }, null, 2))
+  } else {
+    for (const result of results) {
+      for (const warning of result.warnings) console.log(`WARN ${result.file}: ${warning}`)
+      for (const error of result.errors) console.log(`FAIL ${result.file}: ${error}`)
+      console.log(`${result.errors.length === 0 ? 'PASS' : 'FAIL'} ${result.file}`)
+    }
+    console.log(`${failed === 0 ? 'PASS' : 'FAIL'} attestation: ${results.length} file(s), ${failed} failed`)
+  }
+  return failed === 0 ? 0 : 2
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main()
+}

package/40-checker/scripts/bundle-smoke.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * Minimal host-backed bundle smoke: G0 patch parse, G1 compose/row ids,
+ * G3 real boot target rows. G2 compatibility is reported from the host API.
+ *
+ * The checker stays zero-dependency: this script is only used when --host
+ * points at a built @deepseek-ai/dsh-app-boot/lib/index.js.
+ *
+ * Usage:
+ *   node scripts/bundle-smoke.mjs --package <dir> --host <app-boot/lib/index.js> \
+ *     [--base <base/cordis.patch.yml>] [--json] [--timeout 30000]
+ */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+function parse(argv) {
+  const options = { package: null, host: null, base: null, web: null, bare: null, json: false, timeout: 30_000 }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--package') options.package = argv[++i]
+    else if (arg === '--host') options.host = argv[++i]
+    else if (arg === '--base') options.base = argv[++i]
+    else if (arg === '--web') options.web = argv[++i]
+    else if (arg === '--bare') options.bare = argv[++i]
+    else if (arg === '--json') options.json = true
+    else if (arg === '--timeout') options.timeout = Number(argv[++i])
+    else if (arg === '--help' || arg === '-h') { console.log('usage: node scripts/bundle-smoke.mjs --package <dir> --host <app-boot/lib/index.js> [--base <patch>] [--json]'); process.exit(0) }
+    else throw new Error(`unknown option: ${arg}`)
+  }
+  if (!options.package) throw new Error('--package is required')
+  if (!options.host) throw new Error('--host is required')
+  if (!Number.isFinite(options.timeout) || options.timeout < 1000) throw new Error('--timeout must be >= 1000')
+  return options
+}
+
+function withTimeout(promise, ms, label) {
+  let timer
+  const timeout = new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms); timer.unref?.() })
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer))
+}
+
+async function main() {
+  const options = parse(process.argv.slice(2))
+  const pkg = path.resolve(options.package)
+  const manifest = JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'), 'utf8'))
+  const host = await import(pathToFileURL(path.resolve(options.host)).href)
+  const { loadOverlayPatches, composeEntries, boot, getDshRuntimeVersion, evaluatePluginCompatibility } = host
+  if (typeof loadOverlayPatches !== 'function' || typeof composeEntries !== 'function' || typeof boot !== 'function') throw new Error('host does not export loadOverlayPatches/composeEntries/boot')
+  const bundle = manifest.dsh?.bundle
+  if (!bundle?.patch) throw new Error('manifest has no dsh.bundle.patch')
+  const files = Array.isArray(bundle.patch) ? bundle.patch : [bundle.patch]
+  const patchPaths = files.map(file => path.resolve(pkg, file))
+  const targetPatches = patchPaths.flatMap(file => loadOverlayPatches('dsh', file))
+  const basePatches = options.base ? loadOverlayPatches('dsh', path.resolve(options.base)) : []
+  const webPatches = options.web ? loadOverlayPatches('dsh', path.resolve(options.web)) : []
+  const layers = [basePatches, webPatches, targetPatches].filter(layer => layer.length > 0)
+  const composed = composeEntries(layers, message => { warnings.push(message) })
+  const baseIds = new Set(composeEntries([basePatches, webPatches].filter(layer => layer.length > 0)).filter(row => row.id).map(row => row.id))
+  const targetIds = new Set(composed.filter(row => row.id && !baseIds.has(row.id)).map(row => row.id))
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-bundle-smoke-'))
+  const config = path.join(root, 'cordis.yml')
+  fs.writeFileSync(config, '[]\n')
+  const previousHome = process.env.DSH_HOME
+  process.env.DSH_HOME = path.join(root, 'home')
+  fs.mkdirSync(process.env.DSH_HOME, { recursive: true })
+  let ctx
+  let rows = []
+  let state = 'failed'
+  try {
+    const bare = options.bare ? pathToFileURL(path.resolve(options.bare)).href + '/' : pathToFileURL(path.join(root)).href + '/'
+    ctx = await withTimeout(boot('bundle-smoke', config, layers.flat(), undefined, bare), options.timeout, 'bundle boot')
+    const entries = [...ctx.loader.entries()]
+    // A bundle insert is composed under an `include:` group, so the group's
+    // fiber can stay null while the inserted plugin row activates. Match the
+    // inserted row's package name as well as its id, never only the wrapper.
+    const targetNames = new Set(composed
+      .filter(row => row.id && !baseIds.has(row.id) && typeof row.name === 'string')
+      .map(row => row.name))
+    rows = entries.filter(entry => [...targetIds].some(id => entry.id === id || String(entry.id).endsWith(`:${id}`))
+      || targetNames.has(entry.name)).map(entry => ({ id: entry.id, name: entry.name, state: entry.fiber?.state ?? null, disabled: entry.disabled === true }))
+    const active = rows.filter(row => row.state === 2 || row.disabled).length
+    state = rows.length > 0 && active === rows.length ? 'verified' : rows.length > 0 ? 'partial' : 'failed'
+  } finally {
+    try { await ctx?.dispose?.() } catch { /* ignore */ }
+    if (previousHome === undefined) delete process.env.DSH_HOME
+    else process.env.DSH_HOME = previousHome
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+  const compatibility = typeof evaluatePluginCompatibility === 'function' && typeof getDshRuntimeVersion === 'function'
+    ? (() => { try { return evaluatePluginCompatibility(manifest, {}, getDshRuntimeVersion()) === undefined ? 'admit' : 'reject' } catch { return 'error' } })()
+    : 'unknown'
+  const hasClient = Boolean(manifest.dsh?.client)
+  const clientEntry = manifest.exports?.['./client']
+  const clientExport = typeof clientEntry === 'string'
+    || (typeof clientEntry === 'object' && clientEntry !== null && typeof clientEntry.default === 'string')
+  // G4 is a composition property: the package's own root row must exist in
+  // the composed layer. Runtime `entries` names an `include:` wrapper instead,
+  // so reading only activated entries produced false negatives for bundles
+  // whose insert is wrapped in an include group.
+  const rootRows = composed.filter(row => row.name === manifest.name || row.name === '.' || row.name === './')
+  const result = {
+    schema: 'dsh-bundle-smoke/1',
+    package: manifest.name,
+    version: manifest.version,
+    g0: { patchFiles: patchPaths.length, parsed: true },
+    g1: { rows: composed.length, targetRows: targetIds.size, warnings },
+    g2: { compatibility },
+    g3: { state, rows, active: rows.filter(row => row.state === 2 || row.disabled).length },
+    g4: { hasClient, clientExport, rootRows, ok: !hasClient || (clientExport && rootRows.length > 0) },
+  }
+  const output = JSON.stringify(result, null, 2)
+  const exitCode = state === 'verified' ? 0 : state === 'partial' ? 2 : 1
+  // A real boot can leave host-owned timers, sockets, or workers referenced
+  // after dispose. This smoke owns the whole process, so terminate once the
+  // result is flushed instead of making the caller wait for a handle it cannot
+  // see. Without this, a completed boot looks like a timeout to CI.
+  process.stdout.write(`${output}\n`, () => process.exit(exitCode))
+}
+
+const warnings = []
+try { await main() } catch (error) {
+  console.error(`bundle-smoke: ${error.message}`)
+  process.exit(3)
+}

package/40-checker/scripts/claim-check.mjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+/**
+ * claim-check.mjs — conservative scan for mark misuse in public artifacts.
+ *
+ * It only scans market-facing directories by default (publish/, adoption/) plus
+ * README.md. Documentation that *quotes* forbidden words (governance, research
+ * notes) is intentionally out of scope.
+ *
+ * A line fails when it contains a forbidden claim word and no negation, e.g.
+ * "DSH-ENTRY official certification" fails, while "not official" passes.
+ *
+ * Usage:
+ *   node 40-checker/scripts/claim-check.mjs [--root <dir>] [--json]
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const DEFAULT_ROOT = path.resolve(HERE, '..', '..')
+const MARKS = /\bDSH-(?:ENTRY|FLOW|BOOST)\b/i
+const FORBIDDEN = [
+  /\bofficial\b/i,
+  /\bnational standard\b/i,
+  /\bCNAS\b/i,
+  /\baccredited\b/i,
+  /\bcertified\b/i,
+  /\bsecurity audit\b/i,
+  /\brecommended\b/i,
+  /\branking\b/i,
+  /\bguaranteed\b/i,
+  /\bapproved by deepseek\b/i,
+  /国家标准/,
+  /官方认证/,
+  /国家认可/,
+  /安全审计/,
+  /推荐标准/,
+  /排名/,
+]
+const NEGATION = /\bnot\b|\bno\b|\bnever\b|\bnon-|\bforbidden\b|\bprohibit|\bdoes not\b|\bcannot\b|非官方|非认证|不是|不得|禁止|不应|不能|不卖|不做|不把|不称|不提供|不收费|不推荐/i
+const SKIP_JSON_KEYS = new Set(['forbiddenWords', 'notClaimed', 'excluded', 'forbidden', 'limitations', 'mustNot', 'cannot'])
+// "official team" is an audience, not a claim about the mark. Strip it before scanning.
+const ALLOWED_CONTEXT = /\bofficial (?:team|adoption|kit|directory|channel)\b|\bofficial\//gi
+const STRONG_CLAIM = /official (?:certification|standard|endorsement)|officially certified|官方认证|国家标准|国家认可/i
+
+function walk(dir, out) {
+  if (!fs.existsSync(dir)) return
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) walk(full, out)
+    else if (/\.(md|json|txt)$/.test(entry.name)) out.push(full)
+  }
+}
+
+export function scanText(text, file) {
+  const errors = []
+  const warnings = []
+  const lines = text.split(/\r?\n/)
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i]
+    const hasMark = MARKS.test(line)
+    // Without a mark, only a strong claim ("official certification") fails;
+    // a bare "official team" or a path like adoption/official/ is not a claim.
+    if (!hasMark && !STRONG_CLAIM.test(line)) continue
+    const probe = line.replace(ALLOWED_CONTEXT, ' ')
+    if (!hasMark && !FORBIDDEN.some((re) => re.test(probe))) continue
+    const context = lines.slice(Math.max(0, i - 2), i + 2).join(' ')
+    if (NEGATION.test(probe) || NEGATION.test(context)) continue
+    for (const re of FORBIDDEN) {
+      if (re.test(probe)) {
+        errors.push(`${file}:${i + 1}: forbidden claim "${line.trim().slice(0, 120)}"`)
+        break
+      }
+    }
+  }
+  if (MARKS.test(text) && !/非官方|not official|非认证|not a certification/i.test(text)) {
+    warnings.push(`${file}: mark used without a same-page disclaimer`)
+  }
+  return { errors, warnings }
+}
+
+function collectClaimStrings(value, key, out) {
+  if (typeof value === 'string') {
+    if (!SKIP_JSON_KEYS.has(key)) out.push(value)
+    return
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectClaimStrings(item, key, out)
+    return
+  }
+  if (value && typeof value === 'object') {
+    for (const [childKey, child] of Object.entries(value)) collectClaimStrings(child, childKey, out)
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  let root = DEFAULT_ROOT
+  let json = false
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    if (arg === '--root') root = path.resolve(argv[++i])
+    else if (arg === '--json') json = true
+    else if (arg === '--help' || arg === '-h') {
+      console.log('usage: claim-check.mjs [--root <dir>] [--json]')
+      return 0
+    } else {
+      console.error(`unknown argument: ${arg}`)
+      return 2
+    }
+  }
+  const files = [path.join(root, 'README.md')]
+  walk(path.join(root, 'publish'), files)
+  walk(path.join(root, 'adoption'), files)
+  const results = []
+  for (const file of files) {
+    if (!fs.existsSync(file)) continue
+    if (/mark-policy\.(md|json)$/.test(file)) continue
+    let text = fs.readFileSync(file, 'utf8')
+    if (file.endsWith('.json')) {
+      try {
+        const strings = []
+        collectClaimStrings(JSON.parse(text), '', strings)
+        text = strings.join('\n')
+      } catch (error) {
+        results.push({ errors: [`${path.relative(root, file)}: parse error: ${error.message}`], warnings: [] })
+        continue
+      }
+    }
+    const result = scanText(text, path.relative(root, file))
+    if (result.errors.length || result.warnings.length) results.push(result)
+  }
+  const errors = results.flatMap((r) => r.errors)
+  const warnings = results.flatMap((r) => r.warnings)
+  if (json) console.log(JSON.stringify({ ok: errors.length === 0, errors, warnings }, null, 2))
+  else {
+    for (const warning of warnings) console.log(`WARN ${warning}`)
+    for (const error of errors) console.log(`FAIL ${error}`)
+    console.log(`${errors.length === 0 ? 'PASS' : 'FAIL'} claims: ${errors.length} error(s), ${warnings.length} warning(s)`)
+  }
+  return errors.length === 0 ? 0 : 2
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main()
+}

package/40-checker/scripts/clause-map.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * clause-map.mjs — validate the stable clause IDs against spec/levels.json.
+ *
+ * It checks:
+ *   - every gate in levels.json is covered by at least one clause;
+ *   - every clause points to an existing source file;
+ *   - clause IDs are unique;
+ *   - no clause maps to a gate that does not exist;
+ *   - every clause has a level that exists.
+ *
+ * It does not parse the prose; a human still owns the semantics.
+ *
+ * Usage: node 40-checker/scripts/clause-map.mjs [--check] [--json]
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const LEVELS = path.join(ROOT, 'spec', 'levels.json')
+const CLAUSES = path.join(ROOT, 'spec', 'clauses.json')
+
+export function validateClauseMap({ levels, clauses, root = ROOT }) {
+  const errors = []
+  const warnings = []
+  const ids = new Set()
+  const knownGates = new Map()
+  for (const level of levels.levels || []) {
+    knownGates.set(level.id, new Set((level.gates || []).map((gate) => gate.id)))
+  }
+  const covered = new Map([...knownGates.keys()].map((id) => [id, new Set()]))
+  for (const clause of clauses.clauses || []) {
+    if (!clause.id) { errors.push('clause without id'); continue }
+    if (ids.has(clause.id)) errors.push(`duplicate clause id: ${clause.id}`)
+    ids.add(clause.id)
+    if (!knownGates.has(clause.level)) {
+      errors.push(`${clause.id}: unknown level ${clause.level}`)
+      continue
+    }
+    if (!Array.isArray(clause.gates) || clause.gates.length === 0) {
+      errors.push(`${clause.id}: no gates`)
+      continue
+    }
+    for (const gate of clause.gates) {
+      if (!knownGates.get(clause.level).has(gate)) {
+        errors.push(`${clause.id}: gate ${gate} does not exist in level ${clause.level}`)
+      } else {
+        covered.get(clause.level).add(gate)
+      }
+    }
+    const source = String(clause.source || '').split('#')[0]
+    if (!source || !fs.existsSync(path.join(root, source))) {
+      errors.push(`${clause.id}: source file not found: ${source}`)
+    }
+  }
+  for (const [level, gates] of knownGates) {
+    for (const gate of gates) {
+      if (!covered.get(level).has(gate)) errors.push(`${level}.${gate}: no clause maps to this gate`)
+    }
+  }
+  if (!clauses.normativeCount) warnings.push('clauses.json has no normativeCount; not required')
+  return { errors, warnings, covered: Object.fromEntries([...covered].map(([k, v]) => [k, [...v].sort()])) }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  let json = false
+  for (const arg of argv) {
+    if (arg === '--json') json = true
+    else if (arg === '--check') { /* default behaviour */ }
+    else if (arg === '--help' || arg === '-h') {
+      console.log('usage: clause-map.mjs [--check] [--json]')
+      return 0
+    } else {
+      console.error(`unknown argument: ${arg}`)
+      return 2
+    }
+  }
+  const levels = JSON.parse(fs.readFileSync(LEVELS, 'utf8'))
+  const clauses = JSON.parse(fs.readFileSync(CLAUSES, 'utf8'))
+  const result = validateClauseMap({ levels, clauses })
+  if (json) console.log(JSON.stringify(result, null, 2))
+  else {
+    for (const warning of result.warnings) console.log(`WARN ${warning}`)
+    for (const error of result.errors) console.log(`FAIL ${error}`)
+    console.log(`${result.errors.length === 0 ? 'PASS' : 'FAIL'} clause map: ${Object.keys(result.covered).map((k) => `${k}=${result.covered[k].length}`).join(' ')}`)
+  }
+  return result.errors.length === 0 ? 0 : 2
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main()
+}

package/40-checker/scripts/collect-fixtures.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * Collect the known-answer fixture statuses for one runner (OS/Node).
+ * Output is the input format of round-robin.mjs.
+ *
+ * Usage: node 40-checker/scripts/collect-fixtures.mjs --out runner.json
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const CHECKER = path.join(ROOT, '40-checker', 'bin', 'dsh-plugin-verify.mjs')
+
+function run(dir) {
+  const r = spawnSync(process.execPath, [CHECKER, dir, '--scope', 'entry', '--entry-claim', 'static', '--format', 'json'], { encoding: 'utf8', timeout: 120_000, maxBuffer: 8 * 1024 * 1024 })
+  try {
+    const parsed = JSON.parse(r.stdout)
+    return parsed.conclusion?.status ?? 'error'
+  } catch {
+    return 'error'
+  }
+}
+
+function main() {
+  let out = path.join(ROOT, 'runner.json')
+  for (let i = 0; i < process.argv.length; i += 1) {
+    if (process.argv[i] === '--out') out = path.resolve(process.argv[++i])
+  }
+  const result = {
+    runner: `dsh-plugin-verify@0.1.0 (${process.platform}/${process.arch}, node ${process.version})`,
+    anchor: { dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1' },
+    results: {
+      good: { status: run(path.join(ROOT, '40-checker/fixtures/good')), artifact: 'fixtures/good' },
+      'bad-manifest': { status: run(path.join(ROOT, '40-checker/fixtures/bad-manifest')), artifact: 'fixtures/bad-manifest' },
+      skipped: { status: 'not-run', artifact: null },
+    },
+  }
+  fs.writeFileSync(out, `${JSON.stringify(result, null, 2)}\n`)
+  console.log(JSON.stringify(result, null, 2))
+}
+main()

package/40-checker/scripts/dashboard.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * dashboard.mjs — build a small, honest status dashboard from existing results.
+ * It never infers a PASS from a missing file.
+ *
+ * Usage: node 40-checker/scripts/dashboard.mjs [--out dashboard.json]
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const RESULTS = path.join(ROOT, '40-checker', 'results')
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return null }
+}
+
+function countFiles(dir, suffix = '.json') {
+  if (!fs.existsSync(dir)) return 0
+  return fs.readdirSync(dir).filter((name) => name.endsWith(suffix)).length
+}
+
+export function buildDashboard(root = ROOT) {
+  const results = path.join(root, '40-checker', 'results')
+  const entryDir = path.join(results, 'entry', '18')
+  const entryFiles = fs.existsSync(entryDir)
+    ? fs.readdirSync(entryDir).filter((name) => name.endsWith('.json') && !name.endsWith('.runtime.json')).length
+    : 0
+  const flowIndex = readJson(path.join(results, 'flow', 'real', 'index.json'))
+  const boost = readJson(path.join(results, 'boost', 'lev12458.json'))
+  const attestations = readJson(path.join(root, 'publish', 'attestations', 'index.json'))
+  const gov = readJson(path.join(root, 'governance', 'roles.json'))
+  const chain = fs.existsSync(path.join(root, 'evidence', 'chain.jsonl'))
+    ? fs.readFileSync(path.join(root, 'evidence', 'chain.jsonl'), 'utf8').split('\n').filter(Boolean).length
+    : 0
+  return {
+    schema: 'dsh-dashboard/1',
+    generatedAt: new Date().toISOString(),
+    entry: {
+      resultFiles: entryFiles,
+      claim: '18/18 recognized static; 10 G3 verified, 8 partial (see results/entry/18/README.md)',
+    },
+    flow: {
+      packages: flowIndex?.samples?.length ?? flowIndex?.results?.length ?? 0,
+      summary: flowIndex?.totals ?? flowIndex?.summary ?? null,
+      claim: 'J1/J2/J4/J6 runtime on a fixture and 10 real packages; J3/J5/J7/J8 not-run',
+    },
+    boost: {
+      measured: boost?.summary?.measured ?? null,
+      measuredCount: boost?.summary?.measured?.length ?? 0,
+      claim: 'LEV-1-8 measured at synthetic/loader level; not a production baseline',
+    },
+    attestations: {
+      count: attestations?.attestations?.length ?? 0,
+      draft: (attestations?.attestations || []).filter((a) => a.status === 'draft').length,
+      selfReported: (attestations?.attestations || []).filter((a) => a.claimLevel === 'self-reported').length,
+    },
+    governance: {
+      schema: gov?.schema ?? null,
+      stage: gov?.stage ?? null,
+      status: gov?.status ?? null,
+    },
+    evidenceChainEntries: chain,
+    notClaimed: ['official standard', 'certification', 'security audit', 'production readiness', 'ranking'],
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  let out = path.join(ROOT, 'dashboard.json')
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--out') out = path.resolve(argv[++i])
+    else if (argv[i] === '--help' || argv[i] === '-h') { console.log('usage: dashboard.mjs [--out <file>]'); return 0 }
+    else { console.error(`unknown argument: ${argv[i]}`); return 2 }
+  }
+  const dashboard = buildDashboard(ROOT)
+  fs.writeFileSync(out, `${JSON.stringify(dashboard, null, 2)}\n`)
+  console.log(JSON.stringify(dashboard, null, 2))
+  return 0
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.exitCode = main()
+}