dsh-standards 0.0.2 → 1.0.0

package/40-checker/results/flow/real/verification.json

@@ -0,0 +1,265 @@
+{
+  "schema": "dsh-flow-real/1",
+  "generatedAt": "2026-11-01T05:42:31.708Z",
+  "id": "verification",
+  "package": "dsh-verification-receipt",
+  "version": "0.1.0",
+  "entry18Version": "0.1.0",
+  "source": "npm",
+  "spec": "dsh-verification-receipt@0.1.0",
+  "why": "second wave: expected gate/host edge",
+  "packageDir": "/tmp/flow-sample/verification",
+  "download": {
+    "kind": "npm-pack",
+    "command": "npm pack dsh-verification-receipt@0.1.0 --pack-destination /tmp/flow-sample/_cache",
+    "tarball": "/tmp/flow-sample/_cache/dsh-verification-receipt-0.1.0.tgz",
+    "registry": "https://registry.npmmirror.com",
+    "actualVersion": "0.1.0"
+  },
+  "manifest": {
+    "name": "dsh-verification-receipt",
+    "version": "0.1.0",
+    "engines": {
+      "node": "^22.19.0 || >=24.0.0"
+    },
+    "peerDependencies": {
+      "@deepseek-ai/cordis": "^4.0.1",
+      "@deepseek-ai/dsh-session": ">=0.1.0-rc.5 <0.1.0",
+      "@deepseek-ai/schemastery": "^3.18.1"
+    },
+    "dependencies": {
+      "@deepseek-ai/schemastery": "3.18.1"
+    },
+    "scripts": {
+      "postinstall": null
+    },
+    "dsh": {
+      "bundle": {
+        "patch": "./cordis.patch.yml"
+      }
+    }
+  },
+  "dependencyInstall": {
+    "needed": true,
+    "command": "npm install --omit=dev --ignore-scripts --legacy-peer-deps --no-package-lock",
+    "exit": 0,
+    "ignoredScripts": true,
+    "note": "third-party lifecycle scripts were not run (--ignore-scripts)",
+    "stdout": "\nup to date, audited 1 package in 795ms\n\nfound 0 vulnerabilities\n",
+    "stderr": "",
+    "error": null
+  },
+  "previous": null,
+  "gate": null,
+  "journey": {
+    "command": "<home>/opt/node-v24.22.1-linux-x64/bin/node <standards>/40-checker/scripts/journey-runtime.mjs --package /tmp/flow-sample/verification --dsh /tmp/dsh022/node_modules/@deepseek-ai/dsh/lib/bin.js --json",
+    "exit": 1,
+    "parseError": null,
+    "stderr": "",
+    "result": {
+      "schema": "dsh-flow-runtime/1",
+      "environment": {
+        "dsh": "0.2.2-alpha.2",
+        "node": "v24.22.1",
+        "platform": "linux"
+      },
+      "package": "dsh-verification-receipt",
+      "version": "0.1.0",
+      "previous": null,
+      "mode": "j1-j2-j4-j6-runtime",
+      "checks": [
+        {
+          "id": "J1.profile",
+          "result": "PASS",
+          "reason": "create profile exit=0",
+          "stderr": ""
+        },
+        {
+          "id": "J1.install",
+          "result": "BLOCKED",
+          "reason": "host compatibility gate rejected the install (no exemption granted)",
+          "stderr": "\ndsh: installation rejected: Plugin dsh-verification-receipt@0.1.0 is incompatible with dsh 0.2.2-alpha.2: requirements {\"@deepseek-ai/dsh-session\":\">=0.1.0-rc.5 <0.1.0\"}. Running it may cause crashes or data loss. Update the plugin or install a plugin version compatible with this dsh runtime. To accept this risk explicitly, grant the exact-version exemption for dsh-verification-receipt@0.1.0 on dsh 0.2.2-alpha.2 with `dsh plugin allow-version` or the plugin manager, then retry the installation or restart dsh. Exact-version exemption: not active.\ndsh: nothing was installed.\ndsh: to accept the risk, run: dsh plugin --profile flow-journey allow-version dsh-verification-receipt@0.1.0 --dsh-version 0.2.2-alpha.2 --accept-risk\ndsh: plugin command failed; diagnostics: /tmp/dsh-journey-7c2BA7/pro"
+        },
+        {
+          "id": "J1.dump",
+          "result": "PASS",
+          "reason": "dump exit=0",
+          "stderr": ""
+        },
+        {
+          "id": "J1.layer",
+          "result": "FAIL",
+          "reason": "plugin/bundle not visible in dump"
+        },
+        {
+          "id": "J2.toggle",
+          "result": "not-run",
+          "reason": "could not locate the inserted row id in dump-config"
+        },
+        {
+          "id": "J1.remove",
+          "result": "FAIL",
+          "reason": "remove exit=1",
+          "stderr": "Error: ERR_PNPM_CANNOT_REMOVE_MISSING_DEPS\n\n  × removing a package\n  ╰─▶ Cannot remove 'dsh-verification-receipt': project has no dependencies of\n      any kind\n\ndsh: plugin command failed; diagnostics: /tmp/dsh-journey-7c2BA7/profiles/flow-journey/.plugin-manager/logs/operation-UU4ak3/pnpm.log\n"
+        },
+        {
+          "id": "J1.clean",
+          "result": "FAIL",
+          "reason": "layer/dependency gone after remove"
+        },
+        {
+          "id": "J4.tree-load",
+          "result": "FAIL",
+          "reason": "reinstall exit=1",
+          "stderr": "\ndsh: installation rejected: Plugin dsh-verification-receipt@0.1.0 is incompatible with dsh 0.2.2-alpha.2: requirements {\"@deepseek-ai/dsh-session\":\">=0.1.0-rc.5 <0.1.0\"}. Running it may cause crashes or data loss. Update the plugin or install a plugin version compatible with this dsh runtime. To accept this risk explicitly, grant the exact-version exemption for dsh-verification-receipt@0.1.0 on dsh 0.2.2-alpha.2 with `dsh plugin allow-version` or the plugin manager, then retry the installation "
+        },
+        {
+          "id": "J6.upgrade",
+          "result": "not-run",
+          "reason": "no --previous package supplied"
+        },
+        {
+          "id": "J6.rollback",
+          "result": "not-run",
+          "reason": "no --previous package supplied"
+        },
+        {
+          "id": "J3.config",
+          "result": "not-run",
+          "reason": "invalid-config harness not implemented; do not claim J3"
+        },
+        {
+          "id": "J5.permissions",
+          "result": "not-run",
+          "reason": "permissions/disclosure review is manual"
+        },
+        {
+          "id": "J7.observe",
+          "result": "not-run",
+          "reason": "observability probe not implemented"
+        },
+        {
+          "id": "J8.client",
+          "result": "not-run",
+          "reason": "client-shape probe not implemented"
+        }
+      ],
+      "summary": {
+        "pass": 2,
+        "warn": 0,
+        "fail": 4,
+        "blocked": 1,
+        "notRun": 7
+      },
+      "conclusion": "flow-fail"
+    }
+  },
+  "layerProbe": null,
+  "checks": [
+    {
+      "id": "J1.profile",
+      "result": "PASS",
+      "reason": "create profile exit=0",
+      "stderr": ""
+    },
+    {
+      "id": "J1.install",
+      "result": "BLOCKED",
+      "reason": "host compatibility gate rejected the install (no exemption granted)",
+      "stderr": "\ndsh: installation rejected: Plugin dsh-verification-receipt@0.1.0 is incompatible with dsh 0.2.2-alpha.2: requirements {\"@deepseek-ai/dsh-session\":\">=0.1.0-rc.5 <0.1.0\"}. Running it may cause crashes or data loss. Update the plugin or install a plugin version compatible with this dsh runtime. To accept this risk explicitly, grant the exact-version exemption for dsh-verification-receipt@0.1.0 on dsh 0.2.2-alpha.2 with `dsh plugin allow-version` or the plugin manager, then retry the installation or restart dsh. Exact-version exemption: not active.\ndsh: nothing was installed.\ndsh: to accept the risk, run: dsh plugin --profile flow-journey allow-version dsh-verification-receipt@0.1.0 --dsh-version 0.2.2-alpha.2 --accept-risk\ndsh: plugin command failed; diagnostics: /tmp/dsh-journey-7c2BA7/pro"
+    },
+    {
+      "id": "J1.dump",
+      "result": "PASS",
+      "reason": "dump exit=0",
+      "stderr": ""
+    },
+    {
+      "id": "J1.layer",
+      "result": "FAIL",
+      "reason": "plugin/bundle not visible in dump"
+    },
+    {
+      "id": "J2.toggle",
+      "result": "not-run",
+      "reason": "could not locate the inserted row id in dump-config"
+    },
+    {
+      "id": "J1.remove",
+      "result": "FAIL",
+      "reason": "remove exit=1",
+      "stderr": "Error: ERR_PNPM_CANNOT_REMOVE_MISSING_DEPS\n\n  × removing a package\n  ╰─▶ Cannot remove 'dsh-verification-receipt': project has no dependencies of\n      any kind\n\ndsh: plugin command failed; diagnostics: /tmp/dsh-journey-7c2BA7/profiles/flow-journey/.plugin-manager/logs/operation-UU4ak3/pnpm.log\n"
+    },
+    {
+      "id": "J1.clean",
+      "result": "FAIL",
+      "reason": "layer/dependency gone after remove"
+    },
+    {
+      "id": "J4.tree-load",
+      "result": "FAIL",
+      "reason": "reinstall exit=1",
+      "stderr": "\ndsh: installation rejected: Plugin dsh-verification-receipt@0.1.0 is incompatible with dsh 0.2.2-alpha.2: requirements {\"@deepseek-ai/dsh-session\":\">=0.1.0-rc.5 <0.1.0\"}. Running it may cause crashes or data loss. Update the plugin or install a plugin version compatible with this dsh runtime. To accept this risk explicitly, grant the exact-version exemption for dsh-verification-receipt@0.1.0 on dsh 0.2.2-alpha.2 with `dsh plugin allow-version` or the plugin manager, then retry the installation "
+    },
+    {
+      "id": "J6.upgrade",
+      "result": "not-run",
+      "reason": "no --previous package supplied"
+    },
+    {
+      "id": "J6.rollback",
+      "result": "not-run",
+      "reason": "no --previous package supplied"
+    },
+    {
+      "id": "J3.config",
+      "result": "not-run",
+      "reason": "invalid-config harness not implemented; do not claim J3"
+    },
+    {
+      "id": "J5.permissions",
+      "result": "not-run",
+      "reason": "permissions/disclosure review is manual"
+    },
+    {
+      "id": "J7.observe",
+      "result": "not-run",
+      "reason": "observability probe not implemented"
+    },
+    {
+      "id": "J8.client",
+      "result": "not-run",
+      "reason": "client-shape probe not implemented"
+    }
+  ],
+  "verdicts": {
+    "J1": "fail",
+    "J2": "not-run",
+    "J4": "fail",
+    "J6": "not-run"
+  },
+  "classification": "clean",
+  "caveats": [],
+  "limitations": [
+    "J3/J5/J7/J8 are not covered by journey-runtime.",
+    "This is a local-directory install (`dsh plugin add <dir>`), not a registry tarball install."
+  ],
+  "summary": {
+    "checks": {
+      "pass": 2,
+      "warn": 0,
+      "fail": 4,
+      "blocked": 1,
+      "partial": 0,
+      "notRun": 7
+    },
+    "verdicts": {
+      "pass": 0,
+      "fail": 2,
+      "blocked": 0,
+      "partial": 0,
+      "notRun": 2
+    }
+  },
+  "conclusion": "flow-fail"
+}

package/40-checker/results/governance/co-maintainer-packet.md

@@ -0,0 +1,85 @@
+# Co-maintainer packet
+
+Status: **no co-maintainer recruited yet**. This packet is the publishable ask;
+it is not evidence that one exists.
+
+## 150–250 word post (English)
+
+> **Seeking 1–2 co-maintainers for an open, non-official DSH plugin standard**
+>
+> `dsh-standards` is a small, evidence-first project that defines three adoption
+> levels for DeepSeek Harness plugins: ENTRY (it runs), FLOW (it behaves), and
+> BOOST (it measurably helps). It is **not** an official DeepSeek standard, not a
+> certification, and not a security audit. The checker, the 18-package runtime
+> sample, the 60+20 repo static sample, and the benchmark harness are all in one
+> repository.
+>
+> I am the only maintainer and the bus factor is 1. I am looking for one or two
+> people who can commit a few hours a month to:
+> - review checker/spec changes against the evidence rules;
+> - rerun and read CI (static sample, 18-package runtime, web smoke);
+> - triage plugin reports and turn vague claims into reproducible rows;
+> - own one area (checker, docs, samples, or benchmarks).
+>
+> What you get: attribution in `MAINTAINERS.md`, a real review role, and a say in
+> whether the project stays a draft or becomes useful enough for a beta group.
+> No fee, no ranking, no certification, no CLA. Contributions are public and
+> forkable.
+>
+> If you have shipped or reviewed a DSH plugin and can show 1–3 concrete
+> contributions, open an issue with your handle, the area you want, and any
+> conflicts. Chinese or English is fine.
+
+## 150–250 字招募帖（中文）
+
+> **为一个非官方、证据优先的 DSH 插件标准招募 1–2 名共同维护者**
+>
+> `dsh-standards` 是一个小项目，定义 DSH 插件的三级采用标准：ENTRY（装完能跑）、
+> FLOW（行为顺畅）、BOOST（可量化增效）。它**不是** DeepSeek 官方标准，不是认证，
+> 也不是安全审计。checker、18 包运行时样本、60+20 仓库静态样本和基准工具都在
+> 同一个仓库里。
+>
+> 目前只有 1 名维护者，bus factor = 1。希望找 1–2 位每月能投入几小时的人：
+> - 按证据规则评审 checker/规范改动；
+> - 重跑并读懂 CI（静态样本、18 包运行时、web smoke）；
+> - 把模糊的插件报告变成可复现的行；
+> - 认领一个方向（checker、文档、样本或基准）。
+>
+> 你能得到：`MAINTAINERS.md` 署名、真实评审权，以及对项目继续做草稿还是推进到
+> 内测的判断权。无费用、无排名、无认证、无 CLA，贡献公开可 fork。
+>
+> 如果你发布或评审过 DSH 插件，并能给出 1–3 个具体贡献，请开 issue 写明 GitHub
+> handle、想认领的方向和利益冲突。中英文均可。
+
+## Where to post
+
+1. **DSH beta group** — the primary channel; attach a one-paragraph summary and a
+   link to this repository. The repo is currently **private**, so either make it
+   public first or invite the candidate as a read-only collaborator before
+   sharing the link.
+2. **GitHub Discussions** — enable Discussions on `PerryLink/dsh-standards` and
+   pin the post under a `governance` category.
+3. **A relevant awesome-list / community thread** — only where self-promotion
+   is allowed and the list is about DSH plugins, not generic LLM tooling. Do not
+   spam multiple lists with the same text.
+
+## Grant checklist
+
+- [ ] Candidate has 2FA enabled.
+- [ ] At least one contribution reviewed end-to-end by the current maintainer.
+- [ ] Added as GitHub collaborator with **write**, not admin.
+- [ ] Added to `.github/CODEOWNERS` and `MAINTAINERS.md` in one commit.
+- [ ] Candidate uses their **own** npm/PyPI token; no shared secret.
+- [ ] First release is supervised; after that, release rights are documented.
+- [ ] Conflict-of-interest disclosure recorded in the issue.
+- [ ] `provisional` marker removed only after the second maintainer's first review.
+
+## What is still human-only
+
+- Inviting a named GitHub account as a collaborator.
+- Adding a second owner on npm/PyPI.
+- Making the repository public.
+- Recruiting the person in the first place.
+
+No agent can complete those four actions without a human identity and explicit
+account-level permission.