dsh-standards 0.0.3 → 1.0.0

package/40-checker/test/entry-validate.test.mjs

@@ -0,0 +1,172 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+import fs from 'node:fs'
+import os from 'node:os'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+const SCRIPT = path.join(STD, '40-checker', 'scripts', 'entry-validate.mjs')
+const FIXTURES = path.join(STD, 'adoption', 'entry', 'fixtures')
+
+function run(name, withMeta = true) {
+  const dir = path.join(FIXTURES, name)
+  const args = [SCRIPT, dir, '--json']
+  const meta = path.join(dir, 'meta.json')
+  if (withMeta && fs.existsSync(meta)) args.push('--meta', meta)
+  return spawnSync(process.execPath, args, { encoding: 'utf8', timeout: 30_000 })
+}
+
+function result(name, withMeta = true) {
+  const out = run(name, withMeta)
+  assert.ok(out.stdout, out.stderr)
+  return { out, json: JSON.parse(out.stdout) }
+}
+
+test('entry-validate: the good fixture passes C1-C8', () => {
+  const { out, json } = result('good')
+  assert.equal(out.status, 0, out.stderr)
+  assert.equal(json.conclusion.status, 'pass')
+  assert.deepEqual(json.conclusion.failed, [])
+  assert.deepEqual(json.conclusion.notRun, [])
+})
+
+test('entry-validate: missing meta is incomplete, never a pass', () => {
+  const { out, json } = result('no-meta', false)
+  assert.equal(out.status, 3)
+  assert.equal(json.conclusion.status, 'incomplete')
+  assert.ok(json.conclusion.notRun.includes('C1'))
+  assert.ok(json.conclusion.notRun.includes('C7'))
+})
+
+const failures = [
+  ['client-only', 'C2'],
+  ['missing-patch', 'C2'],
+  ['engines-star', 'C4'],
+  ['client-no-export', 'C5'],
+  ['no-metadata', 'C6'],
+  ['no-version', 'C7'],
+  ['forbidden-label', 'C8'],
+]
+
+for (const [name, id] of failures) {
+  test(`entry-validate: ${name} fails ${id}`, () => {
+    const { out, json } = result(name)
+    assert.equal(out.status, 2, out.stderr)
+    assert.equal(json.conclusion.status, 'fail')
+    assert.ok(json.conclusion.failed.includes(id), JSON.stringify(json.conclusion))
+  })
+}
+
+test('entry-validate: a peer range is an accepted C4 source', () => {
+  const { out, json } = result('peer-ok')
+  assert.equal(out.status, 0, out.stderr)
+  assert.equal(json.checks.find(row => row.id === 'C4').status, 'pass')
+})
+
+test('entry-validate: a declared but uncommitted build output is a warning, not a fail', () => {
+  const { out, json } = result('build-output')
+  assert.equal(out.status, 0, out.stderr)
+  assert.equal(json.conclusion.status, 'pass-with-warnings')
+  assert.ok(json.conclusion.warnings.includes('C5'))
+  assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
+  assert.deepEqual(json.conclusion.failed, [])
+})
+
+test('entry-validate: an ordered dsh.bundle.patch list is accepted', () => {
+  const { out, json } = result('patch-list')
+  assert.equal(out.status, 0, out.stderr)
+  assert.equal(json.checks.find(row => row.id === 'C2').status, 'pass')
+  assert.equal(json.conclusion.status, 'pass')
+})
+
+function hostEvidence(status) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-entry-host-'))
+  const file = path.join(dir, 'host.json')
+  fs.writeFileSync(file, JSON.stringify({
+    status,
+    command: 'dsh plugin --profile test add @dsh-fixtures/entry-good',
+    host: 'dsh 0.2.2-alpha.2 / cordis 4.0.6-alpha.1',
+    evidence: 'https://example.invalid/host-install/1',
+    generatedAt: '2026-11-02',
+  }))
+  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
+}
+
+test('entry-validate: a passed host install upgrades C3 to pass', () => {
+  const h = hostEvidence('pass')
+  try {
+    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 0, out.stderr)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C3').status, 'pass')
+    assert.equal(json.conclusion.status, 'pass')
+  } finally { h.cleanup() }
+})
+
+test('entry-validate: a failed host install fails C3', () => {
+  const h = hostEvidence('fail')
+  try {
+    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 2)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C3').status, 'fail')
+    assert.ok(json.conclusion.failed.includes('C3'))
+  } finally { h.cleanup() }
+})
+
+test('entry-validate: a blocked host install is incomplete, not a pass', () => {
+  const h = hostEvidence('blocked')
+  try {
+    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 3)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C3').status, 'blocked')
+    assert.ok(json.conclusion.blocked.includes('C3'))
+    assert.equal(json.conclusion.status, 'incomplete')
+  } finally { h.cleanup() }
+})
+
+test('entry-validate: C3 is flow-only when no host evidence is supplied', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c3-flow-'))
+  try {
+    const meta = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'good', 'meta.json'), 'utf8'))
+    delete meta.installCommand
+    const metaFile = path.join(dir, 'meta.json')
+    fs.writeFileSync(metaFile, JSON.stringify(meta))
+    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', metaFile], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 0, out.stderr)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
+    assert.equal(json.conclusion.status, 'pass')
+  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
+})
+
+test('entry-validate: host evidence can mark C3 not-applicable for a host/directory sample', () => {
+  const h = hostEvidence('not-applicable')
+  try {
+    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 0, out.stderr)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
+    assert.equal(json.conclusion.status, 'pass')
+  } finally { h.cleanup() }
+})
+
+test('entry-validate: a missing license is A7 advisory, not a C6 fail', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c6-license-'))
+  try {
+    const src = path.join(FIXTURES, 'good')
+    for (const name of ['index.js', 'client.js', 'cordis.patch.yml', 'meta.json']) fs.copyFileSync(path.join(src, name), path.join(dir, name))
+    const pkg = JSON.parse(fs.readFileSync(path.join(src, 'package.json'), 'utf8'))
+    delete pkg.license
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(pkg))
+    const out = spawnSync(process.execPath, [SCRIPT, dir, '--json', '--meta', path.join(dir, 'meta.json')], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(out.status, 0, out.stderr)
+    const json = JSON.parse(out.stdout)
+    assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
+    assert.ok(json.advisories.some(row => row.id === 'A7'))
+  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
+})

package/40-checker/test/governance.test.mjs

@@ -0,0 +1,76 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { validateGovernance } from '../scripts/governance-check.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
+
+function fixture() {
+  return {
+    roles: read('governance/roles.json'),
+    contributors: read('governance/contributors.json'),
+    reviewers: read('governance/reviewers.json'),
+    coi: read('governance/coi.json'),
+  }
+}
+
+test('governance: the checked-in files pass', () => {
+  const result = validateGovernance(fixture())
+  assert.deepEqual(result.errors, [])
+})
+
+test('governance: exactly one human organizer is required', () => {
+  const data = fixture()
+  data.roles.roles.organizer.bot = true
+  data.roles.roles.organizer.humanOnly = false
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /organizer must be humanOnly/.test(e)))
+})
+
+test('governance: AI must not decide spec semantics', () => {
+  const data = fixture()
+  data.roles.matrix['ai-steward']['spec.decide'] = 'allow'
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /must not hold spec\.decide/.test(e)))
+})
+
+test('governance: AI merge must be allowlist-only', () => {
+  const data = fixture()
+  data.roles.matrix['ai-steward']['repo.merge.main'] = 'allow'
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /allow-with-allowlist/.test(e)))
+})
+
+test('governance: class A approver must be human', () => {
+  const data = fixture()
+  data.roles.decisions.A.approver = ['ai-steward']
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /decision A approver/.test(e)))
+})
+
+test('governance: AI merge denylist protects spec and governance', () => {
+  const data = fixture()
+  data.roles.ai.mergeDenylist = ['spec/']
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /governance\//.test(e)))
+})
+
+test('governance: a contributor needs DCO and the current terms', () => {
+  const data = fixture()
+  data.contributors.contributors[0].signedOff = false
+  data.contributors.contributors[0].terms = 'dsh-ct/0'
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /no DCO sign-off/.test(e)))
+  assert.ok(result.errors.some((e) => /terms mismatch/.test(e)))
+})
+
+test('governance: reviewer must reference a human role', () => {
+  const data = fixture()
+  data.reviewers.reviewers[0].role = 'ai-steward'
+  const result = validateGovernance(data)
+  assert.ok(result.errors.some((e) => /human role/.test(e)))
+})

package/40-checker/test/label.test.mjs

@@ -0,0 +1,97 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+import fs from 'node:fs'
+import os from 'node:os'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+const SYNC = path.join(STD, '40-checker', 'scripts', 'label-sync.mjs')
+const DRIFT = path.join(STD, '40-checker', 'scripts', 'label-drift.mjs')
+const VERIFY = path.join(STD, '40-checker', 'scripts', 'label-verify.mjs')
+const SAMPLE = path.join(STD, 'adoption', 'market', 'sample-source.json')
+
+function tempDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-label-test-'))
+}
+
+function run(script, args) {
+  return spawnSync(process.execPath, [script, ...args], { encoding: 'utf8', timeout: 30_000 })
+}
+
+test('label-sync: writes a valid index from the sample source', () => {
+  const dir = tempDir()
+  try {
+    const out = path.join(dir, 'labels')
+    const sync = run(SYNC, ['--source', SAMPLE, '--out', out])
+    assert.equal(sync.status, 0, sync.stderr)
+    const index = JSON.parse(fs.readFileSync(path.join(out, 'index.json'), 'utf8'))
+    assert.equal(index.schema, 'dsh-label-index/1')
+    assert.equal(index.records.length, 1)
+    assert.match(index.records[0].recordHash, /^sha256:[0-9a-f]{64}$/)
+    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2026-11-02'])
+    assert.equal(drift.status, 0, drift.stdout + drift.stderr)
+    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', index.records[0].recordHash, '--json'])
+    assert.equal(verify.status, 0, verify.stderr)
+    const view = JSON.parse(verify.stdout)
+    assert.equal(view.ok, true)
+    assert.equal(view.claimLevel, 'reference')
+    assert.equal(Object.prototype.hasOwnProperty.call(view, 'grade'), false)
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('label-drift: an expired label is stale and fails', () => {
+  const dir = tempDir()
+  try {
+    const out = path.join(dir, 'labels')
+    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
+    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2028-01-01', '--json'])
+    assert.equal(drift.status, 1)
+    const result = JSON.parse(drift.stdout)
+    assert.equal(result.stale, 1)
+    assert.equal(result.ok, false)
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('label-sync: a grade or a wrong hash is rejected', () => {
+  const dir = tempDir()
+  try {
+    const source = JSON.parse(fs.readFileSync(SAMPLE, 'utf8'))
+    const badGrade = structuredClone(source)
+    badGrade[0].grade = 'A'
+    const gradeFile = path.join(dir, 'bad-grade.json')
+    fs.writeFileSync(gradeFile, JSON.stringify(badGrade))
+    const grade = run(SYNC, ['--source', gradeFile, '--check'])
+    assert.equal(grade.status, 1)
+    assert.match(grade.stderr, /forbidden field: grade/)
+
+    const badHash = structuredClone(source)
+    badHash[0].recordHash = `sha256:${'0'.repeat(64)}`
+    const hashFile = path.join(dir, 'bad-hash.json')
+    fs.writeFileSync(hashFile, JSON.stringify(badHash))
+    const hash = run(SYNC, ['--source', hashFile, '--check'])
+    assert.equal(hash.status, 1)
+    assert.match(hash.stderr, /recordHash does not match/)
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+test('label-verify: an unknown hash is a 404, not a fake pass', () => {
+  const dir = tempDir()
+  try {
+    const out = path.join(dir, 'labels')
+    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
+    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', `sha256:${'f'.repeat(64)}`])
+    assert.equal(verify.status, 2)
+    assert.match(verify.stderr, /not found/)
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+})

package/40-checker/test/level-audit.test.mjs

@@ -0,0 +1,99 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+const SCRIPT = path.join(STD, '40-checker', 'scripts', 'level-audit.mjs')
+const GOOD = path.join(STD, '40-checker', 'fixtures', 'good')
+
+test('level-audit: static ENTRY is recognized, FLOW/BOOST are not upgraded', () => {
+  const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
+  assert.equal(run.status, 0, run.stderr)
+  const result = JSON.parse(run.stdout)
+  assert.equal(result.schema, 'dsh-level-audit/1')
+  assert.equal(result.levelsSpec.schema, 'dsh-levels/1')
+  assert.equal(result.levels.entry.state, 'recognized')
+  assert.equal(result.levels.flow.state, 'not-run')
+  assert.equal(result.levels.boost.state, 'not-measured')
+  assert.deepEqual(result.notClaimed.includes('certification'), true)
+})
+
+test('level-audit: a missing package exits 3 and does not print a fake pass', () => {
+  const run = spawnSync(process.execPath, [SCRIPT, '/no/such/package', '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
+  assert.equal(run.status, 3)
+  assert.match(run.stderr, /not a package directory/)
+})
+
+import fs from 'node:fs'
+import os from 'node:os'
+
+const BOOST_IDS = ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8']
+
+function writeBoostEvidence(rows) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-boost-evidence-'))
+  const file = path.join(dir, 'boost.json')
+  fs.writeFileSync(file, JSON.stringify(rows))
+  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
+}
+
+function validCard(expiresAt = '2099-01-01', generatedAt = '2026-11-01') {
+  return {
+    subject: 'fixture@1.0.0',
+    host: 'fixture-host',
+    method: 'fixture',
+    scope: 'fixture',
+    command: 'node fixture.mjs',
+    result: 'pass',
+    negativeControl: 'control fails as expected',
+    generatedAt,
+    expiresAt,
+    recordHash: `sha256:${'a'.repeat(64)}`,
+    claimLevel: 'self-reported',
+    issuer: 'fixture',
+    selfAssessed: true,
+  }
+}
+
+test('level-audit: status-only BOOST rows are not measured without evidence cards', () => {
+  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidence: 'looks fine' }]))
+  const fixture = writeBoostEvidence(rows)
+  try {
+    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(run.status, 0, run.stderr)
+    const result = JSON.parse(run.stdout)
+    assert.equal(result.levels.boost.state, 'not-measured')
+    assert.equal(result.levels.boost.practices['LEV-1'].card.valid, false)
+  } finally {
+    fixture.cleanup()
+  }
+})
+
+test('level-audit: BOOST is measured only with eight valid evidence cards', () => {
+  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard() }]))
+  const fixture = writeBoostEvidence(rows)
+  try {
+    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(run.status, 0, run.stderr)
+    const result = JSON.parse(run.stdout)
+    assert.equal(result.levels.boost.state, 'measured')
+    assert.equal(result.levels.boost.validCards, 8)
+  } finally {
+    fixture.cleanup()
+  }
+})
+
+test('level-audit: expired BOOST cards are stale, not measured', () => {
+  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard('2020-01-01', '2019-01-01') }]))
+  const fixture = writeBoostEvidence(rows)
+  try {
+    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
+    assert.equal(run.status, 0, run.stderr)
+    const result = JSON.parse(run.stdout)
+    assert.equal(result.levels.boost.state, 'stale')
+  } finally {
+    fixture.cleanup()
+  }
+})

package/40-checker/test/levels.test.mjs

@@ -0,0 +1,31 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+const levels = JSON.parse(readFileSync(path.join(STD, 'spec', 'levels.json'), 'utf8'))
+
+test('levels: exactly three levels with the expected ids and analogies', () => {
+  assert.equal(levels.schema, 'dsh-levels/1')
+  assert.equal(levels.nonOfficial, true)
+  assert.deepEqual(levels.levels.map(level => level.id), ['entry', 'flow', 'boost'])
+  assert.deepEqual(levels.levels.map(level => level.analogy), ['GB', 'GB/T', 'GB/Z'])
+})
+
+test('levels: ENTRY has G0-G5, FLOW has J1-J8, BOOST has LEV-1..LEV-8', () => {
+  const gates = Object.fromEntries(levels.levels.map(level => [level.id, level.gates.map(gate => gate.id)]))
+  assert.deepEqual(gates.entry, ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
+  assert.deepEqual(gates.flow, ['J1', 'J2', 'J3', 'J4', 'J5', 'J6', 'J7', 'J8'])
+  assert.deepEqual(gates.boost, ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8'])
+})
+
+test('levels: evidence states include not-run and never imply a pass', () => {
+  const all = new Set(levels.levels.flatMap(level => level.evidenceStates))
+  assert.equal(all.has('not-run'), true)
+  assert.equal(all.has('runtime'), true)
+  assert.equal(all.has('measured'), true)
+  assert.equal(levels.axes.rules.some(rule => rule.includes('skip is not a pass')), true)
+})

package/40-checker/test/ops.test.mjs

@@ -0,0 +1,117 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { validateClauseMap } from '../scripts/clause-map.mjs'
+import { effective } from '../scripts/stale-check.mjs'
+import { appendRecord, verifyChain } from '../scripts/evidence-chain.mjs'
+import { buildDashboard } from '../scripts/dashboard.mjs'
+import { inspect } from '../scripts/surveillance.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
+
+test('clause map: the checked-in map covers every gate', () => {
+  const result = validateClauseMap({ levels: read('spec/levels.json'), clauses: read('spec/clauses.json') })
+  assert.deepEqual(result.errors, [])
+  assert.deepEqual(result.covered.entry.sort(), ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
+})
+
+test('clause map: a missing gate is an error', () => {
+  const levels = read('spec/levels.json')
+  const clauses = read('spec/clauses.json')
+  clauses.clauses = clauses.clauses.filter((c) => !c.gates.includes('G4'))
+  const result = validateClauseMap({ levels, clauses })
+  assert.ok(result.errors.some((e) => /G4/.test(e)))
+})
+
+test('stale: an active expired record is expired', () => {
+  const r = effective({ status: 'active', expiresAt: '2020-01-01' }, new Date('2026-11-01T00:00:00Z'))
+  assert.equal(r.status, 'expired')
+  assert.equal(r.stale, true)
+})
+
+test('stale: a draft is not valid but not “stale”', () => {
+  const r = effective({ status: 'draft', expiresAt: '2030-01-01' }, new Date('2026-11-01T00:00:00Z'))
+  assert.equal(r.status, 'draft')
+  assert.equal(r.stale, false)
+})
+
+test('evidence chain: append then verify', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
+  const record = path.join(dir, 'record.json')
+  fs.writeFileSync(record, '{"ok":true}')
+  const chain = path.join(dir, 'chain.jsonl')
+  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
+  appendRecord({ chain, record, ts: '2026-11-02T00:00:01Z' })
+  const result = verifyChain(fs.readFileSync(chain, 'utf8').split('\n'))
+  assert.deepEqual(result.errors, [])
+  assert.equal(result.entries, 2)
+  fs.rmSync(dir, { recursive: true, force: true })
+})
+
+test('evidence chain: tampering is detected', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
+  const record = path.join(dir, 'record.json')
+  fs.writeFileSync(record, '{"ok":true}')
+  const chain = path.join(dir, 'chain.jsonl')
+  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
+  const lines = fs.readFileSync(chain, 'utf8').split('\n')
+  lines[0] = lines[0].replace(/("recordSha256":")([0-9a-f])/, (m, a, b) => a + (b === '0' ? '1' : '0'))
+  const result = verifyChain(lines)
+  assert.ok(result.errors.length > 0)
+  fs.rmSync(dir, { recursive: true, force: true })
+})
+
+test('dashboard: never claims official/security/production', () => {
+  const d = buildDashboard(ROOT)
+  assert.equal(d.schema, 'dsh-dashboard/1')
+  assert.ok(d.notClaimed.includes('security audit'))
+  assert.equal(d.flow.packages, 10)
+})
+
+test('surveillance: expired record becomes an issue', () => {
+  const report = inspect({ attestations: [{ attestationId: 'DSH-ATT-2020-001', status: 'active', expiresAt: '2020-01-01', verifyUrl: 'https://example.com', claimLevel: 'self-reported' }] }, new Date('2026-11-01T00:00:00Z'))
+  assert.ok(report.issues.some((i) => i.issues.includes('expired')))
+})
+
+test('round-robin: independent matching runs are comparable', async () => {
+  const { compare } = await import('../scripts/round-robin.mjs')
+  const expected = { good: { expected: 'warn' }, bad: { expected: 'fail' } }
+  const r = compare({
+    a: { runner: 'runner-a', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
+    b: { runner: 'runner-b', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
+    expected,
+  })
+  assert.equal(r.comparable, true)
+})
+
+test('round-robin: two not-run results are not comparable', async () => {
+  const { compare } = await import('../scripts/round-robin.mjs')
+  const r = compare({
+    a: { runner: 'runner-a', results: { good: { status: 'not-run' } } },
+    b: { runner: 'runner-b', results: { good: { status: 'not-run' } } },
+    expected: { good: { expected: 'warn' } },
+  })
+  assert.equal(r.comparable, false)
+})
+
+test('flow index: aggregates result files without upgrading a verdict', async () => {
+  const { buildFlowIndex } = await import('../scripts/flow-index.mjs')
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-index-'))
+  const row = (id, pass, fail) => ({
+    schema: 'dsh-flow-real/1', id, package: id, version: '1.0.0', source: 'fixture', why: 'test',
+    verdicts: { J1: pass ? 'pass' : 'fail', J2: 'not-run', J4: 'not-run', J6: 'not-run' },
+    classification: 'clean', conclusion: 'partial', caveats: [], summary: { checks: { pass, fail, blocked: 0, notRun: 6 }, verdicts: { pass: pass ? 1 : 0, fail: fail, blocked: 0, partial: 0, notRun: 3 } },
+  })
+  fs.writeFileSync(path.join(dir, 'a.json'), JSON.stringify(row('a', 1, 0)))
+  fs.writeFileSync(path.join(dir, 'b.json'), JSON.stringify(row('b', 0, 1)))
+  const index = buildFlowIndex(dir)
+  assert.equal(index.totals.packages, 2)
+  assert.equal(index.totals.checks.fail, 1)
+  assert.equal(index.totals.verdicts.fail, 1)
+  fs.rmSync(dir, { recursive: true, force: true })
+})

package/40-checker/test/permissions.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { checkCredentials } from '../src/declarations.mjs'
+import { validateCommitments, validateDisclosure, COMMITMENT_IDS } from '../src/permissions.mjs'
+
+const manifest = {
+  dsh: {
+    commitmentsVersion: 1,
+    commitments: Object.fromEntries(COMMITMENT_IDS.map(id => [id, true])),
+    disclosure: {
+      endpoints: ['https://api.example.com'],
+      retention: 'none',
+      systemPrompt: 'unchanged',
+    },
+    capabilities: ['network:egress'],
+  },
+}
+
+test('all 9 commitments validate as booleans', () => {
+  const details = validateCommitments(manifest)
+  assert.equal(details.length, 1)
+  assert.equal(details[0].result, 'PASS')
+})
+
+test('missing commitment is a warning, not a failure', () => {
+  const details = validateCommitments({ dsh: { commitments: { 'no-session-upload': true } } })
+  assert.ok(details.some(item => item.result === 'WARN' && item.reason.includes('missing commitment')))
+})
+
+test('disclosure endpoints must be https URLs', () => {
+  const details = validateDisclosure({ dsh: { disclosure: { endpoints: ['http://insecure.example.com'] } } })
+  assert.ok(details.some(item => item.result === 'WARN'))
+})
+
+test('checkCredentials reads both declaration fields', () => {
+  const check = checkCredentials(manifest, [])
+  assert.equal(check.result, 'PASS')
+  assert.ok(check.details.some(item => item.item === 'C-12.6' && item.result === 'PASS'))
+  assert.ok(check.details.some(item => item.item === 'C-12.7' && item.result === 'PASS'))
+})

package/40-checker/test/semver.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { compareVersions, parseVersion, satisfies, validRange } from '../src/semver.mjs'
+
+test('parseVersion accepts exact semver and prerelease', () => {
+  assert.deepEqual(parseVersion('0.2.2-alpha.2'), { major: 0, minor: 2, patch: 2, prerelease: ['alpha', '2'] })
+  assert.equal(parseVersion('^0.2.2'), null)
+})
+
+test('compareVersions orders release above prerelease', () => {
+  assert.equal(compareVersions(parseVersion('0.2.2'), parseVersion('0.2.2-alpha.2')), 1)
+  assert.equal(compareVersions(parseVersion('0.2.2-alpha.2'), parseVersion('0.2.2-alpha.1')), 1)
+  assert.equal(compareVersions(parseVersion('0.2.0-rc.2'), parseVersion('0.2.0-0')), 1)
+})
+
+test('satisfies handles the ranges used by real plugins', () => {
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.2.2-alpha.2 <0.3.0'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.1.5-rc.1 <0.2.0-0 || >=0.2.0-rc.2 <0.3.0-0'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2-alpha.2'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '~0.2.2'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.3.0'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', 'workspace:^'), false)
+  assert.equal(satisfies('24.0.0', '^22.19.0 || >=24.0.0'), true)
+})
+
+test('validRange rejects empty and malformed ranges', () => {
+  assert.equal(validRange('>=0.2.2 <0.3.0'), true)
+  assert.equal(validRange(''), false)
+  assert.equal(validRange('workspace:^'), false)
+  assert.equal(validRange('not-a-range'), false)
+})