dsh-standards 0.0.3 → 1.0.1

package/40-checker/scripts/journey-runtime.mjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+/**
+ * FLOW runtime probe: J1 install/remove, J2 enable/disable, J4 keyless tree-load,
+ * and J6 upgrade/rollback when `--previous` is supplied.
+ *
+ * J3 (config validation), J5 (permissions), J7 (observability) and J8 (client
+ * shapes) are reported `not-run`: this probe does not pretend to cover them.
+ *
+ * Usage:
+ *   node scripts/journey-runtime.mjs --package <dir> [--dsh <bin>] [--previous <dir>] [--json]
+ */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+function parse(argv) {
+  const out = { package: null, previous: null, dsh: process.env.DSH_BIN || null, allowExemption: false, json: false, timeout: 120_000 }
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--package') out.package = argv[++i]
+    else if (argv[i] === '--previous') out.previous = argv[++i]
+    else if (argv[i] === '--dsh') out.dsh = argv[++i]
+    else if (argv[i] === '--allow-exemption') out.allowExemption = true
+    else if (argv[i] === '--json') out.json = true
+    else if (argv[i] === '--timeout') out.timeout = Number(argv[++i])
+    else if (argv[i] === '--help' || argv[i] === '-h') { console.log('usage: node scripts/journey-runtime.mjs --package <dir> [--previous <dir>] [--dsh <bin>] [--allow-exemption] [--json]'); process.exit(0) }
+    else throw new Error(`unknown option: ${argv[i]}`)
+  }
+  if (!out.package) throw new Error('--package is required')
+  return out
+}
+
+function sh(cmd, args, env, timeout) {
+  return spawnSync(cmd, args, { encoding: 'utf8', timeout, env, maxBuffer: 8 * 1024 * 1024 })
+}
+
+/** Find the row id whose `name:` is the package name or a relative server entry. */
+function rowIdFromDump(dump, pkgName) {
+  for (const block of dump.split(/\n(?=- )/)) {
+    const id = /^\s*-\s*id:\s*(\S+)/m.exec(block)
+    if (!id) continue
+    // `name` is either inline or a `>-` block whose first indented line holds
+    // the value (a file: URL for a local bundle).
+    const inline = /\n\s*name:\s*['"]?([^'"\n]+)['"]?/.exec(block)
+    const blockValue = /\n\s*name:\s*>-\s*\n\s*([^\n]+)/.exec(block)
+    const name = (blockValue ? blockValue[1] : inline ? inline[1] : '').trim()
+    if (name === pkgName || name.startsWith('./') || name.includes(pkgName)) return id[1]
+  }
+  return null
+}
+
+function installedVersion(home, profile, pkgName) {
+  const file = path.join(home, 'profiles', profile, 'node_modules', ...pkgName.split('/'), 'package.json')
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')).version ?? null } catch { return null }
+}
+
+function main() {
+  const options = parse(process.argv.slice(2))
+  const pkg = path.resolve(options.package)
+  const manifest = JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'), 'utf8'))
+  const previous = options.previous ? path.resolve(options.previous) : null
+  const previousManifest = previous ? JSON.parse(fs.readFileSync(path.join(previous, 'package.json'), 'utf8')) : null
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-journey-'))
+  const profile = 'flow-journey'
+  const env = { ...process.env, DSH_HOME: home }
+  delete env.DEEPSEEK_API_KEY
+  delete env.OPENAI_API_KEY
+  const dsh = options.dsh || (process.platform === 'win32' ? 'dsh.cmd' : 'dsh')
+  const checks = []
+  let dshVersion = null
+  const add = (id, result, reason, extra = {}) => checks.push({ id, result, reason, ...extra })
+  try {
+    const version = sh(dsh, ['--version'], env, 30_000)
+    dshVersion = (version.stdout || '').trim()
+    const create = sh(dsh, ['--profile', profile, '--from-default-profile', 'headless', '--dump-config'], env, options.timeout)
+    add('J1.profile', create.status === 0 ? 'PASS' : 'FAIL', `create profile exit=${create.status}`, { stderr: create.stderr.slice(0, 500) })
+    let addResult = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
+    let addText = `${addResult.stdout}${addResult.stderr}`
+    const rejected = addResult.status !== 0 && /installation rejected/.test(addText)
+    // Never grant an exact-version exemption by default: a gate rejection is a
+    // measured BLOCKED result, not something the harness may silently accept.
+    if (rejected && (options.allowExemption || process.env.DSH_JOURNEY_ALLOW_EXEMPTION === '1')) {
+      const allow = sh(dsh, ['plugin', '--profile', profile, 'allow-version', `${manifest.name}@${manifest.version}`, '--dsh-version', dshVersion, '--accept-risk'], env, options.timeout)
+      add('J1.exemption', allow.status === 0 ? 'WARN' : 'FAIL', `allow-version exit=${allow.status}`, { stderr: allow.stderr.slice(0, 500) })
+      addResult = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
+      addText = `${addResult.stdout}${addResult.stderr}`
+    }
+    add('J1.install', rejected && !options.allowExemption && process.env.DSH_JOURNEY_ALLOW_EXEMPTION !== '1' ? 'BLOCKED' : addResult.status === 0 ? 'PASS' : 'FAIL', rejected ? 'host compatibility gate rejected the install (no exemption granted)' : `add exit=${addResult.status}`, { stderr: addText.slice(0, 800) })
+    const dump1 = sh(dsh, ['--profile', profile, '--dump-config'], env, options.timeout)
+    add('J1.dump', dump1.status === 0 ? 'PASS' : 'FAIL', `dump exit=${dump1.status}`, { stderr: dump1.stderr.slice(0, 500) })
+    const appears = dump1.stdout.includes(manifest.name) || /fixture-bundle-server/.test(dump1.stdout)
+    add('J1.layer', appears ? 'PASS' : 'FAIL', appears ? 'layer/entry appears in dump' : 'plugin/bundle not visible in dump')
+
+    // J2: disable/enable through a profile overlay. A missing row id is a real
+    // failure of the probe (not a pass): report it and skip the toggle checks.
+    const rowId = rowIdFromDump(dump1.stdout, manifest.name)
+    if (!rowId) {
+      add('J2.toggle', 'not-run', 'could not locate the inserted row id in dump-config')
+    } else {
+      const overlay = path.join(home, 'j2-overlay.yml')
+      fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: true\n`)
+      const disabled = sh(dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], env, options.timeout)
+      const disabledOK = disabled.status === 0 && /disabled:\s*true/.test(disabled.stdout)
+      add('J2.disable', disabledOK ? 'PASS' : 'FAIL', disabledOK ? `row ${rowId} disabled` : `disable exit=${disabled.status}`, { stderr: disabled.stderr.slice(0, 500) })
+      fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: false\n`)
+      const enabled = sh(dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], env, options.timeout)
+      const enabledOK = enabled.status === 0 && !new RegExp(`id:\\s*${rowId}[\\s\\S]{0,80}disabled:\\s*true`).test(enabled.stdout)
+      add('J2.enable', enabledOK ? 'PASS' : 'FAIL', enabledOK ? `row ${rowId} enabled again` : `enable exit=${enabled.status}`, { stderr: enabled.stderr.slice(0, 500) })
+    }
+
+    const remove = sh(dsh, ['plugin', '--profile', profile, 'remove', manifest.name], env, options.timeout)
+    add('J1.remove', remove.status === 0 ? 'PASS' : 'FAIL', `remove exit=${remove.status}`, { stderr: (remove.stderr || remove.stdout).slice(0, 800) })
+    const dump2 = sh(dsh, ['--profile', profile, '--dump-config'], env, options.timeout)
+    const gone = !dump2.stdout.includes(manifest.name)
+    add('J1.clean', remove.status === 0 && gone ? 'PASS' : 'FAIL', gone ? 'layer/dependency gone after remove' : 'still present after remove')
+
+    // J4: with no API key, the tree must load far enough to reach the model
+    // boundary. This is a tree-load proof, not a successful first task.
+    if (process.env.DEEPSEEK_API_KEY || process.env.OPENAI_API_KEY) {
+      add('J4.tree-load', 'not-run', 'an API key is present in the launching environment')
+    } else {
+      const boot = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
+      if (boot.status !== 0) add('J4.tree-load', 'FAIL', `reinstall exit=${boot.status}`, { stderr: boot.stderr.slice(0, 500) })
+      else {
+        const run = sh(dsh, ['--profile', profile, 'Reply with one short sentence.'], env, 60_000)
+        const text = `${run.stdout}${run.stderr}`
+        const reached = run.status !== 0 && /MISSING_CREDENTIAL|no API key|AUTH|credential/i.test(text)
+        add('J4.tree-load', reached ? 'PASS' : 'FAIL', reached ? 'keyless boot reached the credential boundary' : `boot exit=${run.status}; no credential-boundary message`, { stderr: text.slice(0, 500) })
+      }
+    }
+
+    // J6: upgrade then rollback. Only meaningful when a previous package is
+    // supplied; otherwise it is honestly not-run.
+    if (!previous || !previousManifest) {
+      add('J6.upgrade', 'not-run', 'no --previous package supplied')
+      add('J6.rollback', 'not-run', 'no --previous package supplied')
+    } else {
+      const u1 = sh(dsh, ['plugin', '--profile', profile, 'add', previous], env, options.timeout)
+      const v1 = installedVersion(home, profile, manifest.name)
+      add('J6.upgrade', u1.status === 0 && v1 === previousManifest.version ? 'PASS' : 'FAIL', `upgrade ${previousManifest.version}->${manifest.version} exit=${u1.status}, installed=${v1}`, { stderr: (u1.stderr || u1.stdout).slice(0, 500) })
+      const u2 = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
+      const v2 = installedVersion(home, profile, manifest.name)
+      add('J6.upgrade-current', u2.status === 0 && v2 === manifest.version ? 'PASS' : 'FAIL', `current install exit=${u2.status}, installed=${v2}`, { stderr: (u2.stderr || u2.stdout).slice(0, 500) })
+      const u3 = sh(dsh, ['plugin', '--profile', profile, 'add', previous], env, options.timeout)
+      const v3 = installedVersion(home, profile, manifest.name)
+      add('J6.rollback', u3.status === 0 && v3 === previousManifest.version ? 'PASS' : 'FAIL', `rollback exit=${u3.status}, installed=${v3}`, { stderr: (u3.stderr || u3.stdout).slice(0, 500) })
+    }
+
+    for (const [id, reason] of [
+      ['J3.config', 'invalid-config harness not implemented; do not claim J3'],
+      ['J5.permissions', 'permissions/disclosure review is manual'],
+      ['J7.observe', 'observability probe not implemented'],
+      ['J8.client', 'client-shape probe not implemented'],
+    ]) add(id, 'not-run', reason)
+  } finally {
+    try { fs.rmSync(home, { recursive: true, force: true }) } catch { /* ignore */ }
+  }
+  const result = {
+    schema: 'dsh-flow-runtime/1',
+    environment: { dsh: dshVersion, node: process.version, platform: process.platform },
+    package: manifest.name,
+    version: manifest.version,
+    previous: previousManifest ? previousManifest.version : null,
+    mode: 'j1-j2-j4-j6-runtime',
+    checks,
+    summary: {
+      pass: checks.filter(c => c.result === 'PASS').length,
+      warn: checks.filter(c => c.result === 'WARN').length,
+      fail: checks.filter(c => c.result === 'FAIL').length,
+      blocked: checks.filter(c => c.result === 'BLOCKED').length,
+      notRun: checks.filter(c => c.result === 'not-run').length,
+    },
+    conclusion: checks.some(c => c.result === 'FAIL') ? 'flow-fail' : checks.some(c => c.result === 'BLOCKED') ? 'flow-blocked' : 'flow-warn',
+  }
+  if (options.json || !process.stdout.isTTY) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+  process.exitCode = result.conclusion === 'flow-fail' ? 1 : 0
+}
+try { main() } catch (error) { console.error(`journey-runtime: ${error.message}`); process.exitCode = 3 }

package/40-checker/scripts/journey.mjs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+/**
+ * DSH-FLOW static journey prep: J1-J8 as far as possible without a host.
+ * Runtime install/boot journeys are reported not-run, never PASS.
+ *
+ * Usage: node scripts/journey.mjs --package <dir> [--json]
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+
+function parse(argv) {
+  const out = { package: null, json: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--package') out.package = argv[++i]
+    else if (argv[i] === '--json') out.json = true
+    else if (argv[i] === '--help' || argv[i] === '-h') { console.log('usage: node scripts/journey.mjs --package <dir> [--json]'); process.exit(0) }
+    else throw new Error(`unknown option: ${argv[i]}`)
+  }
+  if (!out.package) throw new Error('--package is required')
+  return out
+}
+
+const read = file => { try { return fs.readFileSync(file, 'utf8') } catch { return '' } }
+const has = (text, re) => re.test(text)
+
+function main() {
+  const { package: pkg, json } = parse(process.argv.slice(2))
+  const dir = path.resolve(pkg)
+  const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'))
+  const readme = read(path.join(dir, 'README.md'))
+  const sources = ['index.js', 'lib/index.js', 'src/index.ts', 'src/index.js', 'dist/index.js']
+    .map(file => read(path.join(dir, file))).join('\n')
+  const patchFiles = manifest.dsh?.bundle?.patch
+    ? (Array.isArray(manifest.dsh.bundle.patch) ? manifest.dsh.bundle.patch : [manifest.dsh.bundle.patch])
+    : []
+  const patch = patchFiles.map(file => read(path.join(dir, file))).join('\n')
+  const hasClient = Boolean(manifest.dsh?.client)
+  const hasWorkspace = JSON.stringify(manifest).includes('workspace:')
+  const hasFiles = Array.isArray(manifest.files) && manifest.files.length > 0
+  const hasEngines = Boolean(manifest.engines?.dsh)
+
+  const checks = []
+  const add = (id, result, reason) => checks.push({ id, result, reason })
+  add('J1.install', !hasWorkspace && (manifest.main || manifest.exports) && hasFiles ? 'PASS' : hasWorkspace ? 'FAIL' : 'WARN', hasWorkspace ? 'workspace: in manifest' : hasFiles ? 'entry + files present' : 'files[] missing (prebuilt tarball may omit)')
+  add('J2.toggle', patch.includes('disabled') || hasClient ? 'PASS' : 'WARN', patch.includes('disabled') ? 'patch has disabled' : 'no disabled/stable toggle evidence')
+  add('J3.config', has(sources, /Config|Schema|schemastery/) ? 'PASS' : 'WARN', has(sources, /Config|Schema|schemastery/) ? 'schema found' : 'no schema/Config found in known entries')
+  add('J4.first-run', has(readme, /quickstart|getting started|安装|快速开始/i) ? 'PASS' : 'WARN', has(readme, /quickstart|getting started|安装|快速开始/i) ? 'README quickstart' : 'README quickstart missing')
+  add('J5.permissions', manifest.dsh?.capabilities || manifest.dsh?.labels || has(readme, /permission|权限/i) ? 'PASS' : 'WARN', 'permissions declaration/README')
+  add('J6.upgrade', hasEngines && hasFiles ? 'PASS' : 'WARN', hasEngines ? 'engines + files' : 'engines.dsh missing')
+  add('J7.observe', has(sources, /logger|ctx\.logger/) || has(readme, /troubleshoot|日志|log/i) ? 'PASS' : 'WARN', 'logger/README troubleshooting')
+  add('J8.client', hasClient ? (typeof manifest.exports?.['./client'] === 'string' ? 'PASS' : 'FAIL') : 'NA', hasClient ? 'client export present' : 'no dsh.client')
+  add('J1.runtime', 'not-run', 'requires temp DSH_HOME + real dsh plugin add/remove')
+  add('J2.runtime', 'not-run', 'requires real profile boot')
+  add('J4.runtime', 'not-run', 'requires real first-run')
+  add('J6.runtime', 'not-run', 'requires real upgrade/rollback')
+  add('J8.runtime', 'not-run', 'requires browser/host page')
+
+  const result = {
+    schema: 'dsh-flow-journey/1',
+    package: manifest.name,
+    version: manifest.version,
+    mode: 'static-prep',
+    checks,
+    summary: {
+      pass: checks.filter(c => c.result === 'PASS').length,
+      warn: checks.filter(c => c.result === 'WARN').length,
+      fail: checks.filter(c => c.result === 'FAIL').length,
+      na: checks.filter(c => c.result === 'NA').length,
+      notRun: checks.filter(c => c.result === 'not-run').length,
+    },
+    conclusion: 'flow-not-run',
+  }
+  if (json || !process.stdout.isTTY) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
+  process.exitCode = result.summary.fail > 0 ? 1 : 0
+}
+try { main() } catch (error) { console.error(`journey: ${error.message}`); process.exitCode = 3 }

package/40-checker/scripts/label-drift.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/** label-drift — validate a published label index, hashes, expiry, and forbidden fields. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { effectiveStatus, validateIndex } from '../src/label.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+
+function usage() {
+  console.log(`label-drift — check a label index for schema/hash/expiry/forbidden-word drift
+
+Usage:
+  node 40-checker/scripts/label-drift.mjs --index <index.json> [--now YYYY-MM-DD] [--json]
+
+Exit: 0 no issues, 1 drift found, 3 input error.`)
+}
+
+function parseArgs(argv) {
+  const options = { index: path.join(STD, 'publish', 'labels', 'index.json'), now: new Date().toISOString().slice(0, 10), json: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    const next = () => {
+      const value = argv[i + 1]
+      if (value === undefined) throw new Error(`${arg} needs a value`)
+      i += 1
+      return value
+    }
+    if (arg === '--index') options.index = path.resolve(next())
+    else if (arg === '--now') options.now = next()
+    else if (arg === '--json') options.json = true
+    else if (arg === '--help' || arg === '-h') { usage(); process.exit(0) }
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(options.now)) throw new Error('--now must be YYYY-MM-DD')
+  return options
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2))
+  const index = JSON.parse(fs.readFileSync(options.index, 'utf8'))
+  const validation = validateIndex(index)
+  const issues = [...validation.errors]
+  const now = new Date(`${options.now}T00:00:00Z`)
+  let stale = 0
+  let withdrawn = 0
+  for (const [i, record] of (index.records ?? []).entries()) {
+    const effective = effectiveStatus(record, now)
+    if (effective === 'stale') { stale += 1; issues.push(`records[${i}]: stale at ${options.now}`) }
+    if (effective === 'withdrawn') withdrawn += 1
+  }
+  const result = {
+    schema: 'dsh-label-drift/1',
+    checkedAt: options.now,
+    index: path.relative(STD, options.index),
+    total: (index.records ?? []).length,
+    stale,
+    withdrawn,
+    issues,
+    ok: issues.length === 0,
+  }
+  if (options.json) console.log(JSON.stringify(result, null, 2))
+  else {
+    console.log(`label-drift ${result.ok ? 'PASS' : 'FAIL'} — ${result.total} record(s), stale ${stale}, withdrawn ${withdrawn}`)
+    for (const issue of issues) console.log(`  - ${issue}`)
+  }
+  process.exit(result.ok ? 0 : 1)
+}
+
+try { main() } catch (error) {
+  console.error(`label-drift: ${error.message}`)
+  process.exit(3)
+}

package/40-checker/scripts/label-sync.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/** label-sync — validate immutable labels, compute recordHash, emit a static index. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { labelId, normalizeLabel, validateLabel } from '../src/label.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+
+function usage() {
+  console.log(`label-sync — validate labels and write publish/labels/<id>.json + index.json
+
+Usage:
+  node 40-checker/scripts/label-sync.mjs --source <labels.json> [--out <dir>] [--check]
+
+Source: an array of labels, or { "records": [ ... ] }.
+--check validates and prints a summary without writing.
+Exit: 0 valid, 1 invalid, 3 input error.`)
+}
+
+function parseArgs(argv) {
+  const options = { source: null, out: path.join(STD, 'publish', 'labels'), check: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    const next = () => {
+      const value = argv[i + 1]
+      if (value === undefined) throw new Error(`${arg} needs a value`)
+      i += 1
+      return value
+    }
+    if (arg === '--source') options.source = next()
+    else if (arg === '--out') options.out = path.resolve(next())
+    else if (arg === '--check') options.check = true
+    else if (arg === '--help' || arg === '-h') { usage(); process.exit(0) }
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  if (!options.source) throw new Error('--source is required')
+  options.source = path.resolve(options.source)
+  return options
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2))
+  const raw = JSON.parse(fs.readFileSync(options.source, 'utf8'))
+  const records = Array.isArray(raw) ? raw : Array.isArray(raw.records) ? raw.records : null
+  if (!records) throw new Error('source must be an array or { records: [...] }')
+  const errors = []
+  const out = []
+  for (const [index, record] of records.entries()) {
+    if (!record || typeof record !== 'object') { errors.push(`[${index}] not an object`); continue }
+    const provided = record.recordHash
+    const normalized = normalizeLabel(record)
+    const validation = validateLabel(normalized)
+    if (provided && provided !== normalized.recordHash) errors.push(`[${index}] recordHash does not match canonical record`)
+    for (const error of validation.errors) errors.push(`[${index}] ${error}`)
+    if (validation.valid) out.push(normalized)
+  }
+  if (errors.length > 0) {
+    console.error(`label-sync: ${errors.length} error(s)`)
+    for (const error of errors) console.error(`  - ${error}`)
+    process.exit(1)
+  }
+  const index = {
+    schema: 'dsh-label-index/1',
+    generatedAt: new Date().toISOString().slice(0, 10),
+    source: path.relative(STD, options.source),
+    spec: { labels: 'dsh-market-label/1', checklist: 'dsh-entry-checklist/1' },
+    records: out,
+  }
+  if (options.check) {
+    console.log(`PASS label-sync: ${out.length} record(s); no files written (--check)`)
+    return
+  }
+  fs.mkdirSync(options.out, { recursive: true })
+  for (const record of out) {
+    const file = path.join(options.out, `${labelId(record)}.json`)
+    fs.writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`)
+  }
+  fs.writeFileSync(path.join(options.out, 'index.json'), `${JSON.stringify(index, null, 2)}\n`)
+  console.log(`PASS label-sync: ${out.length} record(s) -> ${path.relative(STD, options.out)}`)
+}
+
+try { main() } catch (error) {
+  console.error(`label-sync: ${error.message}`)
+  process.exit(3)
+}

package/40-checker/scripts/label-verify.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** label-verify — look up one immutable label by recordHash or id; no grade, no ranking. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { effectiveStatus, labelId, validateLabel } from '../src/label.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const STD = path.resolve(HERE, '..', '..')
+
+function usage() {
+  console.log(`label-verify — look up one label without grades or rankings
+
+Usage:
+  node 40-checker/scripts/label-verify.mjs --index <index.json> (--hash sha256:... | --id <id>) [--json]
+
+Exit: 0 found and valid, 2 not found/invalid, 3 input error.`)
+}
+
+function parseArgs(argv) {
+  const options = { index: path.join(STD, 'publish', 'labels', 'index.json'), hash: null, id: null, json: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]
+    const next = () => {
+      const value = argv[i + 1]
+      if (value === undefined) throw new Error(`${arg} needs a value`)
+      i += 1
+      return value
+    }
+    if (arg === '--index') options.index = path.resolve(next())
+    else if (arg === '--hash') options.hash = next()
+    else if (arg === '--id') options.id = next()
+    else if (arg === '--json') options.json = true
+    else if (arg === '--help' || arg === '-h') { usage(); process.exit(0) }
+    else throw new Error(`unknown argument: ${arg}`)
+  }
+  if (!options.hash && !options.id) throw new Error('--hash or --id is required')
+  return options
+}
+
+function main() {
+  const options = parseArgs(process.argv.slice(2))
+  const index = JSON.parse(fs.readFileSync(options.index, 'utf8'))
+  const records = Array.isArray(index.records) ? index.records : []
+  const record = options.hash
+    ? records.find(row => row.recordHash === options.hash)
+    : records.find(row => labelId(row) === options.id)
+  if (!record) {
+    console.error(`label-verify: not found (${options.hash ?? options.id})`)
+    process.exit(2)
+  }
+  const validation = validateLabel(record)
+  if (!validation.valid) {
+    console.error(`label-verify: invalid record: ${validation.errors.join('; ')}`)
+    process.exit(2)
+  }
+  const summary = {
+    schema: 'dsh-label-verify/1',
+    ok: true,
+    id: labelId(record),
+    recordHash: record.recordHash,
+    subject: record.subject,
+    level: record.level,
+    status: record.status,
+    effectiveStatus: effectiveStatus(record),
+    claimLevel: record.claimLevel,
+    scope: record.scope,
+    validity: record.validity,
+    evidence: record.evidence,
+    disclaimer: record.disclaimer,
+    issuer: record.issuer,
+    verifyUrl: record.verifyUrl,
+    notClaimed: ['official standard', 'certification', 'security audit', 'ranking', 'market acceptance'],
+  }
+  if (options.json) console.log(JSON.stringify(summary, null, 2))
+  else {
+    console.log(`${summary.id}  ${summary.level}/${summary.effectiveStatus}`)
+    console.log(`subject: ${summary.subject.repo}@${summary.subject.version} (${summary.subject.commit.slice(0, 12)})`)
+    console.log(`claimLevel: ${summary.claimLevel}; issuer: ${summary.issuer}`)
+    console.log(`validity: ${summary.validity.generatedAt} -> ${summary.validity.expiresAt}`)
+    console.log(`evidence: ${summary.evidence[0]?.url ?? 'none'}`)
+    console.log(`disclaimer: ${summary.disclaimer}`)
+  }
+  process.exit(0)
+}
+
+try { main() } catch (error) {
+  console.error(`label-verify: ${error.message}`)
+  process.exit(3)
+}

package/40-checker/scripts/landlock-exec.c

@@ -0,0 +1,101 @@
+// Minimal Landlock launcher: allow read/execute everywhere, read-write only
+// under explicitly listed directories, then exec the target.
+//
+// Linux 5.13+ (Landlock ABI 1); uses TRUNCATE/REFER when the ABI supports them.
+// Build: cc -O2 scripts/landlock-exec.c -o /tmp/landlock-exec
+// Usage: landlock-exec --rw <dir> [--rw <dir> ...] -- <command> [args...]
+#define _GNU_SOURCE
+#include <linux/landlock.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+#ifndef LANDLOCK_ACCESS_FS_REFER
+#define LANDLOCK_ACCESS_FS_REFER (1ULL << 13)
+#endif
+#ifndef LANDLOCK_ACCESS_FS_TRUNCATE
+#define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
+#endif
+
+static long landlock_abi(void) {
+  return syscall(SYS_landlock_create_ruleset, NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
+}
+
+static int add_rule(int ruleset_fd, const char *path, __u64 access) {
+  int parent = open(path, O_PATH | O_CLOEXEC);
+  if (parent < 0) {
+    fprintf(stderr, "landlock-exec: open %s: %s\n", path, strerror(errno));
+    return -1;
+  }
+  struct landlock_path_beneath_attr attr;
+  memset(&attr, 0, sizeof(attr));
+  attr.allowed_access = access;
+  attr.parent_fd = parent;
+  int rc = syscall(SYS_landlock_add_rule, ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &attr, 0);
+  if (rc != 0) fprintf(stderr, "landlock-exec: add_rule %s: %s\n", path, strerror(errno));
+  close(parent);
+  return rc;
+}
+
+int main(int argc, char **argv) {
+  long abi = landlock_abi();
+  if (abi < 1) {
+    fprintf(stderr, "landlock-exec: Landlock unavailable (abi=%ld, errno=%s)\n", abi, strerror(errno));
+    return 3;
+  }
+
+  __u64 handled = LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_WRITE_FILE |
+                  LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR |
+                  LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_REMOVE_FILE |
+                  LANDLOCK_ACCESS_FS_MAKE_CHAR | LANDLOCK_ACCESS_FS_MAKE_DIR |
+                  LANDLOCK_ACCESS_FS_MAKE_REG | LANDLOCK_ACCESS_FS_MAKE_SOCK |
+                  LANDLOCK_ACCESS_FS_MAKE_FIFO | LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+                  LANDLOCK_ACCESS_FS_MAKE_SYM;
+  if (abi >= 2) handled |= LANDLOCK_ACCESS_FS_REFER;
+  if (abi >= 3) handled |= LANDLOCK_ACCESS_FS_TRUNCATE;
+
+  struct landlock_ruleset_attr ruleset = { .handled_access_fs = handled };
+  int ruleset_fd = syscall(SYS_landlock_create_ruleset, &ruleset, sizeof(ruleset), 0);
+  if (ruleset_fd < 0) {
+    fprintf(stderr, "landlock-exec: create_ruleset: %s\n", strerror(errno));
+    return 3;
+  }
+
+  // Read + execute everywhere; write access is denied unless a --rw rule follows.
+  if (add_rule(ruleset_fd, "/", LANDLOCK_ACCESS_FS_EXECUTE | LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR) != 0) return 3;
+
+  int i = 1;
+  int saw_separator = 0;
+  for (; i < argc; i++) {
+    if (strcmp(argv[i], "--") == 0) { saw_separator = 1; i++; break; }
+    if (strcmp(argv[i], "--rw") != 0 || i + 1 >= argc) {
+      fprintf(stderr, "usage: landlock-exec --rw <dir> [--rw <dir> ...] -- <command> [args...]\n");
+      return 3;
+    }
+    if (add_rule(ruleset_fd, argv[++i], handled) != 0) return 3;
+  }
+  if (!saw_separator || i >= argc) {
+    fprintf(stderr, "usage: landlock-exec --rw <dir> [--rw <dir> ...] -- <command> [args...]\n");
+    return 3;
+  }
+
+  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
+    fprintf(stderr, "landlock-exec: PR_SET_NO_NEW_PRIVS: %s\n", strerror(errno));
+    return 3;
+  }
+  if (syscall(SYS_landlock_restrict_self, ruleset_fd, 0) != 0) {
+    fprintf(stderr, "landlock-exec: restrict_self: %s\n", strerror(errno));
+    return 3;
+  }
+  close(ruleset_fd);
+
+  execvp(argv[i], &argv[i]);
+  fprintf(stderr, "landlock-exec: exec %s: %s\n", argv[i], strerror(errno));
+  return 127;
+}