dsh-standards 0.0.3 → 1.0.1

package/40-checker/test/permissions.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { checkCredentials } from '../src/declarations.mjs'
+import { validateCommitments, validateDisclosure, COMMITMENT_IDS } from '../src/permissions.mjs'
+
+const manifest = {
+  dsh: {
+    commitmentsVersion: 1,
+    commitments: Object.fromEntries(COMMITMENT_IDS.map(id => [id, true])),
+    disclosure: {
+      endpoints: ['https://api.example.com'],
+      retention: 'none',
+      systemPrompt: 'unchanged',
+    },
+    capabilities: ['network:egress'],
+  },
+}
+
+test('all 9 commitments validate as booleans', () => {
+  const details = validateCommitments(manifest)
+  assert.equal(details.length, 1)
+  assert.equal(details[0].result, 'PASS')
+})
+
+test('missing commitment is a warning, not a failure', () => {
+  const details = validateCommitments({ dsh: { commitments: { 'no-session-upload': true } } })
+  assert.ok(details.some(item => item.result === 'WARN' && item.reason.includes('missing commitment')))
+})
+
+test('disclosure endpoints must be https URLs', () => {
+  const details = validateDisclosure({ dsh: { disclosure: { endpoints: ['http://insecure.example.com'] } } })
+  assert.ok(details.some(item => item.result === 'WARN'))
+})
+
+test('checkCredentials reads both declaration fields', () => {
+  const check = checkCredentials(manifest, [])
+  assert.equal(check.result, 'PASS')
+  assert.ok(check.details.some(item => item.item === 'C-12.6' && item.result === 'PASS'))
+  assert.ok(check.details.some(item => item.item === 'C-12.7' && item.result === 'PASS'))
+})

package/40-checker/test/semver.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { compareVersions, parseVersion, satisfies, validRange } from '../src/semver.mjs'
+
+test('parseVersion accepts exact semver and prerelease', () => {
+  assert.deepEqual(parseVersion('0.2.2-alpha.2'), { major: 0, minor: 2, patch: 2, prerelease: ['alpha', '2'] })
+  assert.equal(parseVersion('^0.2.2'), null)
+})
+
+test('compareVersions orders release above prerelease', () => {
+  assert.equal(compareVersions(parseVersion('0.2.2'), parseVersion('0.2.2-alpha.2')), 1)
+  assert.equal(compareVersions(parseVersion('0.2.2-alpha.2'), parseVersion('0.2.2-alpha.1')), 1)
+  assert.equal(compareVersions(parseVersion('0.2.0-rc.2'), parseVersion('0.2.0-0')), 1)
+})
+
+test('satisfies handles the ranges used by real plugins', () => {
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.2.2-alpha.2 <0.3.0'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.1.5-rc.1 <0.2.0-0 || >=0.2.0-rc.2 <0.3.0-0'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2-alpha.2'), true)
+  assert.equal(satisfies('0.2.2-alpha.2', '~0.2.2'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', '>=0.3.0'), false)
+  assert.equal(satisfies('0.2.2-alpha.2', 'workspace:^'), false)
+  assert.equal(satisfies('24.0.0', '^22.19.0 || >=24.0.0'), true)
+})
+
+test('validRange rejects empty and malformed ranges', () => {
+  assert.equal(validRange('>=0.2.2 <0.3.0'), true)
+  assert.equal(validRange(''), false)
+  assert.equal(validRange('workspace:^'), false)
+  assert.equal(validRange('not-a-range'), false)
+})

package/40-checker/test/verify.test.mjs

@@ -0,0 +1,57 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { buildIndex, findAttestation, effectiveStatus, summarize, verify } from '../../publish/verify.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const ROOT = path.resolve(HERE, '..', '..')
+
+test('verify: the index contains the example record', () => {
+  const index = buildIndex(path.join(ROOT, 'publish/attestations'))
+  assert.equal(index.schema, 'dsh-attestation-index/1')
+  const entry = findAttestation(index, 'DSH-ATT-2026-001')
+  assert.ok(entry)
+  assert.equal(entry.grade, 'A')
+  assert.equal(entry.claimLevel, 'self-reported')
+})
+
+test('verify: an unknown ID is not found', () => {
+  const index = buildIndex(path.join(ROOT, 'publish/attestations'))
+  assert.equal(findAttestation(index, 'DSH-ATT-1999-999'), null)
+})
+
+test('verify: an expired active record is reported expired', () => {
+  const cert = { status: 'active', expiresAt: '2020-01-01' }
+  assert.equal(effectiveStatus(cert, new Date('2026-11-01T00:00:00Z')), 'expired')
+})
+
+test('verify: a non-active status is preserved', () => {
+  assert.equal(effectiveStatus({ status: 'withdrawn', expiresAt: '2030-01-01' }), 'withdrawn')
+})
+
+test('verify: the example record validates', async () => {
+  const result = await verify({ root: ROOT, id: 'DSH-ATT-2026-001' })
+  assert.equal(result.ok, true)
+  assert.equal(result.attestation.claimLevel, 'self-reported')
+  assert.equal(result.attestation.selfAssessed, true)
+})
+
+test('verify: an invalid file fails', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-verify-cert-'))
+  const file = path.join(dir, 'bad.json')
+  fs.writeFileSync(file, JSON.stringify({ schema: 'dsh-attestation/1', attestationId: 'bad' }))
+  const result = await verify({ root: ROOT, file })
+  assert.equal(result.ok, false)
+  assert.ok(result.errors.length > 0)
+  fs.rmSync(dir, { recursive: true, force: true })
+})
+
+test('verify: summarize keeps the disclaimer and evidence', () => {
+  const cert = JSON.parse(fs.readFileSync(path.join(ROOT, 'publish/attestations/DSH-ATT-2026-001.json'), 'utf8'))
+  const s = summarize(cert)
+  assert.match(s.disclaimer, /非官方/)
+  assert.equal(s.evidence.length, 5)
+})

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+## 1.0.1 — 2026-11-03
+
+- 打包：`files` 收窄，不再把 `40-checker/results/` 打进 npm 包（此前包含第三方插件结果、截图与本机路径）。
+- 文档：`npx dsh-levels` 会装到第三方包，改为 `npx -p dsh-standards dsh-levels`；修正不存在的 `bin/` 路径；测试数 73→98。
+- CLI：`dsh-standards --help` 首行显示自己的包名与版本。
+- 检查器：`exports["."]` 指向缺失文件时不再回退到 `main`。
+
+# Changelog
+
+## 2026-11-03 — Node 24.9 baseline
+- Require Node >=24.9.0 to match DeepSeek Harness 0.2.2-alpha.3.
+
+## 2026-11-02 — P0–P2, Apache-2.0, and attestation migration
+
+- Renamed certificate → attestation (`dsh-attestation/1`, `DSH-ATT-*`,
+  `publish/attestations/`); historical docs carry a migration banner.
+- Added the gap ledger (43), role governance (44), and three-purpose kits (45).
+- Added `scheme/`, `spec/clauses.json`, `spec/reference-suite.json`,
+  `spec/schemas/report.schema.json`, `evidence/` hash chain.
+- Added G4 static check, clause-map, stale-check, surveillance, dashboard.
+- Added developer/official/market kits and `publish/verify.mjs` / `verify.html`.
+- CI: governance checks, 73 tests, attestation verify, shell syntax, cross-platform matrix.
+- License: text CC BY 4.0 with a required Change Notice; code Apache-2.0 (D-013); marks separate.
+- Cross-repo: portal `f882144`, guide `e75cd9f`, kit `9897213`, catalog `a272d06`, certification `2f27666`, cert-mcp `4f0cf72`.

package/LICENSE

@@ -0,0 +1,28 @@
+DSH standards — licensing
+
+This repository uses two licenses, by material type.
+
+1. Text, specifications, checklists, documentation, and translations
+   License: Creative Commons Attribution 4.0 International (CC BY 4.0)
+   Full text: LICENSE-CC-BY
+   SPDX: CC-BY-4.0
+   Modification notice: MODIFICATION-POLICY.md (required, prominent)
+
+2. Code, scripts, schemas, and machine-readable checkers
+   License: Apache License, Version 2.0
+   Full text: LICENSE-APACHE
+   SPDX: Apache-2.0
+
+3. Marks and badges
+   The words DSH-ENTRY, DSH-FLOW, DSH-BOOST and the level badges are not
+   licensed by 1 or 2. Their use is governed by governance/mark-policy.md.
+   No trademark registration is claimed.
+
+Contributions are accepted under governance/contribution-terms.md
+(DCO 1.1 + a non-exclusive copyright licence + an RF patent commitment), not
+under a copyright assignment. By contributing text you agree that it may be
+distributed under CC BY 4.0 and that modifications must carry a Change Notice;
+by contributing code you agree that it may be distributed under Apache-2.0.
+
+This file is a notice, not legal advice. A lawyer should review it before the
+repository is used commercially.

package/LICENSE-APACHE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 PerryLink dsh-plugin-portal contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-CC-BY

@@ -0,0 +1,23 @@
+Creative Commons Attribution 4.0 International (CC BY 4.0)
+
+This repository's text, specifications, checklists, documentation, and
+translations are licensed under CC BY 4.0.
+
+Full legal code:
+https://creativecommons.org/licenses/by/4.0/legalcode
+
+SPDX identifier: CC-BY-4.0
+
+You are free to share and adapt the material for any purpose, provided you:
+- give appropriate credit;
+- link to the license;
+- indicate if changes were made; and
+- do not imply the licensor endorses you or your use.
+
+This project asks for the "indicate changes" requirement to be met with a
+prominent Change Notice. See MODIFICATION-POLICY.md for the required fields.
+That policy is the project's attribution/notice format; it does not add a
+license restriction beyond CC BY 4.0. If it is read as a restriction, CC BY 4.0
+controls.
+
+The license does not grant trademark rights. See governance/mark-policy.md.

package/NOTICE

@@ -0,0 +1,14 @@
+DSH standards
+Copyright 2026 PerryLink
+
+Text/specifications/documentation: CC BY 4.0 (LICENSE-CC-BY).
+Modifications must carry a prominent Change Notice (MODIFICATION-POLICY.md).
+Code/scripts/schemas: Apache License 2.0 (LICENSE-APACHE).
+
+Unless required by applicable law or agreed to in writing, software is
+distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+See the applicable license for the specific language.
+
+The words DSH-ENTRY, DSH-FLOW, DSH-BOOST and the level badges are not licensed
+by either license. Their use is governed by governance/mark-policy.md.
+No trademark registration is claimed.

package/NOTICE.md

@@ -0,0 +1,11 @@
+# NOTICE
+
+`dsh-standards` is a community project. It is **not** an official DeepSeek
+Harness standard, certification, security audit, endorsement, or ranking.
+
+- Text, specifications, and documentation: CC BY 4.0 (`LICENSE-CC-BY`).
+- Code, scripts, and schemas: Apache-2.0 (`LICENSE-APACHE`).
+
+Copying or modifying the specification text requires a Change Notice naming the
+source commit, the changed section, what changed, why, and the date. See
+`MODIFICATION-POLICY.md`.

package/README.md

@@ -1,9 +1,152 @@
+> **Execution home.** `dsh-standards` is the public execution umbrella for the
+> three DSH layers: it ships the conformance checker, the level audit, and the
+> canonical specification files. The prose guide is
+> **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)**; the
+> low-level rule text remains in
+> **[dsh-plugin-spec](https://github.com/PerryLink/dsh-plugin-spec)**.
+> The old npm reservation (`dsh-standards@0.0.3`) is replaced by this 1.x line.
+
 # dsh-standards
 
-Name reservation for the DSH plugin standards draft. Canonical: https://github.com/PerryLink/dsh-standards (private).
+> **非官方、非认证、非安全审计。** 这是 DSH 插件规范与实践草稿（canonical: dsh-standards），不代表 DeepSeek 官方背书。
+> `"DeepSeek Harness"` 是 DeepSeek 的商标；本项目只使用 `DSH` 缩写。
+>
+> ⚠️ **修改必须说明**：复制或修改本仓文本时，必须在显著位置给出 Change Notice（来源 commit、改了哪个章节、改了什么、为什么、日期）。见 [`MODIFICATION-POLICY.md`](MODIFICATION-POLICY.md)。
+
+一个项目，三层采用深度：
+
+| 层 | 规范/实践 | 当前状态 |
+|---|---|---|
+| 1 | **DSH-ENTRY 入门规范** | 18/18 `recognized`；base-only 10/18 有 runtime 证据（8 clean + 2 reject）；real web profile 16/18 无告警、2 个 host-gate reject（自评，无独立复核）；client 15/15 loaded；18/18 clean 未达成 |
+| 2 | **DSH-FLOW 顺畅规范** | draft；fixture 上 J1/J2/J4/J6 **12 PASS**；J3/J7 fixture runtime；J5/J8 static preflight；10 个真实包 **78 PASS / 4 FAIL / 2 blocked / 66 not-run** |
+| 3 | **DSH-BOOST 加速实践** | draft；LEV-1–8 **8/8 measured**（loader / context / provider-capture / synthetic timer；非生产基线） |
+
+## 先看什么
+
+- [START-HERE](START-HERE.md) — 新会话先读的一页入口
+- [51-新会话操作手册](51-新会话操作手册.md) — 仓库地图、命令、权限、常见坑
+- [00-索引](00-索引.md) — 全包路由
+- [31-DSH-ENTRY 入门规范](31-DSH-ENTRY入门规范.md) — 内部条款
+- [99-DSH-ENTRY 兼容性画像（对外版）](99-DSH-ENTRY兼容性画像-对外版.md) — 4–6 页对外版
+- [32-DSH-FLOW 顺畅规范](32-DSH-FLOW顺畅规范.md) — J1–J8
+- [33-DSH-BOOST 加速实践](33-DSH-BOOST加速实践.md) — 8 条 LEV
+- [34-三层分级模型（GB/GB-T/GB-Z 类比）](34-三层分级模型-GB-GBT-GBZ类比.md) — 为什么是三层、怎么读
+- [35-三层开发建议与验收清单](35-三层开发建议与验收清单.md) — 作者最短路径 / 评审清单
+- [36-插件全生命周期与工具链](36-插件全生命周期与工具链.md) — 从脚手架到退役
+- [37-PerryLink 插件生态三层对照](37-PerryLink插件生态-三层对照与升级清单.md) — 我的仓怎么升级
+- [38-三层标准 RFC](38-RFC-三层标准-待商议问题.md) — 内测群商议的 8 个问题
+- [39-五工具定位与贡献](39-五工具定位与贡献.md) — guide/doctor/cert/portal/catalog 的角色
+- [40-五工具全面转向方案](40-五工具全面转向方案.md) — 以三层为主轴的迁移计划
+- [42-标准体系缺口](42-标准体系缺口-认证检验认可.md) — 认证/检验/认可/监督还差什么
+- [43-缺口总账与 AI 可执行方案](43-缺口总账与AI可执行方案.md) — **全部缺口、AI/Human/模板/删除裁决、90 天 P0–P3**
+- [44-角色治理与贡献机制](44-角色治理与贡献机制.md) — **角色阶梯、DCO+DCT（CLA 式）、COI、申诉、AI 职员**
+- [45-三用途落地](45-三用途落地-官方市场开发者.md) — **官方前沿探索 / 市场参考 / 开发者指南**
+- [P0-P2 执行状态](P0-P2-STATUS.md) — 逐项 DONE / PARTIAL / REPLACED
+- [46-剩余事项与执行建议](46-剩余事项与执行建议.md) — 还差什么、先做什么、什么不做
+- [47-配套插件发布记录](47-配套插件发布记录-2026-11-02.md) — guide/doctor/kit/upgrade/cert-mcp 的 npm + Release
+- [48-配套包命名研究](48-配套包命名研究-2026-11-02.md) — dsh-* 占用情况与命名备选
+- [49-配套包改名迁移记录](49-配套包改名迁移记录-2026-11-02.md) — clinic / scaffold / primer / codemod 的新旧仓映射、指针与 deprecate
+- [50-新会话交接提示词](50-新会话交接提示词.md) — 无上下文新会话的启动提示词（不依赖旧会话）
+- [scheme/](scheme/SCHEME-v1.md) — A–E / A–D 评价方案与 rubric
+- [evidence/](evidence/README.md) — 追加式证据链与复跑说明
+- [97-采纳可行性评估](97-采纳可行性评估.md) — 官方路径、缺口、90 天
+- [98-内测群与官方沟通包](98-内测群与官方沟通包.md) — 对外话术
+
+## 快速命令
+
+```bash
+# Published umbrella (package `dsh-standards`)
+npx dsh-standards <plugin-dir> --scope entry --entry-claim static
+npx -p dsh-standards dsh-levels <dir> --format json
 
-This package is intentionally minimal: it does not certify, audit, or guarantee any plugin.
+# From a source checkout
+cd 40-checker
+node --test test/*.test.mjs
 
+# 只做结构识别（不声明运行）
+node 40-checker/bin/dsh-plugin-verify.mjs <plugin-dir> --scope entry --entry-claim static
+
+# 声明运行（bundle 需要 host）
+node 40-checker/bin/dsh-plugin-verify.mjs <bundle-dir> --scope entry \
+  --host /path/to/@deepseek-ai/dsh-app-boot/lib/index.js
+
+# 三层自检（ENTRY 自动；FLOW/BOOST 证据文件）
+node bin/dsh-levels.mjs <dir> --format json
+
+# J1 安装/卸载旅程
+node scripts/journey-runtime.mjs --package <dir> --json
+
+# 治理/贡献/评价记录检查
+node scripts/governance-check.mjs
+node scripts/attestation-check.mjs
+node scripts/claim-check.mjs
+node scripts/dco-check.mjs --range HEAD~1..HEAD
+node ../publish/verify.mjs --id DSH-ATT-2026-001
+
+# LEV-7 有界并行基准
+cd ../examples/boost
+node lev7-bench.mjs 64 20
 ```
-$ npx dsh-standards
+
+## 当前硬数据
+
+- 18 包 entry static：**18/18 recognized，0 clean**；
+- 18 包 DS-C static：**0 PASS / 9 WARN / 9 FAIL**；
+- 18 包 base-only runtime：**18/18 有原始 JSON；10/18 G3 verified，8 partial，0 error**；host gate 后 **8 clean + 2 reject + 8 partial**；
+- client runtime：**15/15 `client-module-loaded`**（真实 Chromium）；web-app **4/4 loaded**；
+- 不可用：**0 plugin code FAIL；2 host-gate reject（telemetry/verification）**；
+- 检查器：**98/98 tests**（含治理/DCO/评价记录/声明/验真/链/漂移测试）；
+- J1：**6 PASS + 1 WARN**；LEV-3：volatile **0/20** vs control **20/20** remount；LEV-6：稳定 prefix **100%** vs 易变 **0%**；LEV-7：**8.24×**（合成，非生产基线）。
+
+## 给插件开发者：什么时候用哪个工具
+
+| 阶段 | 命令 | 工具 | 产出 |
+|---|---|---|---|
+| 开始 | `dsh-dev new` / `dsh-start new` | dsh-plugin-start | 可安装骨架 |
+| 静态预检 | `dsh-dev check` / `dsh-ready` | dsh-plugin-ready | static report（host `not-run`） |
+| 宿主契约 | `dsh-clinic --only R,K,X` | dsh-plugin-doctor/clinic | 宿主契约 |
+| 隔离安装 | `dsh-test-drive` | dsh-test-drive | C3 证据 |
+| 市场提交 | `entry-validate --host-evidence` | 本仓 40-checker | C1–C8 + C3 |
+| 工具管理 | `dsh-tools list/doctor/install` | dsh-plugin-tools | 版本/安装指引 |
+
+完整图见 [docs/DEVELOPER-JOURNEY.md](docs/DEVELOPER-JOURNEY.md)；工具家族见 [dsh-plugin-devtools](https://github.com/PerryLink/dsh-plugin-devtools)。旧名项目见 [RENAMES.md](RENAMES.md)。
+
+## 治理与贡献
+
+- 角色与权限：`governance/roles.json`；一页说明：`GOVERNANCE.md`
+- 贡献：DCO 1.1 + DCT v1（`dsh-ct/1`，许可而非版权转让）；见 `CONTRIBUTING.md`
+- 标志：`governance/mark-policy.md`（自动授予、可撤销、必须带免责声明）
+- 申诉：`governance/appeals.md`；AI 只受理/计时/复核，人类终裁
+- 三用途采用包：`adoption/{official,market,developer}/`（按 `45` 落地）
+
+## 边界
+
+- 不收费、不卖等级、不卖排名；
+- 不做认证/安全审计；
+- 不把 static 写成 runtime；
+- 不把 10/18 base-only 写成 18/18 web/生产；不把 `client-module-loaded` 写成 UI/认证；
+- 不声称官方推荐/采纳；
+- 不声称认证/认可/安全审计；A–D 是质量等级，不是 ENTRY/FLOW/BOOST。
+
+## 许可
+
+- 文本/规范/文档/翻译：**CC BY 4.0**（`LICENSE-CC-BY`）；**修改必须按 `MODIFICATION-POLICY.md` 给出 Change Notice**；
+- 代码/脚本/schema：**Apache-2.0**（`LICENSE-APACHE`，含专利授权与防御终止）；
+- 标志/badge：单独规则，见 `governance/mark-policy.md`，不随上述许可授权；
+- 贡献：DCO 1.1 + DCT v1，不要求版权转让。
+
+## 目录
+
+```text
+00-99*.md         规范/研究/画像/沟通包
+40-checker/       检查器、J1 旅程、bundle smoke、样本框、结果
+governance/       角色/贡献条款/标志/申诉/COI/决策日志 + 机器检查
+adoption/         official / market / developer 三套采用包
+spec/             levels.json + clauses.json + schemas（evidence / report / attestation）
+examples/boost/   LEV-7 参考实现与基准
+publish/          labels 示例 + 评价记录 JSON
 ```
+
+## 先行项目
+
+`dsh-plugin-standard`（lanbaolu）是同生态的先行项目；本项目与其无隶属关系，引用/对比时将标注来源。许可见 `LICENSE`（文本 CC BY 4.0 / 代码 Apache-2.0）；修改必须说明。

package/bin/dsh-levels.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Public umbrella entry point for the three-layer audit.
+// The implementation lives in 40-checker/.
+import '../40-checker/bin/dsh-levels.mjs'

package/bin/dsh-standards.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// Public umbrella entry point for the DSH standards checker.
+// The implementation lives in 40-checker/; this shim keeps the package-level
+// command stable while the checker remains independently runnable from source.
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'))
+const argv = process.argv.slice(2)
+
+if (argv.includes('--version') || argv.includes('-v')) {
+  console.log(`dsh-standards ${pkg.version} (checker 0.1.0)`)
+  process.exit(0)
+}
+
+process.env.DSH_CHECKER_BRAND = `dsh-standards ${pkg.version} (checker 0.1.0)`
+await import('../40-checker/bin/dsh-plugin-verify.mjs')

package/docs/BOOST-FIXTURES-2026-11-02.md

@@ -0,0 +1,38 @@
+# BOOST fixture plan (2026-11-02)
+
+> 非官方 · 非排名 · 环境限定. B1–B7 are fixture-level; B8 is optional and environment-scoped.
+
+## B1/B6 — lifecycle + uninstall
+
+- Use `omdsh-dev/plugin-template/tests/harness.ts` shape: real `Context`, `ctx.plugin`, `fiber.dispose`.
+- Fixture: timer/socket/watcher/listener registered through `ctx.effect`/`ctx.on`.
+- Observe: `fiber.getEffects()` returns to baseline after dispose; `process.getActiveResourcesInfo()` has no new handles; dispose 10 times.
+- Negative control: module-level timer / no disposer; must be detected.
+
+## B2 — inject / optional service
+
+- Fixture: provider service + consumer with required `inject` and optional `ctx.get`.
+- Required: consumer stays PENDING when provider absent; becomes active when provider mounts; replacement reloads.
+- Optional: `ctx.get` returns `undefined` when absent; no crash.
+- Negative control: required service fetched via `ctx.get` (should not be treated as satisfied).
+- The pilot fixture syntax was not accepted by Cordis 4.0.5; do not fake a pass. Use the template harness shape or mark `blocked`.
+
+## B4 — events
+
+- Fixture: waterfall observer must call `next()`; downstream receives the value.
+- Serial/bail: order is deterministic; a bail stops later handlers.
+- Negative control: observer does not call `next()`; downstream must not run.
+- If the event API shape is not confirmed, mark `not-run`; do not invent an API.
+
+## B7 — patch lines
+
+- Temporary profile `--dump-config`: each patch line is visible; disable is visible; no hidden/manual extra patch.
+
+## B8 — performance (optional)
+
+- Fixed host/Cordis/Node/OS/profile; warmup 3; 20 cold starts; record boot-to-URL, RSS/heap, bundle bytes, dispose residue.
+- Report raw p50/p95 + environment; no cross-plugin ranking; resolution limit must be stated (pilot polling was 250 ms).
+
+## Output
+
+`boost-fixtures.jsonl` per fixture + `BOOST-REPORT.md`; failed fixture is a real finding, not a reason to change the plugin.