dsh-standards 1.0.0 → 1.0.2

package/40-checker/README.md

@@ -3,7 +3,7 @@
 > 版本：0.1.0 ｜ 日期：2026-10-31 ｜ 标准：DS-C v1.0.0 ｜ 许可：Apache-2.0
 > 零依赖，Node ≥ 20。只读目标包；不修改被检对象。
 >
-> **未发布到 npm。** npm 上的 `dsh-plugin-verify` 是另一个项目；`dsh-levels` 也是第三方包。请从本仓运行 `node bin/...`，不要 `npx dsh-plugin-verify` / `npx dsh-levels`。
+> **发行方式**：本仓直接运行时用 `node 40-checker/bin/...`；npm 上通过 `dsh-standards` 包分发（提供 `dsh-standards` 与 `dsh-levels` 两个命令）。不要用 `npx dsh-plugin-verify`、`npx dsh-levels`——npm 上这两个名字属于其他项目。
 
 ## 1. 它做什么
 
@@ -50,7 +50,7 @@ node bin/dsh-plugin-verify.mjs /path/to/plugin --format sarif --out report.sarif
 # package：作者本地
 node bin/dsh-plugin-verify.mjs ./my-plugin
 
-# listing：市场门禁
+# listing：市场条目校验（收录前提醒，不是门禁）
 node bin/dsh-plugin-verify.mjs ./my-plugin \
   --profile listing \
   --market-index ./market.json \

package/40-checker/scripts/runtime-child.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// Runs L1-L3 in a disposable child process so a plugin cannot block or take over
+// the checker. Input: JSON on stdin. Output: JSON { checks } on stdout.
+import { runRuntimeChecks } from '../src/runtime.mjs'
+import { readSources } from '../src/util.mjs'
+
+const chunks = []
+for await (const chunk of process.stdin) chunks.push(chunk)
+const input = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+let sources = []
+try { sources = readSources(input.dir) } catch { sources = [] }
+const checks = await runRuntimeChecks({ ...input, sources })
+process.stdout.write(JSON.stringify({ checks }))

package/40-checker/src/cli.mjs

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url'
 import { runManifestChecks, DEFAULT_RUNTIME_VERSION } from './manifest.mjs'
 import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from './declarations.mjs'
 import { runRuntimeChecks } from './runtime.mjs'
-import { spawnSync } from 'node:child_process'
+import { spawn, spawnSync } from 'node:child_process'
 import { readSources } from './util.mjs'
 import { buildReport, writeReport } from './report.mjs'
 
@@ -13,7 +13,7 @@ const DEFAULT_COMMIT = 'ce7073d51254c26cd63b22a60835b8f948deb447'
 const DEFAULT_CORDIS = '4.0.6-alpha.1'
 
 function usage() {
-  return `dsh-plugin-verify ${VERSION} — DS-C conformance checker (MVP)
+  return `${process.env.DSH_CHECKER_BRAND || 'dsh-plugin-verify ' + VERSION} — DS-C conformance checker (MVP)
 
 Usage:
   dsh-plugin-verify <package-dir> [options]
@@ -133,6 +133,51 @@ function parseArgs(argv) {
   return options
 }
 
+function runtimeNotRun(reason) {
+  const meta = {
+    'DSC-04': ['C-4', 'L1'], 'DSC-05': ['C-5', 'L1'], 'DSC-06': ['C-6', 'L1+L2'],
+    'DSC-07': ['C-7', 'L2'], 'DSC-08': ['C-8', 'L3'], 'DSC-09': ['C-9', 'L1'],
+  }
+  return Object.entries(meta).map(([id, [clause, layer]]) => ({
+    id, clause, layer, result: 'ERROR', coverage: 'not-run', reason,
+    details: [], evidence: [], method: 'M', advisory: false,
+  }))
+}
+
+/**
+ * L1-L3 run in a child process so that a plugin cannot block the event loop,
+ * read the checker's environment, or kill the process. The child is hard-killed
+ * after timeoutMs + 3s; a kill is reported as not-run, never as a pass.
+ */
+function isolatedRuntimeChecks(input) {
+  return new Promise((resolve) => {
+    const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'scripts', 'runtime-child.mjs')
+    const child = spawn(process.execPath, [script], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    const timer = setTimeout(() => { try { child.kill('SIGKILL') } catch {} }, input.timeoutMs + 3000)
+    child.stdout.on('data', (chunk) => { out += chunk })
+    child.stderr.on('data', (chunk) => { err += chunk })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      resolve(runtimeNotRun(`L1 child failed to start: ${error.message}`))
+    })
+    child.on('exit', (code, signal) => {
+      clearTimeout(timer)
+      if (signal === 'SIGKILL' || signal === 'SIGTERM') {
+        return resolve(runtimeNotRun(`L1 killed after ${input.timeoutMs}ms; plugin blocked the event loop`))
+      }
+      try {
+        const parsed = JSON.parse(out)
+        resolve(parsed.checks)
+      } catch {
+        resolve(runtimeNotRun(`L1 child produced no JSON (exit ${code}): ${String(err).slice(0, 200)}`))
+      }
+    })
+    child.stdin.end(JSON.stringify(input))
+  })
+}
+
 async function entryRunCheck(kind, runtimeChecks, options, dir) {
   const byId = new Map(runtimeChecks.map(item => [item.id, item]))
   const c4 = byId.get('DSC-04')
@@ -204,6 +249,10 @@ export async function main(argv = process.argv.slice(2)) {
     process.stderr.write(`dsh-plugin-verify: target must be a package directory (tarball support is not in the MVP): ${dir}\n`)
     return 3
   }
+  if (!fs.existsSync(path.join(dir, 'package.json'))) {
+    process.stderr.write(`dsh-plugin-verify: not a package directory (no package.json): ${dir}\n`)
+    return 3
+  }
 
   const { manifest, kind, kindInferred, entry, patch, g4, checks: manifestChecks } = runManifestChecks(dir, {
     runtimeVersion: options.runtimeVersion,
@@ -223,6 +272,7 @@ export async function main(argv = process.argv.slice(2)) {
     { id: 'DSC-12', clause: 'C-12', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
     { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
   ]
+  const declarationAdjusted = declarationChecks.map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
   const advisoryChecks = [checkImportTimeAdvisory(sources)]
 
   if (options.scope === 'entry' && options.entryRuntime === 'server-entry' && kind !== 'plugin') options.treatAsPlugin = true
@@ -248,9 +298,9 @@ export async function main(argv = process.argv.slice(2)) {
       result: 'ERROR', coverage: 'not-run', reason, details: [], evidence: [], method: 'M', advisory: false,
     }))
   } else {
-    runtimeChecks = await runRuntimeChecks({
+    runtimeChecks = await isolatedRuntimeChecks({
       dir, manifest, kind: runtimeKind, entry: runtimeEntry,
-      runtimePath: options.runtime, timeoutMs: options.timeoutMs, sources,
+      runtimePath: options.runtime, timeoutMs: options.timeoutMs,
     })
   }
 
@@ -260,9 +310,18 @@ export async function main(argv = process.argv.slice(2)) {
     ...runtimeChecks,
     runCheck,
     advisoryChecks[0],
-    ...declarationChecks,
+    ...declarationAdjusted,
   ]
 
+  if (g4?.result === 'FAIL') {
+    const dsc01 = checks.find(item => item.id === 'DSC-01')
+    if (dsc01 && dsc01.result !== 'FAIL') {
+      dsc01.result = 'FAIL'
+      dsc01.reason = dsc01.reason ? `${dsc01.reason}; ${g4.reason ?? 'G4 failed'}` : (g4.reason ?? 'G4 failed')
+      dsc01.details = [...(dsc01.details ?? []), { item: 'G4', result: 'FAIL', reason: g4.reason ?? 'client shape failed' }]
+    }
+  }
+
   const subject = {
     mode: options.profile === 'listing' || options.profile === 'both' ? 'listing' : 'package',
     profile: options.profile,

package/40-checker/src/manifest.mjs

@@ -31,6 +31,19 @@ function inside(root, target) {
 export function resolveEntry(dir, manifest) {
   const candidates = []
   const exportTarget = rootExportTarget(manifest)
+  if (exportTarget) {
+    const absolute = path.resolve(dir, exportTarget)
+    if (!inside(dir, absolute)) {
+      return { exists: false, escape: true, source: 'exports["."]', target: exportTarget, absolute }
+    }
+    if (!isFile(absolute)) {
+      const sourceCandidates = ['src/index.ts', 'src/index.tsx', 'src/index.js', 'src/index.mjs']
+      const sourceEntry = sourceCandidates.find(relative => isFile(path.join(dir, relative))) ?? null
+      const scripts = isObject(manifest.scripts) ? manifest.scripts : {}
+      const buildHint = Boolean(sourceEntry) || ['build', 'prepare', 'compile'].some(name => typeof scripts[name] === 'string')
+      return { exists: false, escape: false, source: 'exports["."]', target: exportTarget, absolute, declaredMissing: true, sourceEntry, buildHint }
+    }
+  }
   if (exportTarget) candidates.push({ source: 'exports["."]', target: exportTarget })
   if (typeof manifest.main === 'string' && manifest.main.trim() !== '') candidates.push({ source: 'main', target: manifest.main })
   for (const fallback of ['index.js', 'index.mjs', 'index.cjs', 'index.ts']) candidates.push({ source: 'fallback', target: fallback })
@@ -183,12 +196,18 @@ export function runManifestChecks(dir, options = {}) {
   }
   if (entry.escape) {
     manifestDetails.push(detail('C-1.2', 'FAIL', `entry escapes the package: ${entry.target}`, ['package.json#exports']))
+  } else if (entry.declaredMissing && entry.buildHint) {
+    manifestDetails.push(detail('C-1.2', 'WARN', `exports["."] target missing; build hint exists (${entry.sourceEntry ?? 'build script'})`, ['package.json#exports']))
+  } else if (entry.declaredMissing) {
+    manifestDetails.push(detail('C-1.2', 'FAIL', `exports["."] points to a missing file: ${entry.target}`, ['package.json#exports']))
   } else if (entry.exists) {
     manifestDetails.push(detail('C-1.2', 'PASS', `entry resolves via ${entry.source}: ${entry.relative}`, [entry.relative]))
   } else if (entry.buildHint) {
     manifestDetails.push(detail('C-1.2', 'WARN', `entry not present in checkout; source/build hint exists (${entry.sourceEntry ?? 'build script'})`, ['package.json#scripts']))
   } else if (kind === 'bundle' || kind === 'client') {
     manifestDetails.push(detail('C-1.2', 'WARN', `no runtime entry; ${kind} packages may be patch/client only`, ['package.json#exports']))
+  } else if (Array.isArray(manifest.workspaces) || (manifest.workspaces && typeof manifest.workspaces === 'object')) {
+    manifestDetails.push(detail('C-1.2', 'NA', 'workspace root; run the checker on a package subdirectory', ['package.json#workspaces']))
   } else {
     manifestDetails.push(detail('C-1.2', 'FAIL', 'no resolvable runtime entry', ['package.json#exports', 'package.json#main']))
   }
@@ -207,7 +226,7 @@ export function runManifestChecks(dir, options = {}) {
     manifestDetails.push(detail('C-1.5', 'PASS', `license=${manifest.license}`))
   }
   if (manifest.private === true) {
-    manifestDetails.push(detail('C-1.6', 'WARN', 'private:true; not publishable to a registry', ['package.json#private']))
+    manifestDetails.push(detail('C-1.6', 'NA', 'private:true; not publishable to a registry', ['package.json#private']))
   }
   const manifestResult = worst(manifestDetails.map(item => item.result))
   const manifestCheck = check({

package/40-checker/src/report.mjs

@@ -45,7 +45,10 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
     ? adjustedChecks.map(item => runtimeIds.has(item.id) ? { ...item, result: 'NA', coverage: 'not-run', reason: 'out of scope for M1 static-only' } : item)
     : adjustedChecks
   const byId = new Map(effectiveChecks.map(item => [item.id, item]))
-  const selected = mandatory.map(id => byId.get(id)).filter(Boolean)
+  const selectedAll = mandatory.map(id => byId.get(id)).filter(Boolean)
+  // Advisory checks are reported but never move the verdict.
+  const selected = selectedAll.filter(item => item.advisory !== true)
+  const advisoryWarnings = selectedAll.filter(item => item.advisory === true && item.result === 'WARN')
   const missing = mandatory.filter(id => !byId.has(id))
   const failed = selected.filter(item => item.result === 'FAIL')
   const errored = selected.filter(item => item.result === 'ERROR')
@@ -80,6 +83,7 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
   if (failed.length > 0) reasonParts.push(`FAIL: ${failed.map(item => item.id).join(', ')}`)
   if (notRunIds.length > 0) reasonParts.push(`not run: ${notRunIds.join(', ')}`)
   if (warnings.length > 0) reasonParts.push(`WARN: ${warnings.map(item => item.id).join(', ')}`)
+  if (advisoryWarnings.length > 0) reasonParts.push(`advisory: ${advisoryWarnings.map(item => item.id).join(', ')}`)
 
   return {
     schema: 'dsh-conformance/1',
@@ -92,6 +96,7 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
       mandatory: mandatory.length,
       pass: pass.length,
       warn: warnings.length,
+      advisory: advisoryWarnings.length,
       fail: failed.length,
       na: selected.filter(item => item.result === 'NA').length,
       notRun: notRunIds.length,

package/40-checker/src/semver.mjs

@@ -63,19 +63,85 @@ function upperForTilde(version) {
   return { ...version, minor: version.minor + 1, patch: 0, prerelease: [] }
 }
 
-function tokenizeAlternative(alternative) {
-  const tokens = []
+function parsePartial(text) {
+  const match = /^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(text.trim())
+  if (!match) return null
+  return {
+    major: Number(match[1]),
+    minor: match[2] === undefined || /[xX*]/.test(match[2]) ? null : Number(match[2]),
+    patch: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
+}
+
+function fullVersion(partial) {
+  return { major: partial.major, minor: partial.minor ?? 0, patch: partial.patch ?? 0, prerelease: partial.prerelease }
+}
+function nextMinor(partial) { return { major: partial.major, minor: (partial.minor ?? 0) + 1, patch: 0, prerelease: [] } }
+function nextMajor(partial) { return { major: partial.major + 1, minor: 0, patch: 0, prerelease: [] } }
+function fmt(version) {
+  const base = `${version.major}.${version.minor}.${version.patch}`
+  return version.prerelease && version.prerelease.length ? `${base}-${version.prerelease.join('.')}` : base
+}
+
+function expandToken(raw) {
+  if (raw === '*' || raw === 'x' || raw === 'X') return '*'
+  const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?$/.exec(raw)
+  if (!match) return null
+  const op = match[1] ?? '='
+  const partial = {
+    major: Number(match[2]),
+    minor: match[3] === undefined || /[xX*]/.test(match[3]) ? null : Number(match[3]),
+    patch: match[4] === undefined || /[xX*]/.test(match[4]) ? null : Number(match[4]),
+    prerelease: match[5] ? match[5].split('.') : [],
+  }
+  const low = fullVersion(partial)
+  const noMinor = partial.minor === null
+  const noPatch = partial.patch === null
+  if (!noMinor && !noPatch) return `${op}${fmt(low)}`
+  switch (op) {
+    case '^':
+    case '~':
+    case '=':
+      return noMinor ? `>=${fmt(low)} <${fmt(nextMajor(partial))}` : `>=${fmt(low)} <${fmt(nextMinor(partial))}`
+    case '>=': return `>=${fmt(low)}`
+    case '>': return noMinor ? `>=${fmt(nextMajor(partial))}` : `>=${fmt(nextMinor(partial))}`
+    case '<': return `<${fmt(low)}`
+    case '<=': return noMinor ? `<${fmt(nextMajor(partial))}` : `<${fmt(nextMinor(partial))}`
+    default: return null
+  }
+}
+
+/** Hyphen ranges and x-ranges are normalized before tokenizing. */
+function expandAlternative(alternative) {
   const text = alternative.trim()
-  if (text === '' || text === '*' || text === 'x' || text === 'X') return [{ op: '*', version: null }]
-  // Insert a space between a comparator and its version when written as ">=1.2.3"
-  // (already no space) and split on whitespace.
+  if (text === '' || text === '*' || text === 'x' || text === 'X') return '*'
+  const hyphen = /^(.+?)\s+-\s+(.+)$/.exec(text)
+  if (hyphen) {
+    const left = parsePartial(hyphen[1])
+    const right = parsePartial(hyphen[2])
+    if (!left || !right) return null
+    const low = `>=${fmt(fullVersion(left))}`
+    if (right.minor === null) return `${low} <${fmt(nextMajor(right))}`
+    if (right.patch === null) return `${low} <${fmt(nextMinor(right))}`
+    return `${low} <=${fmt(fullVersion(right))}`
+  }
+  const parts = []
   for (const raw of text.split(/\s+/)) {
-    let token = raw
-    if (token === '*' || token === 'x' || token === 'X') {
-      tokens.push({ op: '*', version: null })
-      continue
-    }
-    const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(token)
+    const expanded = expandToken(raw)
+    if (expanded === null) return null
+    parts.push(expanded)
+  }
+  return parts.join(' ')
+}
+
+function tokenizeAlternative(alternative) {
+  const expanded = expandAlternative(alternative)
+  if (expanded === null) return null
+  if (expanded === '*') return [{ op: '*', version: null }]
+  const tokens = []
+  for (const raw of expanded.split(/\s+/)) {
+    const match = /^(>=|<=|>|<|=|\^|~)?\s*v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(raw)
     if (!match) return null
     const op = match[1] ?? '='
     const version = parseVersion(match[2])

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+## 1.0.2 — 2026-11-03
+
+- L1–L3 run in a child process and are hard-killed on timeout; a blocked event loop is reported as `not-run`, never a pass.
+- `dsh.capabilities` / `dsh.labels` warnings are advisory: still reported, no longer flip the verdict.
+- A `g4` client-shape failure now fails DSC-01 instead of being dropped.
+- `private: true` and workspace roots report NA instead of WARN/FAIL.
+- A directory without `package.json` returns exit 3 (usage), matching `dsh-levels`.
+
+## 1.0.1 — 2026-11-03
+
+- 打包：`files` 收窄，不再把 `40-checker/results/` 打进 npm 包（此前包含第三方插件结果、截图与本机路径）。
+- 文档：`npx dsh-levels` 会装到第三方包，改为 `npx -p dsh-standards dsh-levels`；修正不存在的 `bin/` 路径；测试数 73→98。
+- CLI：`dsh-standards --help` 首行显示自己的包名与版本。
+- 检查器：`exports["."]` 指向缺失文件时不再回退到 `main`。
+
+# Changelog
+
+## 2026-11-03 — Node 24.9 baseline
+- Require Node >=24.9.0 to match DeepSeek Harness 0.2.2-alpha.3.
+
+## 2026-11-02 — P0–P2, Apache-2.0, and attestation migration
+
+- Renamed certificate → attestation (`dsh-attestation/1`, `DSH-ATT-*`,
+  `publish/attestations/`); historical docs carry a migration banner.
+- Added the gap ledger (43), role governance (44), and three-purpose kits (45).
+- Added `scheme/`, `spec/clauses.json`, `spec/reference-suite.json`,
+  `spec/schemas/report.schema.json`, `evidence/` hash chain.
+- Added G4 static check, clause-map, stale-check, surveillance, dashboard.
+- Added developer/official/market kits and `publish/verify.mjs` / `verify.html`.
+- CI: governance checks, 73 tests, attestation verify, shell syntax, cross-platform matrix.
+- License: text CC BY 4.0 with a required Change Notice; code Apache-2.0 (D-013); marks separate.
+- Cross-repo: portal `f882144`, guide `e75cd9f`, kit `9897213`, catalog `a272d06`, certification `2f27666`, cert-mcp `4f0cf72`.

package/NOTICE

@@ -0,0 +1,14 @@
+DSH standards
+Copyright 2026 PerryLink
+
+Text/specifications/documentation: CC BY 4.0 (LICENSE-CC-BY).
+Modifications must carry a prominent Change Notice (MODIFICATION-POLICY.md).
+Code/scripts/schemas: Apache License 2.0 (LICENSE-APACHE).
+
+Unless required by applicable law or agreed to in writing, software is
+distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+See the applicable license for the specific language.
+
+The words DSH-ENTRY, DSH-FLOW, DSH-BOOST and the level badges are not licensed
+by either license. Their use is governed by governance/mark-policy.md.
+No trademark registration is claimed.

package/README.md

@@ -17,7 +17,7 @@
 
 | 层 | 规范/实践 | 当前状态 |
 |---|---|---|
-| 1 | **DSH-ENTRY 入门规范** | 18/18 `recognized`；base-only 10/18 verified（8 clean + 2 gate-reject）；real web profile 18/18 verified（16 clean + 2 gate-reject）；client 15/15 loaded；18/18 clean 未达成 |
+| 1 | **DSH-ENTRY 入门规范** | 18/18 `recognized`；base-only 10/18 有 runtime 证据（8 clean + 2 reject）；real web profile 16/18 无告警、2 个 host-gate reject（自评，无独立复核）；client 15/15 loaded；18/18 clean 未达成 |
 | 2 | **DSH-FLOW 顺畅规范** | draft；fixture 上 J1/J2/J4/J6 **12 PASS**；J3/J7 fixture runtime；J5/J8 static preflight；10 个真实包 **78 PASS / 4 FAIL / 2 blocked / 66 not-run** |
 | 3 | **DSH-BOOST 加速实践** | draft；LEV-1–8 **8/8 measured**（loader / context / provider-capture / synthetic timer；非生产基线） |
 
@@ -57,21 +57,21 @@
 ```bash
 # Published umbrella (package `dsh-standards`)
 npx dsh-standards <plugin-dir> --scope entry --entry-claim static
-npx dsh-levels audit <dir> --format json
+npx -p dsh-standards dsh-levels <dir> --format json
 
 # From a source checkout
 cd 40-checker
 node --test test/*.test.mjs
 
 # 只做结构识别（不声明运行）
-node bin/dsh-plugin-verify.mjs <plugin-dir> --scope entry --entry-claim static
+node 40-checker/bin/dsh-plugin-verify.mjs <plugin-dir> --scope entry --entry-claim static
 
 # 声明运行（bundle 需要 host）
-node bin/dsh-plugin-verify.mjs <bundle-dir> --scope entry \
+node 40-checker/bin/dsh-plugin-verify.mjs <bundle-dir> --scope entry \
   --host /path/to/@deepseek-ai/dsh-app-boot/lib/index.js
 
 # 三层自检（ENTRY 自动；FLOW/BOOST 证据文件）
-node bin/dsh-levels.mjs audit <dir> --format json
+node bin/dsh-levels.mjs <dir> --format json
 
 # J1 安装/卸载旅程
 node scripts/journey-runtime.mjs --package <dir> --json
@@ -95,7 +95,7 @@ node lev7-bench.mjs 64 20
 - 18 包 base-only runtime：**18/18 有原始 JSON；10/18 G3 verified，8 partial，0 error**；host gate 后 **8 clean + 2 reject + 8 partial**；
 - client runtime：**15/15 `client-module-loaded`**（真实 Chromium）；web-app **4/4 loaded**；
 - 不可用：**0 plugin code FAIL；2 host-gate reject（telemetry/verification）**；
-- 检查器：**73/73 tests**（含治理/DCO/评价记录/声明/验真/链/漂移测试）；
+- 检查器：**98/98 tests**（含治理/DCO/评价记录/声明/验真/链/漂移测试）；
 - J1：**6 PASS + 1 WARN**；LEV-3：volatile **0/20** vs control **20/20** remount；LEV-6：稳定 prefix **100%** vs 易变 **0%**；LEV-7：**8.24×**（合成，非生产基线）。
 
 ## 给插件开发者：什么时候用哪个工具

package/bin/dsh-standards.mjs

@@ -15,4 +15,5 @@ if (argv.includes('--version') || argv.includes('-v')) {
   process.exit(0)
 }
 
+process.env.DSH_CHECKER_BRAND = `dsh-standards ${pkg.version} (checker 0.1.0)`
 await import('../40-checker/bin/dsh-plugin-verify.mjs')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",
@@ -13,22 +13,31 @@
     "dsh-levels": "./bin/dsh-levels.mjs"
   },
   "files": [
-    "40-checker",
+    "bin",
+    "40-checker/bin",
+    "40-checker/src",
+    "40-checker/scripts",
+    "40-checker/samples",
+    "40-checker/fixtures",
+    "40-checker/test",
+    "40-checker/package.json",
+    "40-checker/README.md",
     "spec",
     "docs",
-    "bin",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "LICENSE-APACHE",
     "LICENSE-CC-BY",
-    "NOTICE.md"
+    "NOTICE.md",
+    "NOTICE"
   ],
   "scripts": {
     "test": "node --test 40-checker/test/*.test.mjs",
     "test:fixtures": "node bin/dsh-standards.mjs 40-checker/fixtures/good --scope entry --entry-claim static --format text"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24.9.0"
   },
   "keywords": [
     "dsh",

package/40-checker/.github/workflows/plugin-verify.yml

@@ -1,70 +0,0 @@
-name: plugin-verify
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-jobs:
-  l0:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: unit tests
-        run: node --test
-      - name: good fixture (static-only M1; expect 0)
-        run: |
-          node bin/dsh-plugin-verify.mjs fixtures/good \
-            --static-only \
-            --market-index fixtures/market-index.json \
-            --plugin-name @dsh-fixtures/good-plugin \
-            --format json --out /tmp/good.json
-      - name: bad fixture (expect 1; 0 would be a false green)
-        run: |
-          set +e
-          node bin/dsh-plugin-verify.mjs fixtures/bad --format json --out /tmp/bad.json
-          code=$?
-          test "$code" -eq 1
-      - name: SARIF smoke
-        run: |
-          node bin/dsh-plugin-verify.mjs fixtures/good \
-            --static-only \
-            --market-index fixtures/market-index.json \
-            --plugin-name @dsh-fixtures/good-plugin \
-            --format sarif --out /tmp/good.sarif
-      - uses: actions/upload-artifact@v4
-        with:
-          name: reports
-          path: |
-            /tmp/good.json
-            /tmp/bad.json
-            /tmp/good.sarif
-
-  l1-manual:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: build host farm (requires a DSH checkout at DSH_HOST)
-        env:
-          DSH_HOST: ${{ vars.DSH_HOST }}
-        run: |
-          test -n "$DSH_HOST"
-          node scripts/host-farm.mjs --plugin fixtures/bundle --farm /tmp/farm --link --quiet
-      - name: L1 on bundle fixture
-        env:
-          DSH_HOST: ${{ vars.DSH_HOST }}
-        run: |
-          node bin/dsh-plugin-verify.mjs /tmp/farm/plugins/bundle \
-            --treat-as-plugin \
-            --runtime "$DSH_HOST/vendor/cordis/lib/index.js" \
-            --runtime-version 0.2.2-alpha.2 \
-            --format json --out /tmp/l1.json
-      - uses: actions/upload-artifact@v4
-        with:
-          name: l1-report
-          path: /tmp/l1.json