dsh-standards 1.1.2 → 1.2.0

package/40-checker/scripts/journey-config-observe.mjs

@@ -19,6 +19,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { sanitizedEnv } from '../src/sandbox-env.mjs'
 
 function parse(argv) {
   const out = { package: null, dsh: process.env.DSH_BIN || 'dsh', json: false, timeout: 120_000 }
@@ -43,10 +44,11 @@ function main() {
   const pkg = path.resolve(options.package)
   const manifest = JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'), 'utf8'))
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-config-'))
+  const tmp = path.join(home, 'tmp')
+  fs.mkdirSync(tmp, { recursive: true })
   const profile = 'flow-config'
-  const env = { ...process.env, DSH_HOME: home }
-  delete env.DEEPSEEK_API_KEY
-  delete env.OPENAI_API_KEY
+  // Allowlisted env only: a plugin boots on import and must not see tokens/keys.
+  const env = sanitizedEnv({ DSH_HOME: home, HOME: home, USERPROFILE: home, TMPDIR: tmp, TEMP: tmp, TMP: tmp })
   const checks = []
   let dshVersion = null
   const add = (id, result, reason) => checks.push({ id, result, reason })

package/40-checker/scripts/journey-runtime.mjs

@@ -6,34 +6,46 @@
  * J3 (config validation), J5 (permissions), J7 (observability) and J8 (client
  * shapes) are reported `not-run`: this probe does not pretend to cover them.
  *
+ * Evidence mode (`--log-dir`): every command records its argv, exit code,
+ * ISO start/end time, and stdout/stderr log path + sha256. `flow-collect.mjs`
+ * wraps those checks into `dsh-flow-evidence/2`. Without `--log-dir` the older
+ * summary shape is preserved for existing consumers.
+ *
+ * Safety: the child environment is built from an allowlist (no tokens, keys,
+ * credentials), HOME/DSH_HOME/TMPDIR point at a fresh temp tree, and the probe
+ * never grants an exact-version exemption unless the caller explicitly asks.
+ *
  * Usage:
- *   node scripts/journey-runtime.mjs --package <dir> [--dsh <bin>] [--previous <dir>] [--json]
+ *   node scripts/journey-runtime.mjs --package <dir> [--dsh <bin>] [--previous <dir>]
+ *     [--log-dir <dir>] [--allow-exemption] [--json]
  */
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { sanitizedEnv, envPolicy } from '../src/sandbox-env.mjs'
+import { sha256Value } from '../src/flow-evidence.mjs'
 
 function parse(argv) {
-  const out = { package: null, previous: null, dsh: process.env.DSH_BIN || null, allowExemption: false, json: false, timeout: 120_000 }
+  const out = {
+    package: null, previous: null, dsh: process.env.DSH_BIN || null, allowExemption: false,
+    json: false, timeout: 120_000, logDir: null,
+  }
   for (let i = 0; i < argv.length; i += 1) {
     if (argv[i] === '--package') out.package = argv[++i]
     else if (argv[i] === '--previous') out.previous = argv[++i]
     else if (argv[i] === '--dsh') out.dsh = argv[++i]
+    else if (argv[i] === '--log-dir') out.logDir = argv[++i]
     else if (argv[i] === '--allow-exemption') out.allowExemption = true
     else if (argv[i] === '--json') out.json = true
     else if (argv[i] === '--timeout') out.timeout = Number(argv[++i])
-    else if (argv[i] === '--help' || argv[i] === '-h') { console.log('usage: node scripts/journey-runtime.mjs --package <dir> [--previous <dir>] [--dsh <bin>] [--allow-exemption] [--json]'); process.exit(0) }
+    else if (argv[i] === '--help' || argv[i] === '-h') { console.log('usage: node scripts/journey-runtime.mjs --package <dir> [--previous <dir>] [--dsh <bin>] [--log-dir <dir>] [--allow-exemption] [--json]'); process.exit(0) }
     else throw new Error(`unknown option: ${argv[i]}`)
   }
   if (!out.package) throw new Error('--package is required')
   return out
 }
 
-function sh(cmd, args, env, timeout) {
-  return spawnSync(cmd, args, { encoding: 'utf8', timeout, env, maxBuffer: 8 * 1024 * 1024 })
-}
-
 /** Find the row id whose `name:` is the package name or a relative server entry. */
 function rowIdFromDump(dump, pkgName) {
   for (const block of dump.split(/\n(?=- )/)) {
@@ -60,90 +72,200 @@ function main() {
   const manifest = JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'), 'utf8'))
   const previous = options.previous ? path.resolve(options.previous) : null
   const previousManifest = previous ? JSON.parse(fs.readFileSync(path.join(previous, 'package.json'), 'utf8')) : null
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-journey-'))
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-journey-'))
+  const home = path.join(root, 'home')
+  const tmp = path.join(root, 'tmp')
+  fs.mkdirSync(home, { recursive: true })
+  fs.mkdirSync(tmp, { recursive: true })
+  const logDir = options.logDir ? path.resolve(options.logDir) : null
+  if (logDir) fs.mkdirSync(logDir, { recursive: true })
   const profile = 'flow-journey'
-  const env = { ...process.env, DSH_HOME: home }
-  delete env.DEEPSEEK_API_KEY
-  delete env.OPENAI_API_KEY
+  const env = sanitizedEnv({
+    DSH_HOME: home,
+    HOME: home,
+    USERPROFILE: home,
+    TMPDIR: tmp,
+    TEMP: tmp,
+    TMP: tmp,
+    NPM_CONFIG_USERCONFIG: path.join(home, '.npmrc'),
+  })
   const dsh = options.dsh || (process.platform === 'win32' ? 'dsh.cmd' : 'dsh')
   const checks = []
+  const blockers = []
   let dshVersion = null
-  const add = (id, result, reason, extra = {}) => checks.push({ id, result, reason, ...extra })
-  try {
-    const version = sh(dsh, ['--version'], env, 30_000)
-    dshVersion = (version.stdout || '').trim()
-    const create = sh(dsh, ['--profile', profile, '--from-default-profile', 'headless', '--dump-config'], env, options.timeout)
-    add('J1.profile', create.status === 0 ? 'PASS' : 'FAIL', `create profile exit=${create.status}`, { stderr: create.stderr.slice(0, 500) })
-    let addResult = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
-    let addText = `${addResult.stdout}${addResult.stderr}`
-    const rejected = addResult.status !== 0 && /installation rejected/.test(addText)
-    // Never grant an exact-version exemption by default: a gate rejection is a
-    // measured BLOCKED result, not something the harness may silently accept.
-    if (rejected && (options.allowExemption || process.env.DSH_JOURNEY_ALLOW_EXEMPTION === '1')) {
-      const allow = sh(dsh, ['plugin', '--profile', profile, 'allow-version', `${manifest.name}@${manifest.version}`, '--dsh-version', dshVersion, '--accept-risk'], env, options.timeout)
-      add('J1.exemption', allow.status === 0 ? 'WARN' : 'FAIL', `allow-version exit=${allow.status}`, { stderr: allow.stderr.slice(0, 500) })
-      addResult = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
-      addText = `${addResult.stdout}${addResult.stderr}`
-    }
-    add('J1.install', rejected && !options.allowExemption && process.env.DSH_JOURNEY_ALLOW_EXEMPTION !== '1' ? 'BLOCKED' : addResult.status === 0 ? 'PASS' : 'FAIL', rejected ? 'host compatibility gate rejected the install (no exemption granted)' : `add exit=${addResult.status}`, { stderr: addText.slice(0, 800) })
-    const dump1 = sh(dsh, ['--profile', profile, '--dump-config'], env, options.timeout)
-    add('J1.dump', dump1.status === 0 ? 'PASS' : 'FAIL', `dump exit=${dump1.status}`, { stderr: dump1.stderr.slice(0, 500) })
-    const appears = dump1.stdout.includes(manifest.name) || /fixture-bundle-server/.test(dump1.stdout)
-    add('J1.layer', appears ? 'PASS' : 'FAIL', appears ? 'layer/entry appears in dump' : 'plugin/bundle not visible in dump')
-
-    // J2: disable/enable through a profile overlay. A missing row id is a real
-    // failure of the probe (not a pass): report it and skip the toggle checks.
-    const rowId = rowIdFromDump(dump1.stdout, manifest.name)
-    if (!rowId) {
-      add('J2.toggle', 'not-run', 'could not locate the inserted row id in dump-config')
-    } else {
-      const overlay = path.join(home, 'j2-overlay.yml')
-      fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: true\n`)
-      const disabled = sh(dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], env, options.timeout)
-      const disabledOK = disabled.status === 0 && /disabled:\s*true/.test(disabled.stdout)
-      add('J2.disable', disabledOK ? 'PASS' : 'FAIL', disabledOK ? `row ${rowId} disabled` : `disable exit=${disabled.status}`, { stderr: disabled.stderr.slice(0, 500) })
-      fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: false\n`)
-      const enabled = sh(dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], env, options.timeout)
-      const enabledOK = enabled.status === 0 && !new RegExp(`id:\\s*${rowId}[\\s\\S]{0,80}disabled:\\s*true`).test(enabled.stdout)
-      add('J2.enable', enabledOK ? 'PASS' : 'FAIL', enabledOK ? `row ${rowId} enabled again` : `enable exit=${enabled.status}`, { stderr: enabled.stderr.slice(0, 500) })
+
+  const writeLog = (name, text) => {
+    if (!logDir) return null
+    const file = path.join(logDir, name)
+    fs.writeFileSync(file, text ?? '')
+    return { path: name.split(path.sep).join('/'), sha256: sha256Value(text ?? '') }
+  }
+
+  /** Run one command and record argv/exit/times/logs (never process.env). */
+  const exec = (label, cmd, args, timeout) => {
+    const startedAt = new Date().toISOString()
+    const t0 = Date.now()
+    const result = spawnSync(cmd, args, {
+      encoding: 'utf8', timeout, env, maxBuffer: 8 * 1024 * 1024, killSignal: 'SIGKILL',
+    })
+    const endedAt = new Date().toISOString()
+    const stdoutText = result.stdout ?? ''
+    const stderrText = result.stderr ?? ''
+    const timedOut = result.error?.code === 'ETIMEDOUT'
+    return {
+      command: [cmd, ...args],
+      exitCode: Number.isInteger(result.status) ? result.status : timedOut ? 124 : 127,
+      startedAt,
+      endedAt,
+      durationMs: Date.now() - t0,
+      stdoutText,
+      stderrText,
+      stdout: writeLog(`${label}.out.log`, stdoutText),
+      stderrLog: writeLog(`${label}.err.log`, stderrText),
+      timedOut,
+      error: result.error ? result.error.message : null,
     }
+  }
 
-    const remove = sh(dsh, ['plugin', '--profile', profile, 'remove', manifest.name], env, options.timeout)
-    add('J1.remove', remove.status === 0 ? 'PASS' : 'FAIL', `remove exit=${remove.status}`, { stderr: (remove.stderr || remove.stdout).slice(0, 800) })
-    const dump2 = sh(dsh, ['--profile', profile, '--dump-config'], env, options.timeout)
-    const gone = !dump2.stdout.includes(manifest.name)
-    add('J1.clean', remove.status === 0 && gone ? 'PASS' : 'FAIL', gone ? 'layer/dependency gone after remove' : 'still present after remove')
+  const add = (id, result, reason, record = null, assertions = []) => {
+    checks.push({
+      id,
+      result,
+      reason,
+      command: record ? record.command : null,
+      exitCode: record ? record.exitCode : null,
+      startedAt: record ? record.startedAt : null,
+      endedAt: record ? record.endedAt : null,
+      durationMs: record ? record.durationMs : null,
+      stdout: record ? record.stdout : null,
+      stderrLog: record ? record.stderrLog : null,
+      stderr: record ? String(record.stderrText).slice(0, 800) : null,
+      assertions,
+    })
+  }
+  const claim = (text, observed) => ({ claim: text, observed })
 
-    // J4: with no API key, the tree must load far enough to reach the model
-    // boundary. This is a tree-load proof, not a successful first task.
-    if (process.env.DEEPSEEK_API_KEY || process.env.OPENAI_API_KEY) {
-      add('J4.tree-load', 'not-run', 'an API key is present in the launching environment')
+  try {
+    const version = exec('J1.version', dsh, ['--version'], 30_000)
+    dshVersion = (version.stdoutText || '').trim() || null
+    if (version.exitCode !== 0) {
+      blockers.push({ journey: 'J1', check: 'J1.version', reason: `dsh executable not usable: ${dsh} (exit ${version.exitCode})` })
+      add('J1.version', 'BLOCKED', `dsh --version failed (exit ${version.exitCode})`, version, [claim('dsh --version succeeded', false)])
+      add('J2.toggle', 'not-run', 'skipped: no usable dsh executable')
+      add('J4.tree-load', 'not-run', 'skipped: no usable dsh executable')
+      add('J6.upgrade', 'not-run', 'skipped: no usable dsh executable')
+      add('J6.rollback', 'not-run', 'skipped: no usable dsh executable')
     } else {
-      const boot = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
-      if (boot.status !== 0) add('J4.tree-load', 'FAIL', `reinstall exit=${boot.status}`, { stderr: boot.stderr.slice(0, 500) })
-      else {
-        const run = sh(dsh, ['--profile', profile, 'Reply with one short sentence.'], env, 60_000)
-        const text = `${run.stdout}${run.stderr}`
-        const reached = run.status !== 0 && /MISSING_CREDENTIAL|no API key|AUTH|credential/i.test(text)
-        add('J4.tree-load', reached ? 'PASS' : 'FAIL', reached ? 'keyless boot reached the credential boundary' : `boot exit=${run.status}; no credential-boundary message`, { stderr: text.slice(0, 500) })
+      const create = exec('J1.profile', dsh, ['--profile', profile, '--from-default-profile', 'headless', '--dump-config'], options.timeout)
+      add('J1.profile', create.exitCode === 0 ? 'PASS' : 'FAIL', `create profile exit=${create.exitCode}`, create,
+        [claim('create profile from the shipped headless template', create.exitCode === 0)])
+
+      if (create.exitCode !== 0) {
+        blockers.push({ journey: 'J1', check: 'J1.profile', reason: `profile creation failed (exit ${create.exitCode})` })
+        add('J2.toggle', 'not-run', 'skipped: profile could not be created')
+        add('J4.tree-load', 'not-run', 'skipped: profile could not be created')
+        add('J6.upgrade', 'not-run', 'skipped: profile could not be created')
+        add('J6.rollback', 'not-run', 'skipped: profile could not be created')
+      } else {
+        runJourneys()
       }
     }
 
-    // J6: upgrade then rollback. Only meaningful when a previous package is
-    // supplied; otherwise it is honestly not-run.
-    if (!previous || !previousManifest) {
-      add('J6.upgrade', 'not-run', 'no --previous package supplied')
-      add('J6.rollback', 'not-run', 'no --previous package supplied')
-    } else {
-      const u1 = sh(dsh, ['plugin', '--profile', profile, 'add', previous], env, options.timeout)
-      const v1 = installedVersion(home, profile, manifest.name)
-      add('J6.upgrade', u1.status === 0 && v1 === previousManifest.version ? 'PASS' : 'FAIL', `upgrade ${previousManifest.version}->${manifest.version} exit=${u1.status}, installed=${v1}`, { stderr: (u1.stderr || u1.stdout).slice(0, 500) })
-      const u2 = sh(dsh, ['plugin', '--profile', profile, 'add', pkg], env, options.timeout)
-      const v2 = installedVersion(home, profile, manifest.name)
-      add('J6.upgrade-current', u2.status === 0 && v2 === manifest.version ? 'PASS' : 'FAIL', `current install exit=${u2.status}, installed=${v2}`, { stderr: (u2.stderr || u2.stdout).slice(0, 500) })
-      const u3 = sh(dsh, ['plugin', '--profile', profile, 'add', previous], env, options.timeout)
-      const v3 = installedVersion(home, profile, manifest.name)
-      add('J6.rollback', u3.status === 0 && v3 === previousManifest.version ? 'PASS' : 'FAIL', `rollback exit=${u3.status}, installed=${v3}`, { stderr: (u3.stderr || u3.stdout).slice(0, 500) })
+    function runJourneys() {
+      const addResult = exec('J1.install', dsh, ['plugin', '--profile', profile, 'add', pkg], options.timeout)
+      const addText = `${addResult.stdoutText}${addResult.stderrText}`
+      const rejected = addResult.exitCode !== 0 && /installation rejected/.test(addText)
+      const exempt = options.allowExemption || process.env.DSH_JOURNEY_ALLOW_EXEMPTION === '1'
+      // Never grant an exact-version exemption by default: a gate rejection is a
+      // measured BLOCKED result, not something the harness may silently accept.
+      if (rejected && exempt) {
+        const allow = exec('J1.exemption', dsh, ['plugin', '--profile', profile, 'allow-version', `${manifest.name}@${manifest.version}`, '--dsh-version', dshVersion, '--accept-risk'], options.timeout)
+        add('J1.exemption', allow.exitCode === 0 ? 'WARN' : 'FAIL', `allow-version exit=${allow.exitCode}`, allow,
+          [claim('exact-version exemption granted for this host only', allow.exitCode === 0)])
+        const retry = exec('J1.install-retry', dsh, ['plugin', '--profile', profile, 'add', pkg], options.timeout)
+        add('J1.install', retry.exitCode === 0 ? 'PASS' : 'FAIL', `install retry exit=${retry.exitCode}`, retry,
+          [claim('plugin add succeeds after the explicit exemption', retry.exitCode === 0)])
+      } else if (rejected) {
+        blockers.push({ journey: 'J1', check: 'J1.install', reason: 'host compatibility gate rejected the install (no exemption granted)' })
+        add('J1.install', 'BLOCKED', 'host compatibility gate rejected the install (no exemption granted)', addResult,
+          [claim('host compatibility gate admits the plugin', false)])
+        add('J2.toggle', 'not-run', 'skipped: install was rejected by the host compatibility gate')
+        add('J4.tree-load', 'not-run', 'skipped: install was rejected by the host compatibility gate')
+        add('J6.upgrade', 'not-run', 'skipped: install was rejected by the host compatibility gate')
+        add('J6.rollback', 'not-run', 'skipped: install was rejected by the host compatibility gate')
+        return
+      } else {
+        add('J1.install', addResult.exitCode === 0 ? 'PASS' : 'FAIL', `add exit=${addResult.exitCode}`, addResult,
+          [claim('plugin add exits 0', addResult.exitCode === 0)])
+      }
+
+      const dump1 = exec('J1.dump', dsh, ['--profile', profile, '--dump-config'], options.timeout)
+      const appears = dump1.stdoutText.includes(manifest.name) || /fixture-bundle-server/.test(dump1.stdoutText)
+      add('J1.dump', dump1.exitCode === 0 ? 'PASS' : 'FAIL', `dump exit=${dump1.exitCode}`, dump1,
+        [claim('dump-config exits 0', dump1.exitCode === 0), claim('plugin/bundle layer appears in dump', appears)])
+      add('J1.layer', appears ? 'PASS' : 'FAIL', appears ? 'layer/entry appears in dump' : 'plugin/bundle not visible in dump', dump1,
+        [claim('layer/entry appears in dump', appears)])
+
+      // J2: disable/enable through a profile overlay. A missing row id is a real
+      // non-result of the probe (not a pass): report it and skip the toggle checks.
+      const rowId = rowIdFromDump(dump1.stdoutText, manifest.name)
+      if (!rowId) {
+        add('J2.toggle', 'not-run', 'could not locate the inserted row id in dump-config')
+      } else {
+        const overlay = path.join(root, 'j2-overlay.yml')
+        fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: true\n`)
+        const disabled = exec('J2.disable', dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], options.timeout)
+        const disabledOK = disabled.exitCode === 0 && /disabled:\s*true/.test(disabled.stdoutText)
+        add('J2.disable', disabledOK ? 'PASS' : 'FAIL', disabledOK ? `row ${rowId} disabled` : `disable exit=${disabled.exitCode}`, disabled,
+          [claim(`row ${rowId} shows disabled: true after the overlay`, disabledOK)])
+        fs.writeFileSync(overlay, `- id: ${rowId}\n  disabled: false\n`)
+        const enabled = exec('J2.enable', dsh, ['--profile', profile, '--patch', overlay, '--dump-config'], options.timeout)
+        const enabledOK = enabled.exitCode === 0 && !new RegExp(`id:\\s*${rowId}[\\s\\S]{0,80}disabled:\\s*true`).test(enabled.stdoutText)
+        add('J2.enable', enabledOK ? 'PASS' : 'FAIL', enabledOK ? `row ${rowId} enabled again` : `enable exit=${enabled.exitCode}`, enabled,
+          [claim(`row ${rowId} is no longer disabled after the overlay`, enabledOK)])
+      }
+
+      const remove = exec('J1.remove', dsh, ['plugin', '--profile', profile, 'remove', manifest.name], options.timeout)
+      add('J1.remove', remove.exitCode === 0 ? 'PASS' : 'FAIL', `remove exit=${remove.exitCode}`, remove,
+        [claim('plugin remove exits 0', remove.exitCode === 0)])
+      const dump2 = exec('J1.clean', dsh, ['--profile', profile, '--dump-config'], options.timeout)
+      const gone = !dump2.stdoutText.includes(manifest.name)
+      add('J1.clean', remove.exitCode === 0 && gone ? 'PASS' : 'FAIL', gone ? 'layer/dependency gone after remove' : 'still present after remove', dump2,
+        [claim('plugin remove exits 0', remove.exitCode === 0), claim('layer/dependency gone after remove', gone)])
+
+      // J4: with no API key in the child environment, the tree must load far
+      // enough to reach the model boundary. This is a tree-load proof, not a
+      // successful first task. The allowlisted env never carries a provider key.
+      const boot = exec('J4.reinstall', dsh, ['plugin', '--profile', profile, 'add', pkg], options.timeout)
+      if (boot.exitCode !== 0) {
+        add('J4.tree-load', 'FAIL', `reinstall exit=${boot.exitCode}`, boot, [claim('clean reinstall exits 0', false)])
+      } else {
+        const run = exec('J4.tree-load', dsh, ['--profile', profile, 'Reply with one short sentence.'], 60_000)
+        const text = `${run.stdoutText}${run.stderrText}`
+        const reached = run.exitCode !== 0 && /MISSING_CREDENTIAL|no API key|AUTH|credential/i.test(text)
+        add('J4.tree-load', reached ? 'PASS' : 'FAIL', reached ? 'keyless boot reached the credential boundary' : `boot exit=${run.exitCode}; no credential-boundary message`, run,
+          [claim('keyless boot reaches the credential boundary', reached)])
+      }
+
+      // J6: upgrade then rollback. Only meaningful when a previous package is
+      // supplied; otherwise it is honestly not-run.
+      if (!previous || !previousManifest) {
+        add('J6.upgrade', 'not-run', 'no --previous package supplied')
+        add('J6.rollback', 'not-run', 'no --previous package supplied')
+      } else {
+        const u1 = exec('J6.upgrade', dsh, ['plugin', '--profile', profile, 'add', previous], options.timeout)
+        const v1 = installedVersion(home, profile, manifest.name)
+        add('J6.upgrade', u1.exitCode === 0 && v1 === previousManifest.version ? 'PASS' : 'FAIL', `upgrade ${previousManifest.version}->${manifest.version} exit=${u1.exitCode}, installed=${v1}`, u1,
+          [claim(`installed version equals previous ${previousManifest.version}`, u1.exitCode === 0 && v1 === previousManifest.version)])
+        const u2 = exec('J6.upgrade-current', dsh, ['plugin', '--profile', profile, 'add', pkg], options.timeout)
+        const v2 = installedVersion(home, profile, manifest.name)
+        add('J6.upgrade-current', u2.exitCode === 0 && v2 === manifest.version ? 'PASS' : 'FAIL', `current install exit=${u2.exitCode}, installed=${v2}`, u2,
+          [claim(`installed version equals current ${manifest.version}`, u2.exitCode === 0 && v2 === manifest.version)])
+        const u3 = exec('J6.rollback', dsh, ['plugin', '--profile', profile, 'add', previous], options.timeout)
+        const v3 = installedVersion(home, profile, manifest.name)
+        add('J6.rollback', u3.exitCode === 0 && v3 === previousManifest.version ? 'PASS' : 'FAIL', `rollback exit=${u3.exitCode}, installed=${v3}`, u3,
+          [claim(`rollback installs ${previousManifest.version} again`, u3.exitCode === 0 && v3 === previousManifest.version)])
+      }
     }
 
     for (const [id, reason] of [
@@ -153,16 +275,19 @@ function main() {
       ['J8.client', 'client-shape probe not implemented'],
     ]) add(id, 'not-run', reason)
   } finally {
-    try { fs.rmSync(home, { recursive: true, force: true }) } catch { /* ignore */ }
+    try { fs.rmSync(root, { recursive: true, force: true }) } catch { /* ignore */ }
   }
   const result = {
     schema: 'dsh-flow-runtime/1',
-    environment: { dsh: dshVersion, node: process.version, platform: process.platform },
+    environment: { dsh: dshVersion, node: process.version, platform: `${process.platform}-${process.arch}` },
     package: manifest.name,
     version: manifest.version,
     previous: previousManifest ? previousManifest.version : null,
     mode: 'j1-j2-j4-j6-runtime',
+    evidenceMode: logDir !== null,
+    environmentPolicy: envPolicy(),
     checks,
+    blockers,
     summary: {
       pass: checks.filter(c => c.result === 'PASS').length,
       warn: checks.filter(c => c.result === 'WARN').length,
@@ -170,7 +295,7 @@ function main() {
       blocked: checks.filter(c => c.result === 'BLOCKED').length,
       notRun: checks.filter(c => c.result === 'not-run').length,
     },
-    conclusion: checks.some(c => c.result === 'FAIL') ? 'flow-fail' : checks.some(c => c.result === 'BLOCKED') ? 'flow-blocked' : 'flow-warn',
+    conclusion: checks.some(c => c.result === 'FAIL') ? 'flow-fail' : checks.some(c => c.result === 'BLOCKED') || blockers.length > 0 ? 'flow-blocked' : 'flow-warn',
   }
   if (options.json || !process.stdout.isTTY) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
   process.exitCode = result.conclusion === 'flow-fail' ? 1 : 0

package/40-checker/scripts/level-audit.mjs

@@ -5,8 +5,9 @@
  * What it does:
  *   ENTRY  runs the existing ENTRY checker (static by default; real G0-G3 boot
  *          when --host is supplied) and maps its conclusion to an evidence state.
- *   FLOW   reads an optional J1-J8 evidence file; with no file it reports the
- *          checklist as `not-run` and never invents a pass.
+ *   FLOW   reads an optional `dsh-flow-evidence/2` file; with no file it reports
+ *          the checklist as `not-run` and never invents a pass. v1 schemas and
+ *          bare {Jx:{status}} rows are `deprecated` and never count as a pass.
  *   BOOST  reads an optional LEV evidence file; with no file it reports
  *          `not-measured`. It does not run benchmarks for you.
  *
@@ -26,6 +27,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { FLOW_IDS, FLOW_EVIDENCE_SCHEMA, validateFlowEvidence } from '../src/flow-evidence.mjs'
 
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const STD = path.resolve(HERE, '..', '..')
@@ -43,7 +45,9 @@ Options:
   --base <file>            dsh-base cordis.patch.yml
   --bare <dir>             bare-module farm for the bundle smoke
   --no-runtime             force static ENTRY even when --host is given
-  --flow-evidence <file>   JSON: { "J1": { "status": "pass|fail|not-run", "evidence": "..." }, ... }
+  --flow-evidence <file>   dsh-flow-evidence/2 JSON from dsh-flow-collect.mjs (J1-J8 checks
+                            with command/exitCode/times/stdout sha256/assertions). v1 and bare
+                            {Jx:{status}} files are reported deprecated and never count as pass.
   --boost-evidence <file>  JSON: { "LEV-3": { "status": "measured|not-measured|failed", "evidenceCard": { ... } }, ... }
                             measured requires a valid evidence card; a status-only row is downgraded to not-measured
   --timeout <ms>           checker timeout, default 150000
@@ -151,32 +155,96 @@ function classifyEntry(report, invoked) {
 }
 
 function classifyFlow(evidence) {
-  const ids = ['J1', 'J2', 'J3', 'J4', 'J5', 'J6', 'J7', 'J8']
+  const ids = FLOW_IDS
+  const emptyJourneys = () => Object.fromEntries(ids.map(id => [id, { status: 'not-run', declared: null, checks: 0, passes: false }]))
   if (!evidence) {
     return {
       state: 'not-run',
-      reason: 'no --flow-evidence file; run the J1-J8 journeys and record pass/fail/not-run',
-      journeys: Object.fromEntries(ids.map(id => [id, { status: 'not-run' }])),
+      schema: null,
+      deprecated: false,
+      invalid: false,
+      evidenceHash: null,
+      passed: 0,
+      errors: [],
+      reason: 'no --flow-evidence file; run dsh-flow-collect.mjs and re-run the audit',
+      journeys: emptyJourneys(),
+    }
+  }
+  const verdict = validateFlowEvidence(evidence)
+  const declaredOf = id => {
+    const row = evidence[id] ?? evidence[id.toLowerCase()]
+    return row?.status ?? null
+  }
+  const base = {
+    schema: verdict.schema,
+    deprecated: verdict.kind === 'v1-deprecated' || verdict.kind === 'legacy',
+    invalid: false,
+    evidenceHash: null,
+    passed: 0,
+    errors: verdict.errors,
+  }
+  if (verdict.kind === 'v1-deprecated' || verdict.kind === 'legacy') {
+    return {
+      ...base,
+      state: 'deprecated',
+      reason: `${verdict.errors[0]}. Run node 40-checker/bin/dsh-flow-collect.mjs --package <dir> to produce ${FLOW_EVIDENCE_SCHEMA}`,
+      journeys: Object.fromEntries(ids.map(id => [id, { status: 'deprecated', declared: declaredOf(id), checks: 0, passes: false }])),
+    }
+  }
+  if (!verdict.valid) {
+    return {
+      ...base,
+      state: 'invalid',
+      invalid: true,
+      reason: `${FLOW_EVIDENCE_SCHEMA} failed structural validation: ${verdict.errors.slice(0, 5).join('; ')}${verdict.errors.length > 5 ? ` (+${verdict.errors.length - 5} more)` : ''}`,
+      evidenceHash: {
+        declared: verdict.declaredHash,
+        computed: verdict.computedHash,
+        ok: verdict.declaredHash !== null && verdict.declaredHash === verdict.computedHash,
+      },
+      journeys: Object.fromEntries(ids.map(id => {
+        const row = verdict.journeys[id] ?? { declared: null, derived: 'not-run', checks: 0, passes: false }
+        return [id, { status: row.declared ?? row.derived, declared: row.declared, checks: row.checks, passes: false }]
+      })),
     }
   }
   const journeys = {}
   for (const id of ids) {
-    const row = evidence[id] ?? evidence[id.toLowerCase()]
-    const status = row?.status
+    const row = verdict.journeys[id]
     journeys[id] = {
-      status: ['pass', 'fail', 'not-run', 'manual'].includes(status) ? status : 'not-run',
-      evidence: row?.evidence ?? null,
+      status: row.derived,
+      declared: row.declared,
+      checks: row.checks,
+      passes: row.passes,
+      reason: evidence.journeys?.[id]?.reason ?? null,
     }
   }
-  const failed = ids.filter(id => journeys[id].status === 'fail')
-  const passed = ids.filter(id => journeys[id].status === 'pass')
+  const passed = ids.filter(id => journeys[id].passes)
+  const failed = ids.filter(id => journeys[id].status === 'fail' && journeys[id].declared !== 'blocked')
+  const blocked = ids.filter(id => journeys[id].declared === 'blocked')
+  const state = failed.length > 0
+    ? 'failed'
+    : passed.length === ids.length
+      ? 'runtime'
+      : blocked.length > 0 ? 'blocked' : 'not-run'
+  const reasons = []
+  if (failed.length > 0) reasons.push(`failed journeys: ${failed.join(', ')}`)
+  if (blocked.length > 0) reasons.push(`blocked journeys (never a pass): ${blocked.join(', ')}`)
+  if (failed.length === 0 && passed.length !== ids.length) {
+    const rest = ids.filter(id => !passed.includes(id) && !blocked.includes(id))
+    if (rest.length > 0) reasons.push(`${passed.length}/8 journeys pass; ${rest.length} static/warn/not-run`)
+  }
+  if (passed.length === ids.length) reasons.push('all J1-J8 journey checks pass (exitCode 0, assertions held)')
   return {
-    state: failed.length > 0 ? 'failed' : passed.length === ids.length ? 'runtime' : 'not-run',
-    reason: failed.length > 0
-      ? `failed journeys: ${failed.join(', ')}`
-      : passed.length === ids.length
-        ? 'all J1-J8 have pass evidence'
-        : `${passed.length}/8 journeys have pass evidence`,
+    ...base,
+    state,
+    reason: reasons.join('; '),
+    passed: passed.length,
+    evidenceHash: {
+      declared: verdict.declaredHash,
+      computed: verdict.computedHash,
+      ok: verdict.declaredHash === verdict.computedHash,
+    },
     journeys,
   }
 }
@@ -270,7 +338,11 @@ function nextActions(entry, flow, boost) {
   if (entry.g4 && entry.g4.hasClient && entry.g4.ok === false) actions.push(`ENTRY: fix G4 — ${entry.g4.reason}`)
   for (const warning of entry.warnings) actions.push(`ENTRY: consider ${warning.id} — ${warning.reason}`)
   if (entry.state === 'recognized') actions.push('ENTRY: run with --host to replace static recognition with a real G0-G3 boot')
-  if (flow.state === 'not-run') actions.push('FLOW: record J1-J8 in a flow-evidence JSON; do not claim FLOW until they run')
+  if (flow.state === 'not-run') actions.push('FLOW: record J1-J8 with node 40-checker/bin/dsh-flow-collect.mjs; do not claim FLOW until they run')
+  if (flow.state === 'deprecated') actions.push('FLOW: v1/bare evidence is deprecated; collect a dsh-flow-evidence/2 file (spec/flow-evidence.schema.json)')
+  if (flow.state === 'invalid') actions.push('FLOW: flow evidence failed structural validation; fix the listed fields or recollect')
+  if (flow.state === 'failed') actions.push(`FLOW: fix failed journeys: ${Object.entries(flow.journeys).filter(([, row]) => row.status === 'fail').map(([id]) => id).join(', ')}`)
+  if (flow.state === 'blocked') actions.push('FLOW: blocked journeys need a prerequisite (usable dsh, --previous, or a compatible host); blocked is not a pass')
   if (boost.state === 'not-measured') actions.push('BOOST: attach LEV evidence cards (subject/host/method/scope/command/result/negativeControl/generatedAt/expiresAt/recordHash/claimLevel/issuer/selfAssessed); a status alone is not measured')
   if (boost.state === 'stale') actions.push('BOOST: refresh stale evidence cards before claiming measured')
   return actions

package/40-checker/scripts/m2-runner.mjs

@@ -18,6 +18,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { spawn, spawnSync } from 'node:child_process'
+import { sanitizedEnv } from '../src/sandbox-env.mjs'
 
 function parse(argv) {
   const options = {
@@ -129,15 +130,15 @@ async function main() {
   const reportPath = path.join(work, 'report.json')
   const cli = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', 'bin', 'dsh-plugin-verify.mjs')
   const args = [cli, pkg, '--format', 'json', '--treat-as-plugin', '--runtime', path.resolve(options.runtime), '--runtime-version', options.runtimeVersion, '--cordis-version', options.cordisVersion, '--out', reportPath]
-  const env = {
-    ...process.env,
+  // The child imports the inspected package: never forward the caller's env.
+  const env = sanitizedEnv({
     DSH_HOME: home,
     HOME: home,
     USERPROFILE: home,
     TMPDIR: path.join(root, 'tmp'),
     TEMP: path.join(root, 'tmp'),
     TMP: path.join(root, 'tmp'),
-  }
+  })
   fs.mkdirSync(env.TMPDIR, { recursive: true })
   const started = Date.now()
   const needsLandlock = options.backend === 'landlock' || options.backend === 'unshare-landlock'

package/40-checker/scripts/runtime-child.mjs

@@ -3,6 +3,10 @@
 // the checker. Input: JSON on stdin. Output: JSON { checks } on stdout.
 import { runRuntimeChecks } from '../src/runtime.mjs'
 import { readSources } from '../src/util.mjs'
+import { scrubProcessEnv } from '../src/sandbox-env.mjs'
+
+// This process imports the inspected package; keep only allowlisted env keys.
+scrubProcessEnv()
 
 const chunks = []
 for await (const chunk of process.stdin) chunks.push(chunk)