dsh-standards 1.1.2 → 1.2.1

package/40-checker/src/report.mjs

@@ -1,4 +1,6 @@
 import path from 'node:path'
+import remediationSpec from '../../spec/remediation.json' with { type: 'json' }
+import { DOCS_BASE, joinAdvice } from './remediation.mjs'
 
 export const PACKAGE_MANDATORY = [
   'DSC-01', 'DSC-02', 'DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09', 'DSC-11', 'DSC-12', 'DSC-13',
@@ -37,7 +39,7 @@ function allowedNa(check, scope, profile, kind) {
   return false
 }
 
-export function buildReport({ subject, anchor, checks, g4 = null, scope, profile, kind, staticOnly = false, entryRuntime = 'require', entryClaim = 'runtime' }) {
+export function buildReport({ subject, anchor, checks, g4 = null, scope, profile, kind, staticOnly = false, entryRuntime = 'require', entryClaim = 'runtime', advice = true }) {
   const mandatory = mandatoryFor(scope, profile, staticOnly, entryClaim)
   const adjustedChecks = scope === 'entry' ? checks.map(item => adjustEntryCheck(item, entryClaim)) : checks
   const runtimeIds = new Set(['DSC-04', 'DSC-05', 'DSC-06', 'DSC-07', 'DSC-08', 'DSC-09'])
@@ -85,7 +87,7 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
   if (warnings.length > 0) reasonParts.push(`WARN: ${warnings.map(item => item.id).join(', ')}`)
   if (advisoryWarnings.length > 0) reasonParts.push(`advisory: ${advisoryWarnings.map(item => item.id).join(', ')}`)
 
-  return {
+  const report = {
     schema: 'dsh-conformance/1',
     standard: { id: 'DS-C', version: '1.0.0' },
     subject,
@@ -120,6 +122,12 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
       reason: reasonParts.join('; '),
     },
   }
+  // Additive only: `advice` is a sibling of `checks`, never part of a check,
+  // and the verdict is computed above without reading it.
+  if (advice !== false) {
+    report.advice = joinAdvice(report, remediationSpec, DOCS_BASE)
+  }
+  return report
 }
 
 const ICON = { PASS: 'PASS', WARN: 'WARN', FAIL: 'FAIL', NA: 'NA  ', ERROR: 'ERR ' }
@@ -145,6 +153,15 @@ export function formatText(report) {
   lines.push(`coverage: mandatory=${coverage.mandatory} pass=${coverage.pass} warn=${coverage.warn} fail=${coverage.fail} na=${coverage.na} notRun=${coverage.notRun}`)
   if (conclusion.reason) lines.push(`reason: ${conclusion.reason}`)
   if (conclusion.status === 'incomplete') lines.push('NOT A DS-C PASS: at least one mandatory check did not run (see notRun).')
+  if (Array.isArray(report.advice) && report.advice.length > 0) {
+    lines.push('')
+    lines.push('advice (non-blocking):')
+    for (const item of report.advice) {
+      const missing = item.ruleMissing ? ' [ruleMissing]' : ''
+      lines.push(`  ${String(item.severity).padEnd(4)} ${String(item.key).padEnd(7)} ${item.source}${missing}: ${String(item.fix ?? item.title ?? '').replace(/\s+/g, ' ').slice(0, 160)}`)
+      if (item.docsUrl) lines.push(`          ${item.docsUrl}`)
+    }
+  }
   lines.push('')
   return `${lines.join('\n')}\n`
 }

package/40-checker/src/sandbox-env.mjs

@@ -0,0 +1,78 @@
+/**
+ * Environment policy for child processes that may load third-party plugin code.
+ *
+ * A plugin boots on first import: anything it can read from `process.env` is
+ * already exfiltratable before a single check runs. `...process.env` therefore
+ * must never be forwarded to `dsh plugin add`, a host boot, or a runtime child.
+ * The policy is an allowlist (not a denylist) so a newly named credential does
+ * not silently leak; the secret-shaped name filter stays as a second gate in
+ * case an allowlisted name is ambiguous.
+ *
+ * Callers that need isolation (temporary HOME, DSH_HOME, TMPDIR) pass those as
+ * explicit overrides. Overrides are the caller's own values, never inherited.
+ */
+
+const ALLOWED = new Set([
+  // Portable process essentials.
+  'PATH', 'HOME', 'USERPROFILE', 'TMPDIR', 'TEMP', 'TMP', 'PWD', 'SHELL',
+  'USER', 'LOGNAME', 'LANG', 'LANGUAGE', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES',
+  'TZ', 'TERM', 'NO_COLOR', 'FORCE_COLOR', 'COLORTERM',
+  // Windows needs these to locate node/npm/tmp; they carry no credentials.
+  'SYSTEMROOT', 'SYSTEMDRIVE', 'WINDIR', 'COMSPEC', 'PATHEXT', 'OS',
+  'NUMBER_OF_PROCESSORS', 'PROCESSOR_ARCHITECTURE', 'PROCESSOR_ARCHITEW6432',
+  'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'PROGRAMFILES',
+  'PROGRAMFILES(X86)', 'COMMONPROGRAMFILES', 'HOMEDRIVE', 'HOMEPATH',
+])
+
+const SECRET_NAME = /(TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|PRIVATE_?KEY|CREDENTIAL|AUTH|COOKIE|SESSION|_KEY$)/i
+
+export function isSecretEnvName(name) {
+  return SECRET_NAME.test(String(name ?? ''))
+}
+
+export function isAllowedEnvName(name) {
+  return ALLOWED.has(String(name)) && !isSecretEnvName(name)
+}
+
+/**
+ * Build the child environment: inherited allowlisted keys + caller overrides.
+ * Overrides are trusted call values (paths the caller just created), not
+ * inherited state, so they are not filtered.
+ */
+export function sanitizedEnv(overrides = {}) {
+  const env = {}
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value === undefined || !isAllowedEnvName(key)) continue
+    env[key] = value
+  }
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === undefined || value === null) continue
+    env[key] = String(value)
+  }
+  return env
+}
+
+/**
+ * In-process variant for scripts that boot a plugin in this very process
+ * (bundle smoke, runtime child). It deletes everything not allowlisted, so a
+ * direct `node script.mjs` invocation gets the same policy as a spawned one.
+ * Returns the removed key names (never values) for logging.
+ */
+export function scrubProcessEnv() {
+  const removed = []
+  for (const key of Object.keys(process.env)) {
+    if (isAllowedEnvName(key)) continue
+    removed.push(key)
+    delete process.env[key]
+  }
+  return removed
+}
+
+export function envPolicy() {
+  return {
+    mode: 'allowlist',
+    allow: [...ALLOWED].sort(),
+    denyNamePattern: SECRET_NAME.source,
+    note: 'tokens/keys/secrets/credentials are dropped even if a future allowlist entry matches',
+  }
+}

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 1.2.1 — 2026-11-06
+
+- **V2 核验修复**：`level-audit` 不再把结构自洽的 self-attested/ci-attested `dsh-flow-evidence/2` 判成 FLOW `runtime`。只有 `claims.claimLevel=sandbox-attested` 或 `producer.kind=sandbox` 才允许 `runtime`；self/ci 的 `passed` 计数保留但 state 记 `not-run`，reason 为 `<claimLevel> evidence; runtime requires sandbox-attested`。`spec/flow-evidence.schema.json` 的 `claims`/`producer.kind` 补充了该判定说明。`advice[]` 新增 `gate`（该 check 的最终结果 PASS/WARN/FAIL），`severity` 跟随 `gate`：ENTRY static claim 把 DSC-02 降为 WARN 时，C-2.1 的 FAIL detail 仍保留在 `reason`，但 advice severity 为 WARN。测试 150 → 152。
+- **FLOW 证据链**：新增 `spec/flow-evidence.schema.json`（`dsh-flow-evidence/2`）与 `40-checker/src/flow-evidence.mjs`。`level-audit --flow-evidence` 只接受 v2；v1（`dsh-flow-journey/1`、`dsh-flow-runtime/1`）与裸 `{Jx:{status}}` 标 `deprecated`，不计 pass。每个 J 须有 `checks[]` 且全部 `exitCode === 0`、断言成立、至少一条非 `static` 观测检查才计 pass（`warn`/`blocked`/`na`/`static` 不计 8/8）。v2 的 `chain.evidenceHash` 由 audit 重算，改动一个字节即 `invalid`。
+- **collector**：新增 `40-checker/bin/dsh-flow-collect.mjs`（根入口 `bin/dsh-flow-collect.mjs`，并支持 `dsh-levels flow collect`）。只读副本 + 前后 `treeSha256` 一致、`npm pack --ignore-scripts` 的 integrity/tarballSha256、`git rev-parse` commit、临时 HOME/DSH_HOME、失败五要素提示（子检查/命令/exitCode/stderr 末 20 行/日志绝对路径 + 条款锚）；前置缺失记 `blocked` 且 exit 0，真失败 exit 1。
+- **安全**：新增 `40-checker/src/sandbox-env.mjs` 白名单 env。`src/cli.mjs` 的 runtime-child/bundle-smoke 子进程、`bundle-smoke.mjs`/`runtime-child.mjs` 进程内 boot、`m2-runner.mjs`、`journey-runtime.mjs`、`journey-config-observe.mjs`、`flow-sample-ci.mjs`、`host-farm.mjs`、`entry18-web.mjs` 不再把 `process.env` 透传给被检插件/宿主 boot。
+- 测试 137 → 149（新增 `40-checker/test/flow-evidence.test.mjs`：v1 不再 pass、v2 伪造 checks/exitCode 不 pass、篡改链路 invalid、blocked 不判 fail、collector 产物可被 audit 读取、失败五要素提示、env 白名单）。
+- 发布包不再包含 `40-checker/test`：该目录依赖仓库内 fixtures，装到用户环境后无法自测，`npm test` 会在 tarball 内失败。`npm test` 152/152。
+
+## 1.2.0 — 2026-11-06
+
+- 新增**建议管道**：`spec/remediation.json` 提供 68 条规则（`details[].item` ∪ `checks[].clause` ∪ G0–G4），`40-checker/src/remediation.mjs` 的纯函数 `joinAdvice(report, rules, docsBase)` 把 FAIL/WARN detail 连接成 `advice[]`；无 detail 的运行时 FAIL 用 `check.clause` 兜底（C-4/C-14）。
+- `buildReport()` 输出新增**加性** `advice[]`（key/severity/title/why/fix/docsUrl/source/version/evidence），不改任何 check 构造、不改判定与 exit code；CLI 新增 `--advice`（默认开）与 `--no-advice`。
+- 建议文档统一指向 `dsh-plugin-guide` 的 v0.4.3：`docsUrl = https://github.com/PerryLink/dsh-plugin-guide/blob/v0.4.3/ + docs`；规则表 `docs` 只存 `文件#锚点`。
+- 新增 `40-checker/test/remediation.test.mjs`：规则表覆盖全集、fixture 无 `ruleMissing`、本地 guide 锚点存在、severity/merge/兜底/纯函数回归。测试 128 → 137。
+
 ## 1.1.2 — 2026-11-04
 
 - 修复 1.1.1 的发布失败：vendored `@babel/parser` 的 `node_modules/` 被根 `.gitignore` 忽略，CI checkout 缺依赖导致 `npm test` 失败。现在 force-add 四个 vendored 包（约 2 MB），并加 1.1.2 的回归说明。
@@ -65,6 +81,12 @@
 
 # Changelog
 
+## 2026-11-04 — 0.2.2-alpha.3 baseline in the three-level docs
+
+- Add the 0.2.2-alpha.3 baseline table and six PR-review evidence gates to `35`.
+- Carry the baseline into `31` (ENTRY), `32` (FLOW R6) and the `33` BOOST card.
+- Fix the ENTRY checklist: Node `>=24.9.0`, `engines.dsh` precedence from 0.2.1-alpha.4, frozen lockfile / release-age evidence.
+
 ## 2026-11-03 — Node 24.9 baseline
 - Require Node >=24.9.0 to match DeepSeek Harness 0.2.2-alpha.3.
 

package/bin/dsh-flow-collect.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Public umbrella entry point for the FLOW evidence collector.
+// The implementation lives in 40-checker/.
+import '../40-checker/bin/dsh-flow-collect.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",
@@ -20,7 +20,6 @@
     "40-checker/scripts",
     "40-checker/samples",
     "40-checker/fixtures",
-    "40-checker/test",
     "40-checker/package.json",
     "40-checker/README.md",
     "spec",

package/spec/README.md

@@ -14,7 +14,9 @@ Machine-readable:
 - [levels.json](levels.json) — levels, gates, evidence states, crosswalk.
 - [clauses.json](clauses.json) — stable clause IDs mapped to gates (`clause-map.mjs`).
 - [reference-suite.json](reference-suite.json) — versioned samples, anchors, change rules.
+- [remediation.json](remediation.json) — 68-key advice table for the additive `advice[]` report field (docs anchors + severity hints).
 - [schemas/evidence.schema.json](schemas/evidence.schema.json) — `dsh-levels/1` record.
+- [flow-evidence.schema.json](flow-evidence.schema.json) — `dsh-flow-evidence/2` FLOW chain (J1–J8 checks, subject/host binding, `evidenceHash`). v1 and bare `{Jx:{status}}` rows are deprecated and never count as a pass.
 - [schemas/attestation.schema.json](schemas/attestation.schema.json) — `dsh-attestation/1` quality record.
 - [schemas/report.schema.json](schemas/report.schema.json) — `dsh-report/1` inspection report (no grade).
 - [../40-checker/scripts/level-audit.mjs](../40-checker/scripts/level-audit.mjs) — one-command audit.

package/spec/flow/README.md

@@ -4,5 +4,30 @@ Usability surface: install, configure, first success, permissions, upgrade,
 uninstall, diagnostics, client/server states.
 
 - Normative text: [../../32-DSH-FLOW顺畅规范.md](../../32-DSH-FLOW顺畅规范.md)
-- Journeys: J1–J8; only J1 has a runtime harness (`40-checker/scripts/journey-runtime.mjs`).
-- Current: J1 6 PASS + 1 WARN; J2–J8 not-run.
+- Journeys: J1–J8 (R1–R8 in the normative text).
+- Runtime probe: `40-checker/scripts/journey-runtime.mjs` (J1/J2/J4/J6); J3/J5/J7/J8
+  are static preflight or manual and never count as a runtime pass.
+- Evidence: `dsh-flow-evidence/2` ([../flow-evidence.schema.json](../flow-evidence.schema.json)).
+  Collect it with `node 40-checker/bin/dsh-flow-collect.mjs --package <dir> --out flow-evidence.json`.
+
+## Evidence chain rules
+
+- `level-audit.mjs --flow-evidence` accepts only `dsh-flow-evidence/2`. v1
+  (`dsh-flow-journey/1`, `dsh-flow-runtime/1`) and bare `{ "J1": { "status": "pass" } }`
+  rows are reported `deprecated` and never count as a pass.
+- A journey counts as pass only when it has at least one `checks[]` element,
+  every check has `exitCode === 0`, every assertion holds, and at least one
+  check is an observed (non-`static`) command. `warn`, `blocked`, `na`,
+  `static` and `not-run` never count toward 8/8.
+- `static` preflight is not runtime: a static PASS is a preflight result only.
+- The collector copies the package to a temp dir, runs against the copy, and
+  records `subject.treeSha256` before/after; a changed tree fails the run.
+- Child environments are built from an allowlist; tokens/keys/secrets never
+  reach the inspected plugin.
+- `claims.claimLevel` is `self-attested` for a local collector run,
+  `ci-attested` with `--ci`. Neither is `verified`, a certification, or a
+  security audit; only a sandbox run may be described as runtime-attested.
+- `level-audit.mjs` reports FLOW `runtime` only when `claims.claimLevel` is
+  `sandbox-attested` or `producer.kind` is `sandbox`. A `self-attested`/
+  `ci-attested` document keeps its `passed` count but is reported `not-run`;
+  structural validation cannot prove where the commands ran.

package/spec/flow-evidence.schema.json

@@ -0,0 +1,221 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/PerryLink/dsh-standards/spec/flow-evidence.schema.json",
+  "title": "DSH FLOW evidence chain",
+  "description": "One collected FLOW result (J1-J8) bound to a package, a host, a timestamp, and a chain hash. Structural validation only: it does not prove the commands really ran. v1 (dsh-flow-journey/1, dsh-flow-runtime/1) and bare {Jx:{status}} documents are deprecated and never count as a pass. `level-audit.mjs --flow-evidence` accepts this document only, and reports `runtime` only when `claims.claimLevel` is `sandbox-attested` or `producer.kind` is `sandbox`; self-attested/ci-attested keeps its pass count but stays not-run.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "generatedAt",
+    "producer",
+    "subject",
+    "host",
+    "journeys",
+    "claims",
+    "chain"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dsh-flow-evidence/2"
+    },
+    "evidenceId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "producer": {
+      "type": "object",
+      "description": "Who collected the evidence. `kind: sandbox` is the producer-side equivalent of `claims.claimLevel: sandbox-attested` and is one of the two ways a document may be reported as FLOW runtime.",
+      "additionalProperties": false,
+      "required": ["command", "at"],
+      "properties": {
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" }
+        },
+        "at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "kind": {
+          "enum": ["local", "ci", "sandbox"],
+          "description": "`local`/`ci` are structural evidence only; `sandbox` may count toward FLOW runtime."
+        },
+        "runner": { "type": "string" },
+        "actor": { "type": "string" },
+        "runUrl": { "type": "string" }
+      }
+    },
+    "subject": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version", "integrity", "tarballSha256", "commit", "treeSha256"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "version": { "type": "string", "minLength": 1 },
+        "integrity": {
+          "oneOf": [
+            { "type": "string", "pattern": "^(sha512|sha256)-[A-Za-z0-9+/=]+$" },
+            { "type": "null" }
+          ]
+        },
+        "tarballSha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+        "commit": {
+          "oneOf": [
+            { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+            { "type": "null" }
+          ]
+        },
+        "treeSha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+        "treeSha256After": {
+          "oneOf": [
+            { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+            { "type": "null" }
+          ]
+        },
+        "treeStable": { "type": "boolean" },
+        "treeExclude": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "source": { "type": "string" }
+      }
+    },
+    "host": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["dsh", "node", "platform"],
+      "properties": {
+        "dsh": {
+          "oneOf": [
+            { "type": "string", "minLength": 1 },
+            { "type": "null" }
+          ]
+        },
+        "dshCommit": {
+          "oneOf": [
+            { "type": "string", "pattern": "^[0-9a-f]{7,40}$" },
+            { "type": "null" }
+          ]
+        },
+        "cordis": { "type": "string" },
+        "node": { "type": "string", "minLength": 1 },
+        "platform": { "type": "string", "minLength": 1 }
+      }
+    },
+    "journeys": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["J1", "J2", "J3", "J4", "J5", "J6", "J7", "J8"],
+      "patternProperties": {
+        "^J[1-8]$": { "$ref": "#/$defs/journey" }
+      }
+    },
+    "claims": {
+      "type": "object",
+      "description": "Attestation level of this evidence. Passing journeys are not runtime by themselves: `level-audit` may report `runtime` only when `claimLevel` is `sandbox-attested` (or `producer.kind` is `sandbox`). `self-attested` (local collector) and `ci-attested` (`--ci`) keep their `passed` count but are reported `not-run`, because structural validation cannot prove the commands ran, let alone in a sandbox.",
+      "additionalProperties": false,
+      "required": ["claimLevel"],
+      "properties": {
+        "claimLevel": {
+          "enum": ["self-attested", "ci-attested", "sandbox-attested"],
+          "description": "`sandbox-attested` is the only claim level that can yield FLOW runtime; `self-attested` and `ci-attested` are never runtime."
+        },
+        "notClaimed": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "method": { "type": "string" }
+      }
+    },
+    "chain": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["evidenceHash"],
+      "properties": {
+        "evidenceHash": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "conclusion": {
+      "enum": ["flow-pass", "flow-warn", "flow-blocked", "flow-fail"]
+    },
+    "signature": {
+      "oneOf": [{ "type": "object" }, { "type": "null" }]
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "log": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "assertion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["claim", "observed"],
+      "properties": {
+        "claim": { "type": "string", "minLength": 1 },
+        "observed": { "type": "boolean" },
+        "detail": { "type": "string" }
+      }
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "command", "exitCode", "startedAt", "endedAt", "stdout", "assertions"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^J[1-8](?:\\.[A-Za-z0-9._-]+)?$" },
+        "kind": { "enum": ["observed", "static", "manual"] },
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" }
+        },
+        "exitCode": { "type": "integer", "minimum": 0, "maximum": 255 },
+        "startedAt": { "type": "string", "format": "date-time" },
+        "endedAt": { "type": "string", "format": "date-time" },
+        "stdout": { "$ref": "#/$defs/log" },
+        "stderr": { "$ref": "#/$defs/log" },
+        "assertions": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/assertion" }
+        },
+        "durationMs": { "type": "number", "minimum": 0 }
+      }
+    },
+    "journey": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["checks"],
+      "properties": {
+        "status": {
+          "enum": ["pass", "fail", "warn", "blocked", "static", "na", "not-run"]
+        },
+        "reason": { "type": "string" },
+        "kind": { "type": "string" },
+        "limitations": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "checks": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/check" }
+        }
+      }
+    }
+  }
+}

package/spec/levels.json

@@ -156,6 +156,8 @@
       "machine": {
         "journey": "40-checker/scripts/journey.mjs",
         "journeyRuntime": "40-checker/scripts/journey-runtime.mjs",
+        "collector": "40-checker/bin/dsh-flow-collect.mjs",
+        "flowEvidence": "spec/flow-evidence.schema.json",
         "audit": "40-checker/scripts/level-audit.mjs"
       }
     },