dsh-standards 1.1.2 → 1.2.1

package/40-checker/test/entry-validate.test.mjs

@@ -1,172 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-import fs from 'node:fs'
-import os from 'node:os'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SCRIPT = path.join(STD, '40-checker', 'scripts', 'entry-validate.mjs')
-const FIXTURES = path.join(STD, 'adoption', 'entry', 'fixtures')
-
-function run(name, withMeta = true) {
-  const dir = path.join(FIXTURES, name)
-  const args = [SCRIPT, dir, '--json']
-  const meta = path.join(dir, 'meta.json')
-  if (withMeta && fs.existsSync(meta)) args.push('--meta', meta)
-  return spawnSync(process.execPath, args, { encoding: 'utf8', timeout: 30_000 })
-}
-
-function result(name, withMeta = true) {
-  const out = run(name, withMeta)
-  assert.ok(out.stdout, out.stderr)
-  return { out, json: JSON.parse(out.stdout) }
-}
-
-test('entry-validate: the good fixture passes C1-C8', () => {
-  const { out, json } = result('good')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.conclusion.status, 'pass')
-  assert.deepEqual(json.conclusion.failed, [])
-  assert.deepEqual(json.conclusion.notRun, [])
-})
-
-test('entry-validate: missing meta is incomplete, never a pass', () => {
-  const { out, json } = result('no-meta', false)
-  assert.equal(out.status, 3)
-  assert.equal(json.conclusion.status, 'incomplete')
-  assert.ok(json.conclusion.notRun.includes('C1'))
-  assert.ok(json.conclusion.notRun.includes('C7'))
-})
-
-const failures = [
-  ['client-only', 'C2'],
-  ['missing-patch', 'C2'],
-  ['engines-star', 'C4'],
-  ['client-no-export', 'C5'],
-  ['no-metadata', 'C6'],
-  ['no-version', 'C7'],
-  ['forbidden-label', 'C8'],
-]
-
-for (const [name, id] of failures) {
-  test(`entry-validate: ${name} fails ${id}`, () => {
-    const { out, json } = result(name)
-    assert.equal(out.status, 2, out.stderr)
-    assert.equal(json.conclusion.status, 'fail')
-    assert.ok(json.conclusion.failed.includes(id), JSON.stringify(json.conclusion))
-  })
-}
-
-test('entry-validate: a peer range is an accepted C4 source', () => {
-  const { out, json } = result('peer-ok')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.checks.find(row => row.id === 'C4').status, 'pass')
-})
-
-test('entry-validate: a declared but uncommitted build output is a warning, not a fail', () => {
-  const { out, json } = result('build-output')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.conclusion.status, 'pass-with-warnings')
-  assert.ok(json.conclusion.warnings.includes('C5'))
-  assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
-  assert.deepEqual(json.conclusion.failed, [])
-})
-
-test('entry-validate: an ordered dsh.bundle.patch list is accepted', () => {
-  const { out, json } = result('patch-list')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.checks.find(row => row.id === 'C2').status, 'pass')
-  assert.equal(json.conclusion.status, 'pass')
-})
-
-function hostEvidence(status) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-entry-host-'))
-  const file = path.join(dir, 'host.json')
-  fs.writeFileSync(file, JSON.stringify({
-    status,
-    command: 'dsh plugin --profile test add @dsh-fixtures/entry-good',
-    host: 'dsh 0.2.2-alpha.2 / cordis 4.0.6-alpha.1',
-    evidence: 'https://example.invalid/host-install/1',
-    generatedAt: '2026-11-02',
-  }))
-  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
-}
-
-test('entry-validate: a passed host install upgrades C3 to pass', () => {
-  const h = hostEvidence('pass')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'pass')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a failed host install fails C3', () => {
-  const h = hostEvidence('fail')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 2)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'fail')
-    assert.ok(json.conclusion.failed.includes('C3'))
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a blocked host install is incomplete, not a pass', () => {
-  const h = hostEvidence('blocked')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 3)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'blocked')
-    assert.ok(json.conclusion.blocked.includes('C3'))
-    assert.equal(json.conclusion.status, 'incomplete')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: C3 is flow-only when no host evidence is supplied', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c3-flow-'))
-  try {
-    const meta = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'good', 'meta.json'), 'utf8'))
-    delete meta.installCommand
-    const metaFile = path.join(dir, 'meta.json')
-    fs.writeFileSync(metaFile, JSON.stringify(meta))
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', metaFile], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('entry-validate: host evidence can mark C3 not-applicable for a host/directory sample', () => {
-  const h = hostEvidence('not-applicable')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a missing license is A7 advisory, not a C6 fail', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c6-license-'))
-  try {
-    const src = path.join(FIXTURES, 'good')
-    for (const name of ['index.js', 'client.js', 'cordis.patch.yml', 'meta.json']) fs.copyFileSync(path.join(src, name), path.join(dir, name))
-    const pkg = JSON.parse(fs.readFileSync(path.join(src, 'package.json'), 'utf8'))
-    delete pkg.license
-    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(pkg))
-    const out = spawnSync(process.execPath, [SCRIPT, dir, '--json', '--meta', path.join(dir, 'meta.json')], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
-    assert.ok(json.advisories.some(row => row.id === 'A7'))
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})

package/40-checker/test/governance.test.mjs

@@ -1,76 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { validateGovernance } from '../scripts/governance-check.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const ROOT = path.resolve(HERE, '..', '..')
-const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
-
-function fixture() {
-  return {
-    roles: read('governance/roles.json'),
-    contributors: read('governance/contributors.json'),
-    reviewers: read('governance/reviewers.json'),
-    coi: read('governance/coi.json'),
-  }
-}
-
-test('governance: the checked-in files pass', () => {
-  const result = validateGovernance(fixture())
-  assert.deepEqual(result.errors, [])
-})
-
-test('governance: exactly one human organizer is required', () => {
-  const data = fixture()
-  data.roles.roles.organizer.bot = true
-  data.roles.roles.organizer.humanOnly = false
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /organizer must be humanOnly/.test(e)))
-})
-
-test('governance: AI must not decide spec semantics', () => {
-  const data = fixture()
-  data.roles.matrix['ai-steward']['spec.decide'] = 'allow'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /must not hold spec\.decide/.test(e)))
-})
-
-test('governance: AI merge must be allowlist-only', () => {
-  const data = fixture()
-  data.roles.matrix['ai-steward']['repo.merge.main'] = 'allow'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /allow-with-allowlist/.test(e)))
-})
-
-test('governance: class A approver must be human', () => {
-  const data = fixture()
-  data.roles.decisions.A.approver = ['ai-steward']
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /decision A approver/.test(e)))
-})
-
-test('governance: AI merge denylist protects spec and governance', () => {
-  const data = fixture()
-  data.roles.ai.mergeDenylist = ['spec/']
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /governance\//.test(e)))
-})
-
-test('governance: a contributor needs DCO and the current terms', () => {
-  const data = fixture()
-  data.contributors.contributors[0].signedOff = false
-  data.contributors.contributors[0].terms = 'dsh-ct/0'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /no DCO sign-off/.test(e)))
-  assert.ok(result.errors.some((e) => /terms mismatch/.test(e)))
-})
-
-test('governance: reviewer must reference a human role', () => {
-  const data = fixture()
-  data.reviewers.reviewers[0].role = 'ai-steward'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /human role/.test(e)))
-})

package/40-checker/test/label.test.mjs

@@ -1,97 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-import fs from 'node:fs'
-import os from 'node:os'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SYNC = path.join(STD, '40-checker', 'scripts', 'label-sync.mjs')
-const DRIFT = path.join(STD, '40-checker', 'scripts', 'label-drift.mjs')
-const VERIFY = path.join(STD, '40-checker', 'scripts', 'label-verify.mjs')
-const SAMPLE = path.join(STD, 'adoption', 'market', 'sample-source.json')
-
-function tempDir() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-label-test-'))
-}
-
-function run(script, args) {
-  return spawnSync(process.execPath, [script, ...args], { encoding: 'utf8', timeout: 30_000 })
-}
-
-test('label-sync: writes a valid index from the sample source', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    const sync = run(SYNC, ['--source', SAMPLE, '--out', out])
-    assert.equal(sync.status, 0, sync.stderr)
-    const index = JSON.parse(fs.readFileSync(path.join(out, 'index.json'), 'utf8'))
-    assert.equal(index.schema, 'dsh-label-index/1')
-    assert.equal(index.records.length, 1)
-    assert.match(index.records[0].recordHash, /^sha256:[0-9a-f]{64}$/)
-    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2026-11-02'])
-    assert.equal(drift.status, 0, drift.stdout + drift.stderr)
-    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', index.records[0].recordHash, '--json'])
-    assert.equal(verify.status, 0, verify.stderr)
-    const view = JSON.parse(verify.stdout)
-    assert.equal(view.ok, true)
-    assert.equal(view.claimLevel, 'reference')
-    assert.equal(Object.prototype.hasOwnProperty.call(view, 'grade'), false)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-drift: an expired label is stale and fails', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
-    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2028-01-01', '--json'])
-    assert.equal(drift.status, 1)
-    const result = JSON.parse(drift.stdout)
-    assert.equal(result.stale, 1)
-    assert.equal(result.ok, false)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-sync: a grade or a wrong hash is rejected', () => {
-  const dir = tempDir()
-  try {
-    const source = JSON.parse(fs.readFileSync(SAMPLE, 'utf8'))
-    const badGrade = structuredClone(source)
-    badGrade[0].grade = 'A'
-    const gradeFile = path.join(dir, 'bad-grade.json')
-    fs.writeFileSync(gradeFile, JSON.stringify(badGrade))
-    const grade = run(SYNC, ['--source', gradeFile, '--check'])
-    assert.equal(grade.status, 1)
-    assert.match(grade.stderr, /forbidden field: grade/)
-
-    const badHash = structuredClone(source)
-    badHash[0].recordHash = `sha256:${'0'.repeat(64)}`
-    const hashFile = path.join(dir, 'bad-hash.json')
-    fs.writeFileSync(hashFile, JSON.stringify(badHash))
-    const hash = run(SYNC, ['--source', hashFile, '--check'])
-    assert.equal(hash.status, 1)
-    assert.match(hash.stderr, /recordHash does not match/)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-verify: an unknown hash is a 404, not a fake pass', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
-    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', `sha256:${'f'.repeat(64)}`])
-    assert.equal(verify.status, 2)
-    assert.match(verify.stderr, /not found/)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})

package/40-checker/test/level-audit.test.mjs

@@ -1,99 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SCRIPT = path.join(STD, '40-checker', 'scripts', 'level-audit.mjs')
-const GOOD = path.join(STD, '40-checker', 'fixtures', 'good')
-
-test('level-audit: static ENTRY is recognized, FLOW/BOOST are not upgraded', () => {
-  const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
-  assert.equal(run.status, 0, run.stderr)
-  const result = JSON.parse(run.stdout)
-  assert.equal(result.schema, 'dsh-level-audit/1')
-  assert.equal(result.levelsSpec.schema, 'dsh-levels/1')
-  assert.equal(result.levels.entry.state, 'recognized')
-  assert.equal(result.levels.flow.state, 'not-run')
-  assert.equal(result.levels.boost.state, 'not-measured')
-  assert.deepEqual(result.notClaimed.includes('certification'), true)
-})
-
-test('level-audit: a missing package exits 3 and does not print a fake pass', () => {
-  const run = spawnSync(process.execPath, [SCRIPT, '/no/such/package', '--format', 'json'], { encoding: 'utf8', timeout: 30_000 })
-  assert.equal(run.status, 3)
-  assert.match(run.stderr, /not a package directory/)
-})
-
-import fs from 'node:fs'
-import os from 'node:os'
-
-const BOOST_IDS = ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8']
-
-function writeBoostEvidence(rows) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-boost-evidence-'))
-  const file = path.join(dir, 'boost.json')
-  fs.writeFileSync(file, JSON.stringify(rows))
-  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
-}
-
-function validCard(expiresAt = '2099-01-01', generatedAt = '2026-11-01') {
-  return {
-    subject: 'fixture@1.0.0',
-    host: 'fixture-host',
-    method: 'fixture',
-    scope: 'fixture',
-    command: 'node fixture.mjs',
-    result: 'pass',
-    negativeControl: 'control fails as expected',
-    generatedAt,
-    expiresAt,
-    recordHash: `sha256:${'a'.repeat(64)}`,
-    claimLevel: 'self-reported',
-    issuer: 'fixture',
-    selfAssessed: true,
-  }
-}
-
-test('level-audit: status-only BOOST rows are not measured without evidence cards', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidence: 'looks fine' }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'not-measured')
-    assert.equal(result.levels.boost.practices['LEV-1'].card.valid, false)
-  } finally {
-    fixture.cleanup()
-  }
-})
-
-test('level-audit: BOOST is measured only with eight valid evidence cards', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard() }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'measured')
-    assert.equal(result.levels.boost.validCards, 8)
-  } finally {
-    fixture.cleanup()
-  }
-})
-
-test('level-audit: expired BOOST cards are stale, not measured', () => {
-  const rows = Object.fromEntries(BOOST_IDS.map(id => [id, { status: 'measured', evidenceCard: validCard('2020-01-01', '2019-01-01') }]))
-  const fixture = writeBoostEvidence(rows)
-  try {
-    const run = spawnSync(process.execPath, [SCRIPT, GOOD, '--format', 'json', '--boost-evidence', fixture.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(run.status, 0, run.stderr)
-    const result = JSON.parse(run.stdout)
-    assert.equal(result.levels.boost.state, 'stale')
-  } finally {
-    fixture.cleanup()
-  }
-})

package/40-checker/test/levels.test.mjs

@@ -1,31 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { readFileSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const levels = JSON.parse(readFileSync(path.join(STD, 'spec', 'levels.json'), 'utf8'))
-
-test('levels: exactly three levels with the expected ids and analogies', () => {
-  assert.equal(levels.schema, 'dsh-levels/1')
-  assert.equal(levels.nonOfficial, true)
-  assert.deepEqual(levels.levels.map(level => level.id), ['entry', 'flow', 'boost'])
-  assert.deepEqual(levels.levels.map(level => level.analogy), ['GB', 'GB/T', 'GB/Z'])
-})
-
-test('levels: ENTRY has G0-G5, FLOW has J1-J8, BOOST has LEV-1..LEV-8', () => {
-  const gates = Object.fromEntries(levels.levels.map(level => [level.id, level.gates.map(gate => gate.id)]))
-  assert.deepEqual(gates.entry, ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
-  assert.deepEqual(gates.flow, ['J1', 'J2', 'J3', 'J4', 'J5', 'J6', 'J7', 'J8'])
-  assert.deepEqual(gates.boost, ['LEV-1', 'LEV-2', 'LEV-3', 'LEV-4', 'LEV-5', 'LEV-6', 'LEV-7', 'LEV-8'])
-})
-
-test('levels: evidence states include not-run and never imply a pass', () => {
-  const all = new Set(levels.levels.flatMap(level => level.evidenceStates))
-  assert.equal(all.has('not-run'), true)
-  assert.equal(all.has('runtime'), true)
-  assert.equal(all.has('measured'), true)
-  assert.equal(levels.axes.rules.some(rule => rule.includes('skip is not a pass')), true)
-})

package/40-checker/test/ops.test.mjs

@@ -1,117 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { validateClauseMap } from '../scripts/clause-map.mjs'
-import { effective } from '../scripts/stale-check.mjs'
-import { appendRecord, verifyChain } from '../scripts/evidence-chain.mjs'
-import { buildDashboard } from '../scripts/dashboard.mjs'
-import { inspect } from '../scripts/surveillance.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const ROOT = path.resolve(HERE, '..', '..')
-const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
-
-test('clause map: the checked-in map covers every gate', () => {
-  const result = validateClauseMap({ levels: read('spec/levels.json'), clauses: read('spec/clauses.json') })
-  assert.deepEqual(result.errors, [])
-  assert.deepEqual(result.covered.entry.sort(), ['G0', 'G1', 'G2', 'G3', 'G4', 'G5'])
-})
-
-test('clause map: a missing gate is an error', () => {
-  const levels = read('spec/levels.json')
-  const clauses = read('spec/clauses.json')
-  clauses.clauses = clauses.clauses.filter((c) => !c.gates.includes('G4'))
-  const result = validateClauseMap({ levels, clauses })
-  assert.ok(result.errors.some((e) => /G4/.test(e)))
-})
-
-test('stale: an active expired record is expired', () => {
-  const r = effective({ status: 'active', expiresAt: '2020-01-01' }, new Date('2026-11-01T00:00:00Z'))
-  assert.equal(r.status, 'expired')
-  assert.equal(r.stale, true)
-})
-
-test('stale: a draft is not valid but not “stale”', () => {
-  const r = effective({ status: 'draft', expiresAt: '2030-01-01' }, new Date('2026-11-01T00:00:00Z'))
-  assert.equal(r.status, 'draft')
-  assert.equal(r.stale, false)
-})
-
-test('evidence chain: append then verify', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
-  const record = path.join(dir, 'record.json')
-  fs.writeFileSync(record, '{"ok":true}')
-  const chain = path.join(dir, 'chain.jsonl')
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:01Z' })
-  const result = verifyChain(fs.readFileSync(chain, 'utf8').split('\n'))
-  assert.deepEqual(result.errors, [])
-  assert.equal(result.entries, 2)
-  fs.rmSync(dir, { recursive: true, force: true })
-})
-
-test('evidence chain: tampering is detected', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-chain-'))
-  const record = path.join(dir, 'record.json')
-  fs.writeFileSync(record, '{"ok":true}')
-  const chain = path.join(dir, 'chain.jsonl')
-  appendRecord({ chain, record, ts: '2026-11-02T00:00:00Z' })
-  const lines = fs.readFileSync(chain, 'utf8').split('\n')
-  lines[0] = lines[0].replace(/("recordSha256":")([0-9a-f])/, (m, a, b) => a + (b === '0' ? '1' : '0'))
-  const result = verifyChain(lines)
-  assert.ok(result.errors.length > 0)
-  fs.rmSync(dir, { recursive: true, force: true })
-})
-
-test('dashboard: never claims official/security/production', () => {
-  const d = buildDashboard(ROOT)
-  assert.equal(d.schema, 'dsh-dashboard/1')
-  assert.ok(d.notClaimed.includes('security audit'))
-  assert.equal(d.flow.packages, 10)
-})
-
-test('surveillance: expired record becomes an issue', () => {
-  const report = inspect({ attestations: [{ attestationId: 'DSH-ATT-2020-001', status: 'active', expiresAt: '2020-01-01', verifyUrl: 'https://example.com', claimLevel: 'self-reported' }] }, new Date('2026-11-01T00:00:00Z'))
-  assert.ok(report.issues.some((i) => i.issues.includes('expired')))
-})
-
-test('round-robin: independent matching runs are comparable', async () => {
-  const { compare } = await import('../scripts/round-robin.mjs')
-  const expected = { good: { expected: 'warn' }, bad: { expected: 'fail' } }
-  const r = compare({
-    a: { runner: 'runner-a', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
-    b: { runner: 'runner-b', results: { good: { status: 'warn' }, bad: { status: 'fail' } } },
-    expected,
-  })
-  assert.equal(r.comparable, true)
-})
-
-test('round-robin: two not-run results are not comparable', async () => {
-  const { compare } = await import('../scripts/round-robin.mjs')
-  const r = compare({
-    a: { runner: 'runner-a', results: { good: { status: 'not-run' } } },
-    b: { runner: 'runner-b', results: { good: { status: 'not-run' } } },
-    expected: { good: { expected: 'warn' } },
-  })
-  assert.equal(r.comparable, false)
-})
-
-test('flow index: aggregates result files without upgrading a verdict', async () => {
-  const { buildFlowIndex } = await import('../scripts/flow-index.mjs')
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-index-'))
-  const row = (id, pass, fail) => ({
-    schema: 'dsh-flow-real/1', id, package: id, version: '1.0.0', source: 'fixture', why: 'test',
-    verdicts: { J1: pass ? 'pass' : 'fail', J2: 'not-run', J4: 'not-run', J6: 'not-run' },
-    classification: 'clean', conclusion: 'partial', caveats: [], summary: { checks: { pass, fail, blocked: 0, notRun: 6 }, verdicts: { pass: pass ? 1 : 0, fail: fail, blocked: 0, partial: 0, notRun: 3 } },
-  })
-  fs.writeFileSync(path.join(dir, 'a.json'), JSON.stringify(row('a', 1, 0)))
-  fs.writeFileSync(path.join(dir, 'b.json'), JSON.stringify(row('b', 0, 1)))
-  const index = buildFlowIndex(dir)
-  assert.equal(index.totals.packages, 2)
-  assert.equal(index.totals.checks.fail, 1)
-  assert.equal(index.totals.verdicts.fail, 1)
-  fs.rmSync(dir, { recursive: true, force: true })
-})

package/40-checker/test/permissions.test.mjs

@@ -1,40 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { checkCredentials } from '../src/declarations.mjs'
-import { validateCommitments, validateDisclosure, COMMITMENT_IDS } from '../src/permissions.mjs'
-
-const manifest = {
-  dsh: {
-    commitmentsVersion: 1,
-    commitments: Object.fromEntries(COMMITMENT_IDS.map(id => [id, true])),
-    disclosure: {
-      endpoints: ['https://api.example.com'],
-      retention: 'none',
-      systemPrompt: 'unchanged',
-    },
-    capabilities: ['network:egress'],
-  },
-}
-
-test('all 9 commitments validate as booleans', () => {
-  const details = validateCommitments(manifest)
-  assert.equal(details.length, 1)
-  assert.equal(details[0].result, 'PASS')
-})
-
-test('missing commitment is a warning, not a failure', () => {
-  const details = validateCommitments({ dsh: { commitments: { 'no-session-upload': true } } })
-  assert.ok(details.some(item => item.result === 'WARN' && item.reason.includes('missing commitment')))
-})
-
-test('disclosure endpoints must be https URLs', () => {
-  const details = validateDisclosure({ dsh: { disclosure: { endpoints: ['http://insecure.example.com'] } } })
-  assert.ok(details.some(item => item.result === 'WARN'))
-})
-
-test('checkCredentials reads both declaration fields', () => {
-  const check = checkCredentials(manifest, [])
-  assert.equal(check.result, 'PASS')
-  assert.ok(check.details.some(item => item.item === 'C-12.6' && item.result === 'PASS'))
-  assert.ok(check.details.some(item => item.item === 'C-12.7' && item.result === 'PASS'))
-})

package/40-checker/test/semver.test.mjs

@@ -1,32 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import { compareVersions, parseVersion, satisfies, validRange } from '../src/semver.mjs'
-
-test('parseVersion accepts exact semver and prerelease', () => {
-  assert.deepEqual(parseVersion('0.2.2-alpha.2'), { major: 0, minor: 2, patch: 2, prerelease: ['alpha', '2'] })
-  assert.equal(parseVersion('^0.2.2'), null)
-})
-
-test('compareVersions orders release above prerelease', () => {
-  assert.equal(compareVersions(parseVersion('0.2.2'), parseVersion('0.2.2-alpha.2')), 1)
-  assert.equal(compareVersions(parseVersion('0.2.2-alpha.2'), parseVersion('0.2.2-alpha.1')), 1)
-  assert.equal(compareVersions(parseVersion('0.2.0-rc.2'), parseVersion('0.2.0-0')), 1)
-})
-
-test('satisfies handles the ranges used by real plugins', () => {
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.2.2-alpha.2 <0.3.0'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.1.5-rc.1 <0.2.0-0 || >=0.2.0-rc.2 <0.3.0-0'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2-alpha.2'), true)
-  assert.equal(satisfies('0.2.2-alpha.2', '~0.2.2'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', '^0.2.2'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', '>=0.3.0'), false)
-  assert.equal(satisfies('0.2.2-alpha.2', 'workspace:^'), false)
-  assert.equal(satisfies('24.0.0', '^22.19.0 || >=24.0.0'), true)
-})
-
-test('validRange rejects empty and malformed ranges', () => {
-  assert.equal(validRange('>=0.2.2 <0.3.0'), true)
-  assert.equal(validRange(''), false)
-  assert.equal(validRange('workspace:^'), false)
-  assert.equal(validRange('not-a-range'), false)
-})