dsh-standards 1.2.0 → 1.2.1

package/40-checker/README.md

@@ -19,7 +19,7 @@ node bin/dsh-plugin-verify.mjs /path/to/plugin --format json --out report.json
 node bin/dsh-plugin-verify.mjs /path/to/plugin --format sarif --out report.sarif
 ```
 
-`buildReport()` 与 `--format json` 默认带**加性** `advice[]`（来自 `spec/remediation.json` 的 68 条规则；FAIL/WARN detail 优先，无 detail 的运行时 FAIL 用 `check.clause` 兜底）。`--no-advice` 可关闭；它不改变任何 check 的结果或 exit code。
+`buildReport()` 与 `--format json` 默认带**加性** `advice[]`（来自 `spec/remediation.json` 的 68 条规则；FAIL/WARN detail 优先，无 detail 的运行时 FAIL 用 `check.clause` 兜底）。每条 advice 的 `gate` 是该 check 的最终结果（PASS/WARN/FAIL），`severity` 跟随 `gate`：被降级为 WARN 的 check 即使 detail 仍是 FAIL，也只给 WARN，detail 原因保留在 `reason`。`--no-advice` 可关闭；它不改变任何 check 的结果或 exit code。
 
 ## 2. 检查项
 
@@ -137,7 +137,7 @@ node bin/dsh-flow-collect.mjs --package ./my-plugin --out flow-evidence.json
 - 每个 J 必须至少 1 条 `checks[]` 且全部 `exitCode === 0`、断言成立、至少一条非 `static` 观测检查，才计 pass；`static` preflight 不是 runtime，`warn`/`blocked`/`na` 都不计 8/8。
 - collector 把包复制到临时目录再跑，前后 `treeSha256` 必须一致；子进程 env 走白名单（不含 token/key/secret）；不授予 `allowBuilds`，不自动 `allow-version`。
 - 前置缺失（无 dsh、无 `--previous`、宿主兼容门禁拒绝）记 `blocked` + reason，出口码 0；真失败出口码 1，并打印五要素提示（子检查 / 命令 / exitCode / stderr 末 20 行 / 日志绝对路径 + 条款锚）。
-- 本地证据只是 `self-attested`：结构自洽 + 绑定此包 + 未过期，**不证明真跑过**，也不是沙箱、认证或安全审计。
+- 本地证据只是 `self-attested`：结构自洽 + 绑定此包 + 未过期，**不证明真跑过**，也不是沙箱、认证或安全审计。`level-audit` 只有见到 `claims.claimLevel=sandbox-attested` 或 `producer.kind=sandbox` 才判 `runtime`；self/ci 证据保留 `passed` 计数但记 `not-run`。
 
 ## 4. 运行 L1–L3
 

package/40-checker/scripts/level-audit.mjs

@@ -8,6 +8,10 @@
  *   FLOW   reads an optional `dsh-flow-evidence/2` file; with no file it reports
  *          the checklist as `not-run` and never invents a pass. v1 schemas and
  *          bare {Jx:{status}} rows are `deprecated` and never count as a pass.
+ *          Only sandbox-attested evidence (claims.claimLevel =
+ *          'sandbox-attested' or producer.kind = 'sandbox') may become
+ *          `runtime`; self-attested/ci-attested keeps its pass count but stays
+ *          `not-run`.
  *   BOOST  reads an optional LEV evidence file; with no file it reports
  *          `not-measured`. It does not run benchmarks for you.
  *
@@ -161,6 +165,9 @@ function classifyFlow(evidence) {
     return {
       state: 'not-run',
       schema: null,
+      claimLevel: null,
+      producerKind: null,
+      sandboxAttested: false,
       deprecated: false,
       invalid: false,
       evidenceHash: null,
@@ -177,6 +184,9 @@ function classifyFlow(evidence) {
   }
   const base = {
     schema: verdict.schema,
+    claimLevel: verdict.claimLevel ?? null,
+    producerKind: verdict.producerKind ?? null,
+    sandboxAttested: verdict.sandboxAttested === true,
     deprecated: verdict.kind === 'v1-deprecated' || verdict.kind === 'legacy',
     invalid: false,
     evidenceHash: null,
@@ -222,19 +232,33 @@ function classifyFlow(evidence) {
   const passed = ids.filter(id => journeys[id].passes)
   const failed = ids.filter(id => journeys[id].status === 'fail' && journeys[id].declared !== 'blocked')
   const blocked = ids.filter(id => journeys[id].declared === 'blocked')
+  // Passing journeys are necessary but not sufficient: only sandbox-attested
+  // evidence may be reported as runtime. A self-attested/ci-attested document
+  // keeps its pass count but never upgrades to runtime. An honest FAIL/BLOCKED
+  // stays visible instead of being hidden behind the attestation level.
+  const runtimeEligible = base.sandboxAttested
   const state = failed.length > 0
     ? 'failed'
-    : passed.length === ids.length
-      ? 'runtime'
-      : blocked.length > 0 ? 'blocked' : 'not-run'
+    : blocked.length > 0
+      ? 'blocked'
+      : runtimeEligible && passed.length === ids.length
+        ? 'runtime'
+        : 'not-run'
   const reasons = []
+  if (!runtimeEligible && failed.length === 0) {
+    reasons.push(`${base.claimLevel ?? 'non-sandbox'} evidence; runtime requires sandbox-attested`)
+  }
   if (failed.length > 0) reasons.push(`failed journeys: ${failed.join(', ')}`)
   if (blocked.length > 0) reasons.push(`blocked journeys (never a pass): ${blocked.join(', ')}`)
   if (failed.length === 0 && passed.length !== ids.length) {
     const rest = ids.filter(id => !passed.includes(id) && !blocked.includes(id))
     if (rest.length > 0) reasons.push(`${passed.length}/8 journeys pass; ${rest.length} static/warn/not-run`)
   }
-  if (passed.length === ids.length) reasons.push('all J1-J8 journey checks pass (exitCode 0, assertions held)')
+  if (passed.length === ids.length) {
+    reasons.push(runtimeEligible
+      ? 'all J1-J8 journey checks pass (exitCode 0, assertions held)'
+      : 'all J1-J8 journey checks pass but the evidence is not sandbox-attested; not runtime')
+  }
   return {
     ...base,
     state,
@@ -338,7 +362,11 @@ function nextActions(entry, flow, boost) {
   if (entry.g4 && entry.g4.hasClient && entry.g4.ok === false) actions.push(`ENTRY: fix G4 — ${entry.g4.reason}`)
   for (const warning of entry.warnings) actions.push(`ENTRY: consider ${warning.id} — ${warning.reason}`)
   if (entry.state === 'recognized') actions.push('ENTRY: run with --host to replace static recognition with a real G0-G3 boot')
-  if (flow.state === 'not-run') actions.push('FLOW: record J1-J8 with node 40-checker/bin/dsh-flow-collect.mjs; do not claim FLOW until they run')
+  if (flow.state === 'not-run' && flow.claimLevel && flow.sandboxAttested !== true) {
+    actions.push(`FLOW: ${flow.claimLevel} evidence keeps ${flow.passed}/8 journey passes but is not runtime; re-run under a sandbox and set claims.claimLevel=sandbox-attested (or producer.kind=sandbox)`)
+  } else if (flow.state === 'not-run') {
+    actions.push('FLOW: record J1-J8 with node 40-checker/bin/dsh-flow-collect.mjs; do not claim FLOW until they run')
+  }
   if (flow.state === 'deprecated') actions.push('FLOW: v1/bare evidence is deprecated; collect a dsh-flow-evidence/2 file (spec/flow-evidence.schema.json)')
   if (flow.state === 'invalid') actions.push('FLOW: flow evidence failed structural validation; fix the listed fields or recollect')
   if (flow.state === 'failed') actions.push(`FLOW: fix failed journeys: ${Object.entries(flow.journeys).filter(([, row]) => row.status === 'fail').map(([id]) => id).join(', ')}`)

package/40-checker/src/flow-evidence.mjs

@@ -13,6 +13,12 @@
  * status alone): at least one check, every check has exitCode 0, at least one
  * observed (non-static) check, and every observed check's assertions hold.
  * A journey declared `warn`/`blocked`/`na`/`static`/`not-run` never counts.
+ *
+ * Runtime rule: passing journeys are necessary but not sufficient. Only
+ * sandbox-attested evidence (`claims.claimLevel === 'sandbox-attested'` or
+ * `producer.kind === 'sandbox'`) may be reported as `flow.state = 'runtime'`.
+ * `self-attested`/`ci-attested` documents keep their `passed` count but stay
+ * `not-run`, because structural validation cannot prove where commands ran.
  */
 import crypto from 'node:crypto'
 import fs from 'node:fs'
@@ -163,6 +169,18 @@ export function journeyCountsAsPass(journey) {
   return declared === null || declared === 'pass'
 }
 
+/**
+ * Runtime eligibility. A local collector run is `self-attested`
+ * (`ci-attested` with `--ci`): structurally valid, but it does not prove that
+ * commands ran, let alone in a sandbox. Only `claims.claimLevel ===
+ * 'sandbox-attested'` or the producer-side equivalent `producer.kind ===
+ * 'sandbox'` may be reported as FLOW runtime.
+ */
+export function isSandboxAttested(document) {
+  if (!isPlainObject(document)) return false
+  return document.claims?.claimLevel === 'sandbox-attested' || document.producer?.kind === 'sandbox'
+}
+
 function emptyVerdict(kind, schema, errors) {
   return {
     kind,
@@ -176,6 +194,9 @@ function emptyVerdict(kind, schema, errors) {
     host: null,
     generatedAt: null,
     conclusion: null,
+    claimLevel: null,
+    producerKind: null,
+    sandboxAttested: false,
   }
 }
 
@@ -366,6 +387,9 @@ function validateV2(document) {
     host: isPlainObject(document.host) ? document.host : null,
     generatedAt: document.generatedAt ?? null,
     conclusion: document.conclusion ?? null,
+    claimLevel: isPlainObject(document.claims) ? document.claims.claimLevel ?? null : null,
+    producerKind: isPlainObject(document.producer) ? document.producer.kind ?? null : null,
+    sandboxAttested: isSandboxAttested(document),
   }
 
   function validateCheck(check, label) {

package/40-checker/src/index.mjs

@@ -7,5 +7,5 @@ export { buildReport, formatText, formatSarif, writeReport } from './report.mjs'
 export { joinAdvice, DOCS_BASE } from './remediation.mjs'
 export { satisfies, validRange, parseVersion, compareVersions } from './semver.mjs'
 export { parseInstallSpec } from './install-spec.mjs'
-export { FLOW_IDS, FLOW_EVIDENCE_SCHEMA, evidenceHash, finalizeEvidence, journeyAggregate, treeSha256, validateFlowEvidence } from './flow-evidence.mjs'
+export { FLOW_IDS, FLOW_EVIDENCE_SCHEMA, evidenceHash, finalizeEvidence, journeyAggregate, isSandboxAttested, treeSha256, validateFlowEvidence } from './flow-evidence.mjs'
 export { sanitizedEnv, scrubProcessEnv, isSecretEnvName, isAllowedEnvName, envPolicy } from './sandbox-env.mjs'

package/40-checker/src/remediation.mjs

@@ -53,8 +53,13 @@ function uniqueEvidence(...lists) {
  *
  * One entry is produced per (check.id, detail.item) pair with FAIL/WARN — or,
  * for a FAIL/WARN check with no live details, one entry keyed by check.clause.
- * Duplicate details are merged: severity takes the worst value, evidence is
- * unioned, and the specific reasons are joined for diagnostics.
+ * `gate` is the check's final result (PASS/WARN/FAIL) after report adjustments
+ * such as the ENTRY static-claim downgrade; `severity` follows that gate, so a
+ * FAIL detail under a check downgraded to WARN yields a WARN advice entry. The
+ * detail's own reason stays in `reason` for diagnostics.
+ *
+ * Duplicate details are merged: evidence is unioned, occurrences counted, and
+ * the specific reasons are joined for diagnostics.
  *
  * @param {object} report dsh-conformance/1 report
  * @param {object} rules flat key→rule map (also accepts a { rules } or { items } wrapper)
@@ -66,15 +71,15 @@ export function joinAdvice(report, rules, docsBase = DOCS_BASE) {
   const version = versionOf(rules)
   const merged = new Map()
 
-  const add = (check, key, severity, reason, evidence) => {
-    if (typeof key !== 'string' || key === '' || !LIVE.has(severity)) return false
+  const add = (check, key, gate, reason, evidence) => {
+    if (typeof key !== 'string' || key === '' || !LIVE.has(gate)) return false
     const id = `${check.id}|${key}`
     const current = merged.get(id)
     if (!current) {
       merged.set(id, {
         check,
         key,
-        severity,
+        gate,
         reasons: typeof reason === 'string' && reason !== '' ? [reason] : [],
         evidence: uniqueEvidence(evidence),
         occurrences: 1,
@@ -83,7 +88,6 @@ export function joinAdvice(report, rules, docsBase = DOCS_BASE) {
     }
     current.occurrences += 1
     if (typeof reason === 'string' && reason !== '' && !current.reasons.includes(reason)) current.reasons.push(reason)
-    if (SEVERITY_RANK[severity] > SEVERITY_RANK[current.severity]) current.severity = severity
     current.evidence = uniqueEvidence(current.evidence, evidence)
     return true
   }
@@ -92,7 +96,7 @@ export function joinAdvice(report, rules, docsBase = DOCS_BASE) {
     const liveDetails = (Array.isArray(check.details) ? check.details : [])
       .filter(detail => detail && LIVE.has(detail.result))
     let added = 0
-    for (const detail of liveDetails) if (add(check, detail.item, detail.result, detail.reason, detail.evidence)) added += 1
+    for (const detail of liveDetails) if (add(check, detail.item, check.result, detail.reason, detail.evidence)) added += 1
     // A runtime FAIL (DSC-04 / DSC-14) has no details; its clause is the only
     // joinable key. Only use the fallback when no joinable detail was produced,
     // so a specific detail always wins over the check-level summary.
@@ -106,7 +110,8 @@ export function joinAdvice(report, rules, docsBase = DOCS_BASE) {
     const rule = table[entry.key] ?? null
     const item = {
       key: entry.key,
-      severity: entry.severity,
+      gate: entry.gate,
+      severity: entry.gate,
       title: rule?.title ?? entry.key,
       why: rule?.why ?? null,
       fix: rule?.fix ?? null,
@@ -124,7 +129,7 @@ export function joinAdvice(report, rules, docsBase = DOCS_BASE) {
 
   // FAIL before WARN, then key/source for deterministic output.
   advice.sort((a, b) => (
-    (SEVERITY_RANK[b.severity] ?? 0) - (SEVERITY_RANK[a.severity] ?? 0)
+    (SEVERITY_RANK[b.gate] ?? 0) - (SEVERITY_RANK[a.gate] ?? 0)
     || a.key.localeCompare(b.key)
     || a.source.localeCompare(b.source)
   ))

package/CHANGELOG.md

@@ -1,9 +1,11 @@
-## 未发布
+## 1.2.1 — 2026-11-06
 
+- **V2 核验修复**：`level-audit` 不再把结构自洽的 self-attested/ci-attested `dsh-flow-evidence/2` 判成 FLOW `runtime`。只有 `claims.claimLevel=sandbox-attested` 或 `producer.kind=sandbox` 才允许 `runtime`；self/ci 的 `passed` 计数保留但 state 记 `not-run`，reason 为 `<claimLevel> evidence; runtime requires sandbox-attested`。`spec/flow-evidence.schema.json` 的 `claims`/`producer.kind` 补充了该判定说明。`advice[]` 新增 `gate`（该 check 的最终结果 PASS/WARN/FAIL），`severity` 跟随 `gate`：ENTRY static claim 把 DSC-02 降为 WARN 时，C-2.1 的 FAIL detail 仍保留在 `reason`，但 advice severity 为 WARN。测试 150 → 152。
 - **FLOW 证据链**：新增 `spec/flow-evidence.schema.json`（`dsh-flow-evidence/2`）与 `40-checker/src/flow-evidence.mjs`。`level-audit --flow-evidence` 只接受 v2；v1（`dsh-flow-journey/1`、`dsh-flow-runtime/1`）与裸 `{Jx:{status}}` 标 `deprecated`，不计 pass。每个 J 须有 `checks[]` 且全部 `exitCode === 0`、断言成立、至少一条非 `static` 观测检查才计 pass（`warn`/`blocked`/`na`/`static` 不计 8/8）。v2 的 `chain.evidenceHash` 由 audit 重算，改动一个字节即 `invalid`。
 - **collector**：新增 `40-checker/bin/dsh-flow-collect.mjs`（根入口 `bin/dsh-flow-collect.mjs`，并支持 `dsh-levels flow collect`）。只读副本 + 前后 `treeSha256` 一致、`npm pack --ignore-scripts` 的 integrity/tarballSha256、`git rev-parse` commit、临时 HOME/DSH_HOME、失败五要素提示（子检查/命令/exitCode/stderr 末 20 行/日志绝对路径 + 条款锚）；前置缺失记 `blocked` 且 exit 0，真失败 exit 1。
 - **安全**：新增 `40-checker/src/sandbox-env.mjs` 白名单 env。`src/cli.mjs` 的 runtime-child/bundle-smoke 子进程、`bundle-smoke.mjs`/`runtime-child.mjs` 进程内 boot、`m2-runner.mjs`、`journey-runtime.mjs`、`journey-config-observe.mjs`、`flow-sample-ci.mjs`、`host-farm.mjs`、`entry18-web.mjs` 不再把 `process.env` 透传给被检插件/宿主 boot。
 - 测试 137 → 149（新增 `40-checker/test/flow-evidence.test.mjs`：v1 不再 pass、v2 伪造 checks/exitCode 不 pass、篡改链路 invalid、blocked 不判 fail、collector 产物可被 audit 读取、失败五要素提示、env 白名单）。
+- 发布包不再包含 `40-checker/test`：该目录依赖仓库内 fixtures，装到用户环境后无法自测，`npm test` 会在 tarball 内失败。`npm test` 152/152。
 
 ## 1.2.0 — 2026-11-06
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",
@@ -20,7 +20,6 @@
     "40-checker/scripts",
     "40-checker/samples",
     "40-checker/fixtures",
-    "40-checker/test",
     "40-checker/package.json",
     "40-checker/README.md",
     "spec",

package/spec/flow/README.md

@@ -27,3 +27,7 @@ uninstall, diagnostics, client/server states.
 - `claims.claimLevel` is `self-attested` for a local collector run,
   `ci-attested` with `--ci`. Neither is `verified`, a certification, or a
   security audit; only a sandbox run may be described as runtime-attested.
+- `level-audit.mjs` reports FLOW `runtime` only when `claims.claimLevel` is
+  `sandbox-attested` or `producer.kind` is `sandbox`. A `self-attested`/
+  `ci-attested` document keeps its `passed` count but is reported `not-run`;
+  structural validation cannot prove where the commands ran.

package/spec/flow-evidence.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/PerryLink/dsh-standards/spec/flow-evidence.schema.json",
   "title": "DSH FLOW evidence chain",
-  "description": "One collected FLOW result (J1-J8) bound to a package, a host, a timestamp, and a chain hash. Structural validation only: it does not prove the commands really ran. v1 (dsh-flow-journey/1, dsh-flow-runtime/1) and bare {Jx:{status}} documents are deprecated and never count as a pass. `level-audit.mjs --flow-evidence` accepts this document only.",
+  "description": "One collected FLOW result (J1-J8) bound to a package, a host, a timestamp, and a chain hash. Structural validation only: it does not prove the commands really ran. v1 (dsh-flow-journey/1, dsh-flow-runtime/1) and bare {Jx:{status}} documents are deprecated and never count as a pass. `level-audit.mjs --flow-evidence` accepts this document only, and reports `runtime` only when `claims.claimLevel` is `sandbox-attested` or `producer.kind` is `sandbox`; self-attested/ci-attested keeps its pass count but stays not-run.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -29,6 +29,7 @@
     },
     "producer": {
       "type": "object",
+      "description": "Who collected the evidence. `kind: sandbox` is the producer-side equivalent of `claims.claimLevel: sandbox-attested` and is one of the two ways a document may be reported as FLOW runtime.",
       "additionalProperties": false,
       "required": ["command", "at"],
       "properties": {
@@ -42,7 +43,8 @@
           "format": "date-time"
         },
         "kind": {
-          "enum": ["local", "ci", "sandbox"]
+          "enum": ["local", "ci", "sandbox"],
+          "description": "`local`/`ci` are structural evidence only; `sandbox` may count toward FLOW runtime."
         },
         "runner": { "type": "string" },
         "actor": { "type": "string" },
@@ -116,11 +118,13 @@
     },
     "claims": {
       "type": "object",
+      "description": "Attestation level of this evidence. Passing journeys are not runtime by themselves: `level-audit` may report `runtime` only when `claimLevel` is `sandbox-attested` (or `producer.kind` is `sandbox`). `self-attested` (local collector) and `ci-attested` (`--ci`) keep their `passed` count but are reported `not-run`, because structural validation cannot prove the commands ran, let alone in a sandbox.",
       "additionalProperties": false,
       "required": ["claimLevel"],
       "properties": {
         "claimLevel": {
-          "enum": ["self-attested", "ci-attested", "sandbox-attested"]
+          "enum": ["self-attested", "ci-attested", "sandbox-attested"],
+          "description": "`sandbox-attested` is the only claim level that can yield FLOW runtime; `self-attested` and `ci-attested` are never runtime."
         },
         "notClaimed": {
           "type": "array",

package/40-checker/test/attestation.test.mjs

@@ -1,59 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { validateAttestation } from '../scripts/attestation-check.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const ROOT = path.resolve(HERE, '..', '..')
-const base = () => JSON.parse(fs.readFileSync(path.join(ROOT, 'publish/attestations/DSH-ATT-2026-001.json'), 'utf8'))
-
-test('attestation: the checked-in example passes', () => {
-  const result = validateAttestation(base())
-  assert.deepEqual(result.errors, [])
-})
-
-test('attestation: a level field is forbidden', () => {
-  const cert = base()
-  cert.level = 'entry'
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /level field/.test(e)))
-})
-
-test('attestation: selfAssessed cannot be verified', () => {
-  const cert = base()
-  cert.claimLevel = 'verified'
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /cannot claim verified/.test(e)))
-})
-
-test('attestation: an expired active attestation fails', () => {
-  const cert = base()
-  cert.status = 'active'
-  cert.issuedAt = '2024-01-01'
-  cert.expiresAt = '2025-01-01'
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /cannot be active/.test(e)))
-})
-
-test('attestation: excluded scope is required', () => {
-  const cert = base()
-  cert.scope.excluded = []
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /scope\.excluded/.test(e)))
-})
-
-test('attestation: evidence needs a URL or hash', () => {
-  const cert = base()
-  cert.evidence[0] = { id: 'A', result: 'PASS' }
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /needs a url or sha256/.test(e)))
-})
-
-test('attestation: disclaimer must deny official/certification', () => {
-  const cert = base()
-  cert.disclaimer = 'A great plugin, approved.'
-  const result = validateAttestation(cert)
-  assert.ok(result.errors.some((e) => /non-official/.test(e)))
-})