dsh-standards 1.2.0 → 1.2.1

package/40-checker/test/entry-validate.test.mjs

@@ -1,172 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-import fs from 'node:fs'
-import os from 'node:os'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SCRIPT = path.join(STD, '40-checker', 'scripts', 'entry-validate.mjs')
-const FIXTURES = path.join(STD, 'adoption', 'entry', 'fixtures')
-
-function run(name, withMeta = true) {
-  const dir = path.join(FIXTURES, name)
-  const args = [SCRIPT, dir, '--json']
-  const meta = path.join(dir, 'meta.json')
-  if (withMeta && fs.existsSync(meta)) args.push('--meta', meta)
-  return spawnSync(process.execPath, args, { encoding: 'utf8', timeout: 30_000 })
-}
-
-function result(name, withMeta = true) {
-  const out = run(name, withMeta)
-  assert.ok(out.stdout, out.stderr)
-  return { out, json: JSON.parse(out.stdout) }
-}
-
-test('entry-validate: the good fixture passes C1-C8', () => {
-  const { out, json } = result('good')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.conclusion.status, 'pass')
-  assert.deepEqual(json.conclusion.failed, [])
-  assert.deepEqual(json.conclusion.notRun, [])
-})
-
-test('entry-validate: missing meta is incomplete, never a pass', () => {
-  const { out, json } = result('no-meta', false)
-  assert.equal(out.status, 3)
-  assert.equal(json.conclusion.status, 'incomplete')
-  assert.ok(json.conclusion.notRun.includes('C1'))
-  assert.ok(json.conclusion.notRun.includes('C7'))
-})
-
-const failures = [
-  ['client-only', 'C2'],
-  ['missing-patch', 'C2'],
-  ['engines-star', 'C4'],
-  ['client-no-export', 'C5'],
-  ['no-metadata', 'C6'],
-  ['no-version', 'C7'],
-  ['forbidden-label', 'C8'],
-]
-
-for (const [name, id] of failures) {
-  test(`entry-validate: ${name} fails ${id}`, () => {
-    const { out, json } = result(name)
-    assert.equal(out.status, 2, out.stderr)
-    assert.equal(json.conclusion.status, 'fail')
-    assert.ok(json.conclusion.failed.includes(id), JSON.stringify(json.conclusion))
-  })
-}
-
-test('entry-validate: a peer range is an accepted C4 source', () => {
-  const { out, json } = result('peer-ok')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.checks.find(row => row.id === 'C4').status, 'pass')
-})
-
-test('entry-validate: a declared but uncommitted build output is a warning, not a fail', () => {
-  const { out, json } = result('build-output')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.conclusion.status, 'pass-with-warnings')
-  assert.ok(json.conclusion.warnings.includes('C5'))
-  assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
-  assert.deepEqual(json.conclusion.failed, [])
-})
-
-test('entry-validate: an ordered dsh.bundle.patch list is accepted', () => {
-  const { out, json } = result('patch-list')
-  assert.equal(out.status, 0, out.stderr)
-  assert.equal(json.checks.find(row => row.id === 'C2').status, 'pass')
-  assert.equal(json.conclusion.status, 'pass')
-})
-
-function hostEvidence(status) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-entry-host-'))
-  const file = path.join(dir, 'host.json')
-  fs.writeFileSync(file, JSON.stringify({
-    status,
-    command: 'dsh plugin --profile test add @dsh-fixtures/entry-good',
-    host: 'dsh 0.2.2-alpha.2 / cordis 4.0.6-alpha.1',
-    evidence: 'https://example.invalid/host-install/1',
-    generatedAt: '2026-11-02',
-  }))
-  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
-}
-
-test('entry-validate: a passed host install upgrades C3 to pass', () => {
-  const h = hostEvidence('pass')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'pass')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a failed host install fails C3', () => {
-  const h = hostEvidence('fail')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 2)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'fail')
-    assert.ok(json.conclusion.failed.includes('C3'))
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a blocked host install is incomplete, not a pass', () => {
-  const h = hostEvidence('blocked')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 3)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'blocked')
-    assert.ok(json.conclusion.blocked.includes('C3'))
-    assert.equal(json.conclusion.status, 'incomplete')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: C3 is flow-only when no host evidence is supplied', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c3-flow-'))
-  try {
-    const meta = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'good', 'meta.json'), 'utf8'))
-    delete meta.installCommand
-    const metaFile = path.join(dir, 'meta.json')
-    fs.writeFileSync(metaFile, JSON.stringify(meta))
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', metaFile], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('entry-validate: host evidence can mark C3 not-applicable for a host/directory sample', () => {
-  const h = hostEvidence('not-applicable')
-  try {
-    const out = spawnSync(process.execPath, [SCRIPT, path.join(FIXTURES, 'good'), '--json', '--meta', path.join(FIXTURES, 'good', 'meta.json'), '--host-evidence', h.file], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C3').status, 'not-applicable')
-    assert.equal(json.conclusion.status, 'pass')
-  } finally { h.cleanup() }
-})
-
-test('entry-validate: a missing license is A7 advisory, not a C6 fail', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-c6-license-'))
-  try {
-    const src = path.join(FIXTURES, 'good')
-    for (const name of ['index.js', 'client.js', 'cordis.patch.yml', 'meta.json']) fs.copyFileSync(path.join(src, name), path.join(dir, name))
-    const pkg = JSON.parse(fs.readFileSync(path.join(src, 'package.json'), 'utf8'))
-    delete pkg.license
-    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(pkg))
-    const out = spawnSync(process.execPath, [SCRIPT, dir, '--json', '--meta', path.join(dir, 'meta.json')], { encoding: 'utf8', timeout: 30_000 })
-    assert.equal(out.status, 0, out.stderr)
-    const json = JSON.parse(out.stdout)
-    assert.equal(json.checks.find(row => row.id === 'C6').status, 'pass')
-    assert.ok(json.advisories.some(row => row.id === 'A7'))
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})

package/40-checker/test/flow-evidence.test.mjs

@@ -1,295 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import {
-  FLOW_IDS, evidenceHash, finalizeEvidence, journeyAggregate, treeSha256, validateFlowEvidence,
-} from '../src/flow-evidence.mjs'
-import { isSecretEnvName, sanitizedEnv } from '../src/sandbox-env.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const AUDIT = path.join(STD, '40-checker', 'scripts', 'level-audit.mjs')
-const COLLECT = path.join(STD, '40-checker', 'bin', 'dsh-flow-collect.mjs')
-const GOOD = path.join(STD, '40-checker', 'fixtures', 'good')
-const TEMPLATE = path.join(STD, 'examples', 'plugin-template')
-const ISO = '2026-11-06T12:00:00.000Z'
-const HASH = `sha256:${'a'.repeat(64)}`
-
-function check(id, overrides = {}) {
-  return {
-    id,
-    kind: 'observed',
-    command: ['node', '-e', 'process.exit(0)'],
-    exitCode: 0,
-    startedAt: ISO,
-    endedAt: ISO,
-    stdout: { path: `logs/${id}.out.log`, sha256: HASH },
-    assertions: [{ claim: `${id} observed`, observed: true }],
-    ...overrides,
-  }
-}
-
-function evidenceDocument({ journeys = {}, subject, ...rest } = {}) {
-  const base = {
-    schema: 'dsh-flow-evidence/2',
-    generatedAt: ISO,
-    producer: { command: ['node', '40-checker/bin/dsh-flow-collect.mjs'], at: ISO, kind: 'local' },
-    subject: subject ?? {
-      name: '@dsh-fixtures/good-plugin',
-      version: '1.0.0',
-      integrity: null,
-      tarballSha256: HASH,
-      commit: null,
-      treeSha256: HASH,
-    },
-    host: { dsh: '0.2.1-rc.5', node: 'v24.22.1', platform: 'linux-x64' },
-    journeys: Object.fromEntries(FLOW_IDS.map((id) => [id, { status: 'pass', checks: [check(`${id}.run`)] }])),
-    claims: { claimLevel: 'self-attested', notClaimed: ['certification'] },
-    conclusion: 'flow-pass',
-    ...rest,
-  }
-  for (const [id, override] of Object.entries(journeys)) base.journeys[id] = override
-  return finalizeEvidence(base)
-}
-
-function writeTemp(name, value) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-evidence-test-'))
-  const file = path.join(dir, name)
-  fs.writeFileSync(file, typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`)
-  return { dir, file, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) }
-}
-
-function runAudit(flowFile) {
-  const run = spawnSync(process.execPath, [AUDIT, GOOD, '--format', 'json', '--flow-evidence', flowFile], {
-    encoding: 'utf8', timeout: 60_000,
-  })
-  assert.equal(run.status, 0, run.stderr)
-  return JSON.parse(run.stdout)
-}
-
-test('sandbox-env: inherited secrets are dropped and only allowlisted names survive', () => {
-  process.env.DSH_TEST_TOKEN = 'do-not-leak'
-  process.env.DSH_TEST_API_KEY = 'do-not-leak'
-  try {
-    const env = sanitizedEnv()
-    assert.equal(env.DSH_TEST_TOKEN, undefined)
-    assert.equal(env.DSH_TEST_API_KEY, undefined)
-    assert.equal(env.DSH_HOME, undefined)
-    assert.equal(env.PATH, process.env.PATH)
-    assert.equal(isSecretEnvName('GH_TOKEN'), true)
-    assert.equal(isSecretEnvName('DEEPSEEK_API_KEY'), true)
-    assert.equal(isSecretEnvName('PATH'), false)
-    assert.equal(sanitizedEnv({ DSH_HOME: '/tmp/isolated' }).DSH_HOME, '/tmp/isolated')
-  } finally {
-    delete process.env.DSH_TEST_TOKEN
-    delete process.env.DSH_TEST_API_KEY
-  }
-})
-
-test('flow-evidence: a well-formed v2 document validates and hashes consistently', () => {
-  const doc = evidenceDocument()
-  const verdict = validateFlowEvidence(doc)
-  assert.equal(verdict.kind, 'v2')
-  assert.equal(verdict.valid, true, verdict.errors.join('; '))
-  assert.equal(verdict.declaredHash, evidenceHash(doc))
-  assert.equal(verdict.journeys.J1.derived, 'pass')
-})
-
-test('level-audit: v1 journey/runtime schemas are deprecated and never a pass', () => {
-  const docs = [
-    { schema: 'dsh-flow-journey/1', package: '@dsh-fixtures/good-plugin', checks: [] },
-    { schema: 'dsh-flow-runtime/1', environment: {}, checks: [] },
-  ]
-  for (const doc of docs) {
-    const temp = writeTemp('v1.json', doc)
-    try {
-      const result = runAudit(temp.file)
-      assert.equal(result.levels.flow.state, 'deprecated')
-      assert.equal(result.levels.flow.deprecated, true)
-      assert.equal(result.levels.flow.passed, 0)
-      assert.notEqual(result.levels.flow.state, 'runtime')
-    } finally {
-      temp.cleanup()
-    }
-  }
-})
-
-test('level-audit: bare {Jx:{status:pass}} rows are deprecated and never a pass', () => {
-  const temp = writeTemp('bare.json', Object.fromEntries(FLOW_IDS.map(id => [id, { status: 'pass' }])))
-  try {
-    const result = runAudit(temp.file)
-    assert.equal(result.levels.flow.state, 'deprecated')
-    assert.equal(result.levels.flow.passed, 0)
-    assert.notEqual(result.levels.flow.state, 'runtime')
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: v2 with all eight journeys passing is runtime', () => {
-  const temp = writeTemp('v2-pass.json', evidenceDocument())
-  try {
-    const result = runAudit(temp.file)
-    assert.equal(result.levels.flow.state, 'runtime')
-    assert.equal(result.levels.flow.passed, 8)
-    assert.equal(result.levels.flow.evidenceHash.ok, true)
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: a forged v2 pass with a non-zero exitCode is not a pass', () => {
-  // Declared pass on every journey, but J4 carries exitCode 1: the aggregate
-  // contradicts the declaration, so the document must fail validation.
-  const doc = evidenceDocument({
-    journeys: { J4: { status: 'pass', checks: [check('J4.run', { exitCode: 1 })] } },
-  })
-  const temp = writeTemp('forged.json', doc)
-  try {
-    const result = runAudit(temp.file)
-    assert.notEqual(result.levels.flow.state, 'runtime')
-    assert.equal(result.levels.flow.passed, 0)
-    assert.equal(result.levels.flow.invalid, true)
-    assert.match(result.levels.flow.reason, /aggregate|exitCode|declares pass/i)
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: an honest v2 with one failed journey is failed, not runtime', () => {
-  const doc = evidenceDocument({
-    journeys: { J4: { status: 'fail', checks: [check('J4.run', { exitCode: 1 })] } },
-    conclusion: 'flow-fail',
-  })
-  const temp = writeTemp('failed.json', doc)
-  try {
-    const result = runAudit(temp.file)
-    assert.equal(result.levels.flow.state, 'failed')
-    assert.equal(result.levels.flow.passed, 7)
-    assert.equal(result.levels.flow.journeys.J4.status, 'fail')
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: a v2 journey without checks does not count as a pass', () => {
-  const doc = evidenceDocument({ journeys: { J5: { status: 'not-run', checks: [] } } })
-  const temp = writeTemp('empty.json', doc)
-  try {
-    const result = runAudit(temp.file)
-    assert.notEqual(result.levels.flow.state, 'runtime')
-    assert.equal(result.levels.flow.passed, 7)
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: a tampered evidence hash is invalid, not runtime', () => {
-  const doc = evidenceDocument()
-  doc.chain.evidenceHash = HASH
-  const temp = writeTemp('tampered.json', doc)
-  try {
-    const result = runAudit(temp.file)
-    assert.equal(result.levels.flow.state, 'invalid')
-    assert.equal(result.levels.flow.passed, 0)
-    assert.match(result.levels.flow.reason, /evidenceHash/)
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('level-audit: a declared blocked journey is blocked, not failed', () => {
-  const doc = evidenceDocument({
-    journeys: { J6: { status: 'blocked', reason: 'no --previous package supplied', checks: [check('J6.upgrade', { exitCode: 1 })] } },
-    conclusion: 'flow-blocked',
-  })
-  const temp = writeTemp('blocked.json', doc)
-  try {
-    const result = runAudit(temp.file)
-    assert.equal(result.levels.flow.state, 'blocked')
-    assert.equal(result.levels.flow.passed, 7)
-  } finally {
-    temp.cleanup()
-  }
-})
-
-test('flow-collect: static output is v2, validates, and the audit can read it', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-collect-test-'))
-  try {
-    const copy = path.join(dir, 'plugin')
-    fs.cpSync(TEMPLATE, copy, { recursive: true })
-    const out = path.join(dir, 'flow.json')
-    const run = spawnSync(process.execPath, [COLLECT, '--package', copy, '--static', '--out', out], {
-      encoding: 'utf8', timeout: 120_000,
-    })
-    assert.equal(run.status, 0, `${run.stderr}\n${run.stdout}`)
-    const doc = JSON.parse(fs.readFileSync(out, 'utf8'))
-    assert.equal(doc.schema, 'dsh-flow-evidence/2')
-    const verdict = validateFlowEvidence(doc)
-    assert.equal(verdict.valid, true, verdict.errors.join('; '))
-    assert.deepEqual(Object.keys(doc.journeys), FLOW_IDS)
-    assert.equal(doc.subject.treeStable, true)
-    assert.equal(doc.subject.treeSha256, treeSha256(TEMPLATE).hash)
-    assert.equal(doc.chain.evidenceHash, evidenceHash(doc))
-    assert.equal(journeyAggregate(doc.journeys.J1.checks), 'static')
-
-    // The audit consumes the collector output without upgrading it to runtime.
-    const audit = spawnSync(process.execPath, [AUDIT, copy, '--format', 'json', '--flow-evidence', out], {
-      encoding: 'utf8', timeout: 60_000,
-    })
-    assert.equal(audit.status, 0, audit.stderr)
-    const result = JSON.parse(audit.stdout)
-    assert.equal(result.levels.flow.schema, 'dsh-flow-evidence/2')
-    assert.notEqual(result.levels.flow.state, 'runtime')
-    assert.notEqual(result.levels.flow.state, 'invalid')
-    assert.notEqual(result.levels.flow.state, 'deprecated')
-    assert.equal(result.levels.flow.passed, 0)
-    assert.equal(result.levels.flow.evidenceHash.ok, true)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('flow-collect: a failed journey exits 1 and prints the five-element hint', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-flow-collect-fail-'))
-  try {
-    const plugin = path.join(dir, 'plugin')
-    fs.mkdirSync(plugin)
-    fs.writeFileSync(path.join(plugin, 'package.json'), `${JSON.stringify({
-      name: 'dsh-flow-bad-fixture', version: '1.0.0', type: 'module', main: './index.mjs',
-      files: ['index.mjs'], dependencies: { 'workspace-only': 'workspace:*' },
-    }, null, 2)}\n`)
-    fs.writeFileSync(path.join(plugin, 'index.mjs'), 'export function apply() {}\n')
-    const out = path.join(dir, 'flow.json')
-    const run = spawnSync(process.execPath, [COLLECT, '--package', plugin, '--static', '--out', out], {
-      encoding: 'utf8', timeout: 120_000,
-    })
-    assert.equal(run.status, 1, `${run.stderr}\n${run.stdout}`)
-    for (const marker of ['FAIL J1.install.preflight', '1) 子检查:', '2) 命令:', '3) exitCode:', '4) stderr(末20行):', '5) 日志:', '条款锚: 32#R1']) {
-      assert.ok(run.stdout.includes(marker), `missing hint marker ${marker}\n${run.stdout}`)
-    }
-    const doc = JSON.parse(fs.readFileSync(out, 'utf8'))
-    assert.equal(doc.journeys.J1.status, 'fail')
-    assert.equal(doc.conclusion, 'flow-fail')
-    assert.equal(validateFlowEvidence(doc).valid, true)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('flow-evidence: the published schema declares the validator contract', () => {
-  const schema = JSON.parse(fs.readFileSync(path.join(STD, 'spec', 'flow-evidence.schema.json'), 'utf8'))
-  assert.equal(schema.properties.schema.const, 'dsh-flow-evidence/2')
-  for (const key of ['schema', 'generatedAt', 'producer', 'subject', 'host', 'journeys', 'claims', 'chain']) {
-    assert.ok(schema.required.includes(key), `schema.required is missing ${key}`)
-  }
-  for (const id of FLOW_IDS) assert.ok(schema.properties.journeys.required.includes(id), `journeys.required is missing ${id}`)
-  for (const key of ['id', 'command', 'exitCode', 'startedAt', 'endedAt', 'stdout', 'assertions']) {
-    assert.ok(schema.$defs.check.required.includes(key), `check.required is missing ${key}`)
-  }
-  assert.ok(schema.$defs.journey.properties.checks)
-})

package/40-checker/test/governance.test.mjs

@@ -1,76 +0,0 @@
-import test from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { validateGovernance } from '../scripts/governance-check.mjs'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const ROOT = path.resolve(HERE, '..', '..')
-const read = (rel) => JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8'))
-
-function fixture() {
-  return {
-    roles: read('governance/roles.json'),
-    contributors: read('governance/contributors.json'),
-    reviewers: read('governance/reviewers.json'),
-    coi: read('governance/coi.json'),
-  }
-}
-
-test('governance: the checked-in files pass', () => {
-  const result = validateGovernance(fixture())
-  assert.deepEqual(result.errors, [])
-})
-
-test('governance: exactly one human organizer is required', () => {
-  const data = fixture()
-  data.roles.roles.organizer.bot = true
-  data.roles.roles.organizer.humanOnly = false
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /organizer must be humanOnly/.test(e)))
-})
-
-test('governance: AI must not decide spec semantics', () => {
-  const data = fixture()
-  data.roles.matrix['ai-steward']['spec.decide'] = 'allow'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /must not hold spec\.decide/.test(e)))
-})
-
-test('governance: AI merge must be allowlist-only', () => {
-  const data = fixture()
-  data.roles.matrix['ai-steward']['repo.merge.main'] = 'allow'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /allow-with-allowlist/.test(e)))
-})
-
-test('governance: class A approver must be human', () => {
-  const data = fixture()
-  data.roles.decisions.A.approver = ['ai-steward']
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /decision A approver/.test(e)))
-})
-
-test('governance: AI merge denylist protects spec and governance', () => {
-  const data = fixture()
-  data.roles.ai.mergeDenylist = ['spec/']
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /governance\//.test(e)))
-})
-
-test('governance: a contributor needs DCO and the current terms', () => {
-  const data = fixture()
-  data.contributors.contributors[0].signedOff = false
-  data.contributors.contributors[0].terms = 'dsh-ct/0'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /no DCO sign-off/.test(e)))
-  assert.ok(result.errors.some((e) => /terms mismatch/.test(e)))
-})
-
-test('governance: reviewer must reference a human role', () => {
-  const data = fixture()
-  data.reviewers.reviewers[0].role = 'ai-steward'
-  const result = validateGovernance(data)
-  assert.ok(result.errors.some((e) => /human role/.test(e)))
-})

package/40-checker/test/label.test.mjs

@@ -1,97 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import path from 'node:path'
-import fs from 'node:fs'
-import os from 'node:os'
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-const STD = path.resolve(HERE, '..', '..')
-const SYNC = path.join(STD, '40-checker', 'scripts', 'label-sync.mjs')
-const DRIFT = path.join(STD, '40-checker', 'scripts', 'label-drift.mjs')
-const VERIFY = path.join(STD, '40-checker', 'scripts', 'label-verify.mjs')
-const SAMPLE = path.join(STD, 'adoption', 'market', 'sample-source.json')
-
-function tempDir() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-label-test-'))
-}
-
-function run(script, args) {
-  return spawnSync(process.execPath, [script, ...args], { encoding: 'utf8', timeout: 30_000 })
-}
-
-test('label-sync: writes a valid index from the sample source', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    const sync = run(SYNC, ['--source', SAMPLE, '--out', out])
-    assert.equal(sync.status, 0, sync.stderr)
-    const index = JSON.parse(fs.readFileSync(path.join(out, 'index.json'), 'utf8'))
-    assert.equal(index.schema, 'dsh-label-index/1')
-    assert.equal(index.records.length, 1)
-    assert.match(index.records[0].recordHash, /^sha256:[0-9a-f]{64}$/)
-    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2026-11-02'])
-    assert.equal(drift.status, 0, drift.stdout + drift.stderr)
-    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', index.records[0].recordHash, '--json'])
-    assert.equal(verify.status, 0, verify.stderr)
-    const view = JSON.parse(verify.stdout)
-    assert.equal(view.ok, true)
-    assert.equal(view.claimLevel, 'reference')
-    assert.equal(Object.prototype.hasOwnProperty.call(view, 'grade'), false)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-drift: an expired label is stale and fails', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
-    const drift = run(DRIFT, ['--index', path.join(out, 'index.json'), '--now', '2028-01-01', '--json'])
-    assert.equal(drift.status, 1)
-    const result = JSON.parse(drift.stdout)
-    assert.equal(result.stale, 1)
-    assert.equal(result.ok, false)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-sync: a grade or a wrong hash is rejected', () => {
-  const dir = tempDir()
-  try {
-    const source = JSON.parse(fs.readFileSync(SAMPLE, 'utf8'))
-    const badGrade = structuredClone(source)
-    badGrade[0].grade = 'A'
-    const gradeFile = path.join(dir, 'bad-grade.json')
-    fs.writeFileSync(gradeFile, JSON.stringify(badGrade))
-    const grade = run(SYNC, ['--source', gradeFile, '--check'])
-    assert.equal(grade.status, 1)
-    assert.match(grade.stderr, /forbidden field: grade/)
-
-    const badHash = structuredClone(source)
-    badHash[0].recordHash = `sha256:${'0'.repeat(64)}`
-    const hashFile = path.join(dir, 'bad-hash.json')
-    fs.writeFileSync(hashFile, JSON.stringify(badHash))
-    const hash = run(SYNC, ['--source', hashFile, '--check'])
-    assert.equal(hash.status, 1)
-    assert.match(hash.stderr, /recordHash does not match/)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('label-verify: an unknown hash is a 404, not a fake pass', () => {
-  const dir = tempDir()
-  try {
-    const out = path.join(dir, 'labels')
-    assert.equal(run(SYNC, ['--source', SAMPLE, '--out', out]).status, 0)
-    const verify = run(VERIFY, ['--index', path.join(out, 'index.json'), '--hash', `sha256:${'f'.repeat(64)}`])
-    assert.equal(verify.status, 2)
-    assert.match(verify.stderr, /not found/)
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true })
-  }
-})