dsh-standards 1.2.1 → 1.3.0

package/docs/assets/dsh-standards-flow-v3-light.svg

@@ -0,0 +1,87 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards pipeline">
+<defs>
+  <linearGradient id="lineGrad" x1="0" y1="0" x2="1" y2="0">
+    <stop offset="0" stop-color="#4B67B4" stop-opacity=".15"/>
+    <stop offset=".5" stop-color="#4B67B4" stop-opacity=".9"/>
+    <stop offset="1" stop-color="#4B67B4" stop-opacity=".15"/>
+  </linearGradient>
+  <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
+    <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.10"/>
+  </filter>
+  <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
+    <circle cx="1.3" cy="1.3" r="1.3" fill="#f2f0f8"/>
+  </pattern>
+</defs>
+<rect width="1100" height="660" fill="#ffffff"/>
+<rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
+<text x="50" y="62" fill="#141419" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
+<text x="50" y="90" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">static checks, runtime measurement, one reproducible report</text>
+<rect x="50" y="108" width="1000" height="1.6" rx="1" fill="#e6e3f0"/>
+<g filter="url(#soft)">
+  <rect x="50" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
+</g>
+<circle cx="74" cy="214" r="12" fill="#ece7f9"/>
+<text x="74" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">01</text>
+<text x="138.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">plugin dir</text>
+<text x="138.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">the repository</text>
+<path d="M231 249.0 C241.0 249.0, 241.0 249.0, 251 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
+<path d="M241 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#soft)">
+  <rect x="256" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#4B67B4" stroke-width="2.6"/>
+</g>
+<circle cx="280" cy="214" r="12" fill="#ece7f9"/>
+<text x="280" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">02</text>
+<text x="344.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">DSC-01…13</text>
+<text x="344.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">static checks</text>
+<path d="M437 249.0 C447.0 249.0, 447.0 249.0, 457 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
+<path d="M447 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#soft)">
+  <rect x="462" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
+</g>
+<circle cx="486" cy="214" r="12" fill="#ece7f9"/>
+<text x="486" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">03</text>
+<text x="550.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">L1–L3</text>
+<text x="550.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime measurement</text>
+<path d="M643 249.0 C653.0 249.0, 653.0 249.0, 663 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
+<path d="M653 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#soft)">
+  <rect x="668" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
+</g>
+<circle cx="692" cy="214" r="12" fill="#ece7f9"/>
+<text x="692" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">04</text>
+<text x="756.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">report</text>
+<text x="756.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">text / json / sarif</text>
+<path d="M849 249.0 C859.0 249.0, 859.0 249.0, 869 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
+<path d="M859 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
+<g filter="url(#soft)">
+  <rect x="874" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#16a34a" stroke-width="2.6"/>
+</g>
+<circle cx="898" cy="214" r="12" fill="#ece7f9"/>
+<text x="898" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">05</text>
+<text x="962.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">dsh-levels</text>
+<text x="962.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">ENTRY/FLOW/BOOST</text>
+<g filter="url(#soft)">
+  <rect x="462" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#16a34a" stroke-width="1.2"/>
+</g>
+<text x="486" y="404" fill="#16a34a" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
+<text x="486" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit pass</text>
+<g filter="url(#soft)">
+  <rect x="592" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
+</g>
+<text x="616" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
+<text x="616" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit fail</text>
+<g filter="url(#soft)">
+  <rect x="722" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
+</g>
+<text x="746" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
+<text x="746" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit config</text>
+<g filter="url(#soft)">
+  <rect x="852" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
+</g>
+<text x="876" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
+<text x="876" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit runtime</text>
+<rect x="50" y="476" width="1000" height="58" rx="15" fill="#fcfcfe" stroke="#e6e3f0"/>
+<text x="74" y="502" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">static ≠ runtime</text>
+<text x="74" y="522" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13">a static pass never substitutes for a runtime run; not-run is reported, never upgraded to PASS</text>
+<text x="50" y="596" fill="#4d5261" font-family="ui-monospace, monospace" font-size="13">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
+</svg>

package/docs/assets/dsh-standards-flow-v4-dark.svg

@@ -0,0 +1,79 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards dual-channel funnel">
+<defs>
+  <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
+    <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.55"/>
+  </filter>
+  <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
+    <circle cx="1.3" cy="1.3" r="1.3" fill="#182031"/>
+  </pattern>
+  <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+    <path d="M0 0 L10 5 L0 10 z" fill="#8496f5"/>
+  </marker>
+</defs>
+<rect width="1100" height="660" fill="#0d1117"/>
+<rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
+<text x="50" y="58" fill="#f0f3f9" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
+<text x="50" y="86" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">two channels, one report · static never pretends to be runtime</text>
+<rect x="42" y="118" width="292" height="366" rx="20" fill="#121824" stroke="#2a3142"/>
+<text x="62" y="146" fill="#8496f5" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">STATIC · DSC-01...13</text>
+<rect x="348" y="118" width="292" height="366" rx="20" fill="#121824" stroke="#2a3142"/>
+<text x="368" y="146" fill="#3fb950" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">RUNTIME · L1-L3</text>
+
+<rect x="58" y="168" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="78" cy="199" r="8" fill="#8496f5"/>
+<text x="96" y="194" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">contract</text>
+<text x="96" y="214" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cordis.patch.yml</text>
+<rect x="58" y="244" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="78" cy="275" r="8" fill="#8496f5"/>
+<text x="96" y="270" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">manifest</text>
+<text x="96" y="290" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">package.json</text>
+<rect x="58" y="320" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="78" cy="351" r="8" fill="#8496f5"/>
+<text x="96" y="346" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">layout</text>
+<text x="96" y="366" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">files + imports</text>
+<rect x="58" y="396" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="78" cy="427" r="8" fill="#8496f5"/>
+<text x="96" y="422" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">docs</text>
+<text x="96" y="442" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">README + topics</text>
+<rect x="364" y="168" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="384" cy="199" r="8" fill="#3fb950"/>
+<text x="402" y="194" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">install</text>
+<text x="402" y="214" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cold profile</text>
+<rect x="364" y="244" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="384" cy="275" r="8" fill="#3fb950"/>
+<text x="402" y="270" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">smoke</text>
+<text x="402" y="290" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">agent step</text>
+<rect x="364" y="320" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="384" cy="351" r="8" fill="#3fb950"/>
+<text x="402" y="346" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">perf</text>
+<text x="402" y="366" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">p50 / p99</text>
+<rect x="364" y="396" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
+<circle cx="384" cy="427" r="8" fill="#3fb950"/>
+<text x="402" y="422" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">evidence</text>
+<text x="402" y="442" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">reproducible</text>
+<path d="M188 484 V504 H672" stroke="#8496f5" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
+<path d="M494 484 V496 H672" stroke="#3fb950" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
+<rect x="680" y="380" width="176" height="120" rx="18" fill="#161b26" stroke="#8496f5" stroke-width="2.2" filter="url(#soft)"/>
+<text x="700" y="408" fill="#8496f5" font-family="ui-monospace, monospace" font-size="13" font-weight="700">report</text>
+<text x="700" y="436" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">text</text>
+<text x="700" y="458" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">json</text>
+<text x="700" y="480" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">sarif</text>
+<path d="M856 440 H904" stroke="#8496f5" stroke-width="2.4" fill="none" marker-end="url(#arr)"/>
+<text x="920" y="218" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13" font-weight="700">EXIT</text>
+<rect x="920" y="240" width="120" height="46" rx="12" fill="#161b26" stroke="#3fb950" stroke-width="1.5"/>
+<text x="938" y="269" fill="#3fb950" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
+<text x="962" y="269" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">pass</text>
+<rect x="920" y="298" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
+<text x="938" y="327" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
+<text x="962" y="327" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">fail</text>
+<rect x="920" y="356" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
+<text x="938" y="385" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
+<text x="962" y="385" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">config</text>
+<rect x="920" y="414" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
+<text x="938" y="443" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
+<text x="962" y="443" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime</text>
+<text x="680" y="540" fill="#8496f5" font-family="ui-monospace, monospace" font-size="13" font-weight="700">ENTRY / FLOW / BOOST</text>
+<text x="680" y="562" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">dsh-levels: depth of adoption</text>
+
+<text x="50" y="618" fill="#a8b1c4" font-family="ui-monospace, monospace" font-size="12.5">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
+</svg>

package/docs/assets/dsh-standards-flow-v4-light.svg

@@ -0,0 +1,79 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards dual-channel funnel">
+<defs>
+  <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
+    <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.10"/>
+  </filter>
+  <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
+    <circle cx="1.3" cy="1.3" r="1.3" fill="#f2f0f8"/>
+  </pattern>
+  <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+    <path d="M0 0 L10 5 L0 10 z" fill="#4B67B4"/>
+  </marker>
+</defs>
+<rect width="1100" height="660" fill="#ffffff"/>
+<rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
+<text x="50" y="58" fill="#141419" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
+<text x="50" y="86" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">two channels, one report · static never pretends to be runtime</text>
+<rect x="42" y="118" width="292" height="366" rx="20" fill="#f7f5fc" stroke="#e6e3f0"/>
+<text x="62" y="146" fill="#4B67B4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">STATIC · DSC-01...13</text>
+<rect x="348" y="118" width="292" height="366" rx="20" fill="#f7f5fc" stroke="#e6e3f0"/>
+<text x="368" y="146" fill="#16a34a" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">RUNTIME · L1-L3</text>
+
+<rect x="58" y="168" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="78" cy="199" r="8" fill="#4B67B4"/>
+<text x="96" y="194" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">contract</text>
+<text x="96" y="214" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cordis.patch.yml</text>
+<rect x="58" y="244" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="78" cy="275" r="8" fill="#4B67B4"/>
+<text x="96" y="270" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">manifest</text>
+<text x="96" y="290" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">package.json</text>
+<rect x="58" y="320" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="78" cy="351" r="8" fill="#4B67B4"/>
+<text x="96" y="346" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">layout</text>
+<text x="96" y="366" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">files + imports</text>
+<rect x="58" y="396" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="78" cy="427" r="8" fill="#4B67B4"/>
+<text x="96" y="422" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">docs</text>
+<text x="96" y="442" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">README + topics</text>
+<rect x="364" y="168" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="384" cy="199" r="8" fill="#16a34a"/>
+<text x="402" y="194" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">install</text>
+<text x="402" y="214" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cold profile</text>
+<rect x="364" y="244" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="384" cy="275" r="8" fill="#16a34a"/>
+<text x="402" y="270" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">smoke</text>
+<text x="402" y="290" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">agent step</text>
+<rect x="364" y="320" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="384" cy="351" r="8" fill="#16a34a"/>
+<text x="402" y="346" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">perf</text>
+<text x="402" y="366" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">p50 / p99</text>
+<rect x="364" y="396" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
+<circle cx="384" cy="427" r="8" fill="#16a34a"/>
+<text x="402" y="422" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">evidence</text>
+<text x="402" y="442" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">reproducible</text>
+<path d="M188 484 V504 H672" stroke="#4B67B4" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
+<path d="M494 484 V496 H672" stroke="#16a34a" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
+<rect x="680" y="380" width="176" height="120" rx="18" fill="#ffffff" stroke="#4B67B4" stroke-width="2.2" filter="url(#soft)"/>
+<text x="700" y="408" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">report</text>
+<text x="700" y="436" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">text</text>
+<text x="700" y="458" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">json</text>
+<text x="700" y="480" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">sarif</text>
+<path d="M856 440 H904" stroke="#4B67B4" stroke-width="2.4" fill="none" marker-end="url(#arr)"/>
+<text x="920" y="218" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13" font-weight="700">EXIT</text>
+<rect x="920" y="240" width="120" height="46" rx="12" fill="#ffffff" stroke="#16a34a" stroke-width="1.5"/>
+<text x="938" y="269" fill="#16a34a" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
+<text x="962" y="269" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">pass</text>
+<rect x="920" y="298" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
+<text x="938" y="327" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
+<text x="962" y="327" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">fail</text>
+<rect x="920" y="356" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
+<text x="938" y="385" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
+<text x="962" y="385" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">config</text>
+<rect x="920" y="414" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
+<text x="938" y="443" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
+<text x="962" y="443" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime</text>
+<text x="680" y="540" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">ENTRY / FLOW / BOOST</text>
+<text x="680" y="562" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">dsh-levels: depth of adoption</text>
+
+<text x="50" y="618" fill="#4d5261" font-family="ui-monospace, monospace" font-size="12.5">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
+</svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",
@@ -33,7 +33,7 @@
     "NOTICE"
   ],
   "scripts": {
-    "test": "node --test 40-checker/test/*.test.mjs",
+    "test": "node 40-checker/scripts/run-tests.mjs",
     "test:fixtures": "node bin/dsh-standards.mjs 40-checker/fixtures/good --scope entry --entry-claim static --format text"
   },
   "engines": {

package/spec/README.md

@@ -16,6 +16,7 @@ Machine-readable:
 - [reference-suite.json](reference-suite.json) — versioned samples, anchors, change rules.
 - [remediation.json](remediation.json) — 68-key advice table for the additive `advice[]` report field (docs anchors + severity hints).
 - [schemas/evidence.schema.json](schemas/evidence.schema.json) — `dsh-levels/1` record.
+- [schemas/advice.schema.json](schemas/advice.schema.json) — `dsh-advice/1` entry array: the additive `advice[]` field of a `dsh-conformance/1` report (13 required fields; `why`/`fix`/`docsUrl` may be null; `evidence` ≤ 10; `gate`/`severity` ∈ {FAIL,WARN}).
 - [flow-evidence.schema.json](flow-evidence.schema.json) — `dsh-flow-evidence/2` FLOW chain (J1–J8 checks, subject/host binding, `evidenceHash`). v1 and bare `{Jx:{status}}` rows are deprecated and never count as a pass.
 - [schemas/attestation.schema.json](schemas/attestation.schema.json) — `dsh-attestation/1` quality record.
 - [schemas/report.schema.json](schemas/report.schema.json) — `dsh-report/1` inspection report (no grade).
@@ -26,4 +27,5 @@ Rules:
 
 - Levels depend on `common` only; do not import each other.
 - A level is not a certification, badge, grade, or score.
+- CI attribution (`producer.runUrl`/`repository`/`commit`) is read from the runner environment and is self-declared: **CI 归属 ≠ 证明**. It never upgrades `claims.claimLevel`, and `level-audit` reports it only as `attestation: ci | self-declared`.
 - `dsh-standard` is an alias; `dsh-standards` is canonical.

package/spec/flow/README.md

@@ -9,6 +9,9 @@ uninstall, diagnostics, client/server states.
   are static preflight or manual and never count as a runtime pass.
 - Evidence: `dsh-flow-evidence/2` ([../flow-evidence.schema.json](../flow-evidence.schema.json)).
   Collect it with `node 40-checker/bin/dsh-flow-collect.mjs --package <dir> --out flow-evidence.json`.
+  Use `--sandbox` (or `dsh-levels flow sandbox`) to run the runtime probe under
+  `unshare` (network), `prlimit` (nproc/as) and a process-group timeout that
+  kills the whole tree with an allowlisted, token-free environment.
 
 ## Evidence chain rules
 
@@ -21,13 +24,23 @@ uninstall, diagnostics, client/server states.
   `static` and `not-run` never count toward 8/8.
 - `static` preflight is not runtime: a static PASS is a preflight result only.
 - The collector copies the package to a temp dir, runs against the copy, and
-  records `subject.treeSha256` before/after; a changed tree fails the run.
+  records `subject.treeSha256` before/after. A changed tree
+  (`treeStable: false` or a differing `treeSha256After`) is structurally
+  invalid, not just a warning.
 - Child environments are built from an allowlist; tokens/keys/secrets never
-  reach the inspected plugin.
+  reach the inspected plugin. The sandbox mode additionally asserts that
+  `GH_TOKEN`, `NPM_TOKEN` and `GITHUB_TOKEN` are absent and aborts if one
+  survives.
 - `claims.claimLevel` is `self-attested` for a local collector run,
-  `ci-attested` with `--ci`. Neither is `verified`, a certification, or a
-  security audit; only a sandbox run may be described as runtime-attested.
+  `ci-attested` with `--ci`, and `sandbox-attested` only for `--sandbox` when
+  every isolation item is effective. None of them is a certification or a
+  security audit.
+- `producer.kind` is `sandbox` only when the sandbox report has an empty
+  `degraded` list. Any missing item (`unshare-missing`, `prlimit-missing`,
+  `env-token-present`, `home-not-isolated`) switches it to `sandbox-degraded`;
+  that document remains structurally valid but is never FLOW runtime.
 - `level-audit.mjs` reports FLOW `runtime` only when `claims.claimLevel` is
   `sandbox-attested` or `producer.kind` is `sandbox`. A `self-attested`/
-  `ci-attested` document keeps its `passed` count but is reported `not-run`;
-  structural validation cannot prove where the commands ran.
+  `ci-attested`/`sandbox-degraded` document keeps its `passed` count but is
+  reported `not-run` (or its honest fail/blocked state), with the degraded
+  reasons in the audit reason.

package/spec/flow-evidence.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/PerryLink/dsh-standards/spec/flow-evidence.schema.json",
   "title": "DSH FLOW evidence chain",
-  "description": "One collected FLOW result (J1-J8) bound to a package, a host, a timestamp, and a chain hash. Structural validation only: it does not prove the commands really ran. v1 (dsh-flow-journey/1, dsh-flow-runtime/1) and bare {Jx:{status}} documents are deprecated and never count as a pass. `level-audit.mjs --flow-evidence` accepts this document only, and reports `runtime` only when `claims.claimLevel` is `sandbox-attested` or `producer.kind` is `sandbox`; self-attested/ci-attested keeps its pass count but stays not-run.",
+  "description": "One collected FLOW result (J1-J8) bound to a package, a host, a timestamp, and a chain hash. Structural validation only: it does not prove the commands really ran. v1 (dsh-flow-journey/1, dsh-flow-runtime/1) and bare {Jx:{status}} documents are deprecated and never count as a pass. `level-audit.mjs --flow-evidence` accepts this document only, and reports `runtime` only when `claims.claimLevel` is `sandbox-attested` or `producer.kind` is `sandbox`; `sandbox-degraded` (any isolation item missing) and self-attested/ci-attested keep their pass count but stay not-run.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -29,7 +29,7 @@
     },
     "producer": {
       "type": "object",
-      "description": "Who collected the evidence. `kind: sandbox` is the producer-side equivalent of `claims.claimLevel: sandbox-attested` and is one of the two ways a document may be reported as FLOW runtime.",
+      "description": "Who collected the evidence. `kind: sandbox` is the producer-side equivalent of `claims.claimLevel: sandbox-attested` and is one of the two ways a document may be reported as FLOW runtime. `provider`/`runId`/`repository`/`commit`/`runUrl` are copied from the runner environment (GITHUB_*) and are self-declared: CI attribution is not proof that the commands ran.",
       "additionalProperties": false,
       "required": ["command", "at"],
       "properties": {
@@ -43,12 +43,16 @@
           "format": "date-time"
         },
         "kind": {
-          "enum": ["local", "ci", "sandbox"],
-          "description": "`local`/`ci` are structural evidence only; `sandbox` may count toward FLOW runtime."
+          "enum": ["local", "ci", "sandbox", "sandbox-degraded"],
+          "description": "`local`/`ci` are structural evidence only; `sandbox` (every isolation item effective) may count toward FLOW runtime; `sandbox-degraded` never does."
         },
         "runner": { "type": "string" },
         "actor": { "type": "string" },
-        "runUrl": { "type": "string" }
+        "runUrl": { "type": "string", "description": "CI run URL. Self-declared, display-only." },
+        "provider": { "type": "string", "description": "CI provider id (for example github-actions). Self-declared." },
+        "runId": { "type": "string", "description": "CI run id (GITHUB_RUN_ID). Self-declared." },
+        "repository": { "type": "string", "description": "CI repository (GITHUB_REPOSITORY). Self-declared." },
+        "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$", "description": "CI commit (GITHUB_SHA). Self-declared." }
       }
     },
     "subject": {
@@ -108,6 +112,72 @@
         "platform": { "type": "string", "minLength": 1 }
       }
     },
+    "sandbox": {
+      "type": "object",
+      "description": "Containment report from `flow collect --sandbox`. `mode` is `sandbox` only when every isolation item (env allowlist + token assertion, temporary HOME/DSH_HOME, network namespace, prlimit nproc/as, process-group tree kill) is effective. `producer.kind=sandbox` requires mode=sandbox and an empty `degraded` list.",
+      "required": ["mode", "degraded"],
+      "properties": {
+        "schema": { "const": "dsh-sandbox-report/1" },
+        "mode": { "enum": ["sandbox", "sandbox-degraded"] },
+        "degraded": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Missing isolation items, e.g. unshare-missing, prlimit-missing, env-token-present, home-not-isolated."
+        },
+        "platform": { "type": "string" },
+        "env": {
+          "type": "object",
+          "properties": {
+            "policy": { "type": "string" },
+            "checked": { "type": "array", "items": { "type": "string" } },
+            "absent": { "type": "boolean" },
+            "offenders": { "type": "array", "items": { "type": "string" } }
+          }
+        },
+        "home": {
+          "type": "object",
+          "properties": {
+            "isolated": { "type": "boolean" },
+            "mode": { "type": "string" }
+          }
+        },
+        "network": {
+          "type": "object",
+          "properties": {
+            "isolated": { "type": "boolean" },
+            "mechanism": { "type": "string" },
+            "reason": { "type": "string" },
+            "bin": { "type": "string" },
+            "args": { "type": "array", "items": { "type": "string" } },
+            "probe": { "type": "object" },
+            "attempts": { "type": "array", "items": { "type": "object" } }
+          }
+        },
+        "limits": {
+          "type": "object",
+          "properties": {
+            "available": { "type": "boolean" },
+            "bin": { "type": "string" },
+            "nproc": { "type": "integer", "minimum": 2 },
+            "asBytes": { "type": "integer", "minimum": 67108864 },
+            "applied": { "type": "array", "items": { "type": "string" } },
+            "observed": { "type": "object" },
+            "probe": { "type": "object" },
+            "reason": { "type": "string" }
+          }
+        },
+        "processTreeKill": {
+          "type": "object",
+          "properties": {
+            "available": { "type": "boolean" },
+            "mechanism": { "type": "string" }
+          }
+        },
+        "executed": { "type": "boolean", "description": "True when the sandboxed runtime probe actually ran." },
+        "execution": { "type": "object", "description": "Command, exit code, timeout/kill outcome, and process-tree clearing proof." },
+        "note": { "type": "string" }
+      }
+    },
     "journeys": {
       "type": "object",
       "additionalProperties": false,
@@ -118,7 +188,7 @@
     },
     "claims": {
       "type": "object",
-      "description": "Attestation level of this evidence. Passing journeys are not runtime by themselves: `level-audit` may report `runtime` only when `claimLevel` is `sandbox-attested` (or `producer.kind` is `sandbox`). `self-attested` (local collector) and `ci-attested` (`--ci`) keep their `passed` count but are reported `not-run`, because structural validation cannot prove the commands ran, let alone in a sandbox.",
+      "description": "Attestation level of this evidence. Passing journeys are not runtime by themselves: `level-audit` may report `runtime` only when `claimLevel` is `sandbox-attested` (or `producer.kind` is `sandbox`). `self-attested` (local collector), `ci-attested` (`--ci`), and every `sandbox-degraded` document keep their `passed` count but are reported `not-run`, because structural validation cannot prove the commands ran, let alone in a fully isolated sandbox.",
       "additionalProperties": false,
       "required": ["claimLevel"],
       "properties": {

package/spec/schemas/advice.schema.json

@@ -0,0 +1,92 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/PerryLink/dsh-standards/spec/schemas/advice.schema.json",
+  "title": "DSH advice entry array (dsh-advice/1)",
+  "description": "The additive `advice[]` field of a dsh-conformance/1 report. One entry per (check, key) finding; advice never changes the verdict. 13 fields are required; `ruleMissing` is an optional diagnostic emitted when spec/remediation.json has no rule for a key. `version` is the producing package version, not this schema version.",
+  "type": "array",
+  "items": {
+    "type": "object",
+    "additionalProperties": false,
+    "required": [
+      "key",
+      "gate",
+      "severity",
+      "title",
+      "why",
+      "fix",
+      "docsUrl",
+      "source",
+      "version",
+      "evidence",
+      "reason",
+      "occurrences",
+      "advisory"
+    ],
+    "properties": {
+      "key": {
+        "type": "string",
+        "minLength": 1,
+        "description": "Clause or gate key the advice is attached to (for example C-2.2)."
+      },
+      "gate": {
+        "enum": ["FAIL", "WARN"],
+        "description": "Result of the owning check after report adjustments."
+      },
+      "severity": {
+        "enum": ["FAIL", "WARN"],
+        "description": "Rendered severity; follows `gate` in dsh-advice/1."
+      },
+      "title": {
+        "type": "string",
+        "minLength": 1,
+        "description": "Short human title; falls back to the key when the rule table has no title."
+      },
+      "why": {
+        "type": ["string", "null"],
+        "description": "Why the finding matters; null when the rule table has no explanation."
+      },
+      "fix": {
+        "type": ["string", "null"],
+        "description": "Concrete remediation; null when the rule table has no fix."
+      },
+      "docsUrl": {
+        "type": ["string", "null"],
+        "format": "uri",
+        "description": "Release-pinned documentation URL; null when the rule has no docs anchor."
+      },
+      "source": {
+        "type": "string",
+        "minLength": 1,
+        "description": "Check id that produced the finding (DSC-xx)."
+      },
+      "version": {
+        "type": "string",
+        "minLength": 1,
+        "description": "Version of the producing package (dsh-standards)."
+      },
+      "evidence": {
+        "type": "array",
+        "maxItems": 10,
+        "items": { "type": "string" },
+        "description": "Up to 10 deduplicated evidence references."
+      },
+      "reason": {
+        "type": "string",
+        "description": "Diagnostic reason(s); may be empty. Not used for the verdict."
+      },
+      "occurrences": {
+        "type": "integer",
+        "minimum": 1,
+        "description": "How many duplicate details were merged into this entry."
+      },
+      "advisory": {
+        "type": "boolean",
+        "description": "True when the owning check is advisory and never moves the verdict."
+      },
+      "ruleMissing": {
+        "type": "boolean",
+        "description": "Optional diagnostic: spec/remediation.json has no rule for `key`."
+      }
+    }
+  }
+}