dsh-standards 1.2.2 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (46) hide show
  1. package/40-checker/README.md +18 -1
  2. package/40-checker/scripts/build-offline-kit.mjs +284 -0
  3. package/40-checker/scripts/build-sidecar.mjs +714 -0
  4. package/40-checker/scripts/flow-collect.mjs +7 -1
  5. package/40-checker/scripts/level-audit.mjs +45 -7
  6. package/40-checker/scripts/run-tests.mjs +3 -7
  7. package/40-checker/src/author-cli.mjs +406 -0
  8. package/40-checker/src/author-report.mjs +271 -0
  9. package/40-checker/src/bundle-static.mjs +181 -0
  10. package/40-checker/src/cli.mjs +100 -11
  11. package/40-checker/src/client-shape.mjs +33 -3
  12. package/40-checker/src/declarations.mjs +53 -8
  13. package/40-checker/src/flow-evidence.mjs +106 -1
  14. package/40-checker/src/index.mjs +6 -4
  15. package/40-checker/src/manifest.mjs +87 -14
  16. package/40-checker/src/remediation.mjs +108 -7
  17. package/40-checker/src/report.mjs +203 -26
  18. package/40-checker/src/semver.mjs +112 -65
  19. package/40-checker/src/util.mjs +51 -8
  20. package/CHANGELOG.md +44 -0
  21. package/README.en.md +7 -2
  22. package/README.es.md +7 -2
  23. package/README.hi.md +7 -2
  24. package/README.md +35 -18
  25. package/README.pt.md +7 -2
  26. package/bin/dsh-standards.mjs +13 -2
  27. package/docs/assets/dsh-standards-flow-v3-dark.svg +87 -0
  28. package/docs/assets/dsh-standards-flow-v3-light.svg +87 -0
  29. package/docs/assets/dsh-standards-flow-v4-dark.svg +79 -0
  30. package/docs/assets/dsh-standards-flow-v4-light.svg +79 -0
  31. package/docs/assets/dsh-standards-hero-en-dark.webp +0 -0
  32. package/docs/assets/dsh-standards-hero-en-light.webp +0 -0
  33. package/docs/assets/dsh-standards-hero-zh-dark.webp +0 -0
  34. package/docs/assets/dsh-standards-hero-zh-light.webp +0 -0
  35. package/docs/coverage.md +82 -0
  36. package/package.json +1 -1
  37. package/spec/README.md +2 -0
  38. package/spec/coverage-contract.md +100 -0
  39. package/spec/dsc-clauses.json +766 -0
  40. package/spec/examples/boost-card.example.json +15 -0
  41. package/spec/examples/flow-evidence.example.json +113 -0
  42. package/spec/flow-evidence.schema.json +6 -2
  43. package/spec/remediation.json +54 -54
  44. package/spec/schemas/advice.schema.json +92 -0
  45. package/spec/schemas/boost-card.schema.json +107 -0
  46. package/spec/schemas/conformance.schema.json +848 -0
package/README.pt.md CHANGED
@@ -1,8 +1,8 @@
1
1
  <div align="center">
2
2
 
3
3
  <picture>
4
- <source media="(prefers-color-scheme: dark)" srcset="docs/assets/dsh-standards-flow-dark.svg">
5
- <img src="docs/assets/dsh-standards-flow-light.svg" width="100%" alt="Fluxo do dsh-standards: diretório do plugin → dsh-standards (DSC-01…13 estáticas) → runtime L1–L3 → relatório (text/json/sarif, exit 0|1|2|3) → dsh-levels (ENTRY / FLOW / BOOST)">
4
+ <source media="(prefers-color-scheme: dark)" srcset="docs/assets/dsh-standards-hero-en-dark.webp">
5
+ <img src="docs/assets/dsh-standards-hero-en-light.webp" width="100%" alt="dsh-standards: DSC-01…13 static checks + L1–L3 runtime, reproducible reports">
6
6
  </picture>
7
7
 
8
8
  # dsh-standards
@@ -76,6 +76,11 @@ O índice completo de 51 documentos está no [README.md](README.md) em chinês.
76
76
 
77
77
  </details>
78
78
 
79
+ <picture>
80
+ <source media="(prefers-color-scheme: dark)" srcset="docs/assets/dsh-standards-flow-v4-dark.svg">
81
+ <img src="docs/assets/dsh-standards-flow-v4-light.svg" width="100%" alt="dsh-standards pipeline: plugin dir → DSC-01…13 → L1–L3 runtime → report → dsh-levels">
82
+ </picture>
83
+
79
84
  ## Instalação em três passos
80
85
 
81
86
  **1. Instalar** (duas opções; Node `>=24.9.0`):
package/bin/dsh-standards.mjs CHANGED
@@ -2,6 +2,9 @@
2
2
  // Public umbrella entry point for the DSH standards checker.
3
3
  // The implementation lives in 40-checker/; this shim keeps the package-level
4
4
  // command stable while the checker remains independently runnable from source.
5
+ //
6
+ // dsh-standards check [dir] author-facing Markdown / --json / --html report
7
+ // dsh-standards <dir> raw checker report (backwards compatible)
5
8
  import { readFileSync } from 'node:fs'
6
9
  import { fileURLToPath } from 'node:url'
7
10
  import { dirname, join } from 'node:path'
@@ -15,5 +18,13 @@ if (argv.includes('--version') || argv.includes('-v')) {
15
18
  process.exit(0)
16
19
  }
17
20
 
18
- process.env.DSH_CHECKER_BRAND = `dsh-standards ${pkg.version} (checker 0.1.0)`
19
- await import('../40-checker/bin/dsh-plugin-verify.mjs')
21
+ if (argv[0] === 'check') {
22
+ const { runCheck } = await import('../40-checker/src/author-cli.mjs')
23
+ const code = await runCheck(argv.slice(1))
24
+ process.exitCode = code
25
+ // The checker may have imported a plugin; do not let stray handles hang us.
26
+ setTimeout(() => process.exit(code), 250)
27
+ } else {
28
+ process.env.DSH_CHECKER_BRAND = `dsh-standards ${pkg.version} (checker 0.1.0)`
29
+ await import('../40-checker/bin/dsh-plugin-verify.mjs')
30
+ }
package/docs/assets/dsh-standards-flow-v3-dark.svg ADDED
@@ -0,0 +1,87 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards pipeline">
2
+ <defs>
3
+ <linearGradient id="lineGrad" x1="0" y1="0" x2="1" y2="0">
4
+ <stop offset="0" stop-color="#8496f5" stop-opacity=".15"/>
5
+ <stop offset=".5" stop-color="#8496f5" stop-opacity=".9"/>
6
+ <stop offset="1" stop-color="#8496f5" stop-opacity=".15"/>
7
+ </linearGradient>
8
+ <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
9
+ <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.55"/>
10
+ </filter>
11
+ <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
12
+ <circle cx="1.3" cy="1.3" r="1.3" fill="#182031"/>
13
+ </pattern>
14
+ </defs>
15
+ <rect width="1100" height="660" fill="#0d1117"/>
16
+ <rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
17
+ <text x="50" y="62" fill="#f0f3f9" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
18
+ <text x="50" y="90" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">static checks, runtime measurement, one reproducible report</text>
19
+ <rect x="50" y="108" width="1000" height="1.6" rx="1" fill="#2a3142"/>
20
+ <g filter="url(#soft)">
21
+ <rect x="50" y="190" width="176" height="118" rx="17" fill="#161b26" stroke="#2a3142" stroke-width="1.3"/>
22
+ </g>
23
+ <circle cx="74" cy="214" r="12" fill="#242d42"/>
24
+ <text x="74" y="219" text-anchor="middle" fill="#8496f5" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">01</text>
25
+ <text x="138.0" y="256" text-anchor="middle" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">plugin dir</text>
26
+ <text x="138.0" y="282" text-anchor="middle" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">the repository</text>
27
+ <path d="M231 249.0 C241.0 249.0, 241.0 249.0, 251 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
28
+ <path d="M241 244.0 l8 5 -8 5" fill="none" stroke="#8496f5" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
29
+ <g filter="url(#soft)">
30
+ <rect x="256" y="190" width="176" height="118" rx="17" fill="#161b26" stroke="#8496f5" stroke-width="2.6"/>
31
+ </g>
32
+ <circle cx="280" cy="214" r="12" fill="#242d42"/>
33
+ <text x="280" y="219" text-anchor="middle" fill="#8496f5" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">02</text>
34
+ <text x="344.0" y="256" text-anchor="middle" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">DSC-01…13</text>
35
+ <text x="344.0" y="282" text-anchor="middle" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">static checks</text>
36
+ <path d="M437 249.0 C447.0 249.0, 447.0 249.0, 457 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
37
+ <path d="M447 244.0 l8 5 -8 5" fill="none" stroke="#8496f5" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
38
+ <g filter="url(#soft)">
39
+ <rect x="462" y="190" width="176" height="118" rx="17" fill="#161b26" stroke="#2a3142" stroke-width="1.3"/>
40
+ </g>
41
+ <circle cx="486" cy="214" r="12" fill="#242d42"/>
42
+ <text x="486" y="219" text-anchor="middle" fill="#8496f5" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">03</text>
43
+ <text x="550.0" y="256" text-anchor="middle" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">L1–L3</text>
44
+ <text x="550.0" y="282" text-anchor="middle" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime measurement</text>
45
+ <path d="M643 249.0 C653.0 249.0, 653.0 249.0, 663 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
46
+ <path d="M653 244.0 l8 5 -8 5" fill="none" stroke="#8496f5" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
47
+ <g filter="url(#soft)">
48
+ <rect x="668" y="190" width="176" height="118" rx="17" fill="#161b26" stroke="#2a3142" stroke-width="1.3"/>
49
+ </g>
50
+ <circle cx="692" cy="214" r="12" fill="#242d42"/>
51
+ <text x="692" y="219" text-anchor="middle" fill="#8496f5" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">04</text>
52
+ <text x="756.0" y="256" text-anchor="middle" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">report</text>
53
+ <text x="756.0" y="282" text-anchor="middle" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">text / json / sarif</text>
54
+ <path d="M849 249.0 C859.0 249.0, 859.0 249.0, 869 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
55
+ <path d="M859 244.0 l8 5 -8 5" fill="none" stroke="#8496f5" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
56
+ <g filter="url(#soft)">
57
+ <rect x="874" y="190" width="176" height="118" rx="17" fill="#161b26" stroke="#3fb950" stroke-width="2.6"/>
58
+ </g>
59
+ <circle cx="898" cy="214" r="12" fill="#242d42"/>
60
+ <text x="898" y="219" text-anchor="middle" fill="#8496f5" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">05</text>
61
+ <text x="962.0" y="256" text-anchor="middle" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">dsh-levels</text>
62
+ <text x="962.0" y="282" text-anchor="middle" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">ENTRY/FLOW/BOOST</text>
63
+ <g filter="url(#soft)">
64
+ <rect x="462" y="378" width="118" height="58" rx="14" fill="#161b26" stroke="#3fb950" stroke-width="1.2"/>
65
+ </g>
66
+ <text x="486" y="404" fill="#3fb950" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
67
+ <text x="486" y="423" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit pass</text>
68
+ <g filter="url(#soft)">
69
+ <rect x="592" y="378" width="118" height="58" rx="14" fill="#161b26" stroke="#d29922" stroke-width="1.2"/>
70
+ </g>
71
+ <text x="616" y="404" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
72
+ <text x="616" y="423" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit fail</text>
73
+ <g filter="url(#soft)">
74
+ <rect x="722" y="378" width="118" height="58" rx="14" fill="#161b26" stroke="#d29922" stroke-width="1.2"/>
75
+ </g>
76
+ <text x="746" y="404" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
77
+ <text x="746" y="423" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit config</text>
78
+ <g filter="url(#soft)">
79
+ <rect x="852" y="378" width="118" height="58" rx="14" fill="#161b26" stroke="#d29922" stroke-width="1.2"/>
80
+ </g>
81
+ <text x="876" y="404" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
82
+ <text x="876" y="423" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit runtime</text>
83
+ <rect x="50" y="476" width="1000" height="58" rx="15" fill="#161b26" stroke="#2a3142"/>
84
+ <text x="74" y="502" fill="#8496f5" font-family="ui-monospace, monospace" font-size="13" font-weight="700">static ≠ runtime</text>
85
+ <text x="74" y="522" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13">a static pass never substitutes for a runtime run; not-run is reported, never upgraded to PASS</text>
86
+ <text x="50" y="596" fill="#a8b1c4" font-family="ui-monospace, monospace" font-size="13">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
87
+ </svg>
package/docs/assets/dsh-standards-flow-v3-light.svg ADDED
@@ -0,0 +1,87 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards pipeline">
2
+ <defs>
3
+ <linearGradient id="lineGrad" x1="0" y1="0" x2="1" y2="0">
4
+ <stop offset="0" stop-color="#4B67B4" stop-opacity=".15"/>
5
+ <stop offset=".5" stop-color="#4B67B4" stop-opacity=".9"/>
6
+ <stop offset="1" stop-color="#4B67B4" stop-opacity=".15"/>
7
+ </linearGradient>
8
+ <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
9
+ <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.10"/>
10
+ </filter>
11
+ <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
12
+ <circle cx="1.3" cy="1.3" r="1.3" fill="#f2f0f8"/>
13
+ </pattern>
14
+ </defs>
15
+ <rect width="1100" height="660" fill="#ffffff"/>
16
+ <rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
17
+ <text x="50" y="62" fill="#141419" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
18
+ <text x="50" y="90" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">static checks, runtime measurement, one reproducible report</text>
19
+ <rect x="50" y="108" width="1000" height="1.6" rx="1" fill="#e6e3f0"/>
20
+ <g filter="url(#soft)">
21
+ <rect x="50" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
22
+ </g>
23
+ <circle cx="74" cy="214" r="12" fill="#ece7f9"/>
24
+ <text x="74" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">01</text>
25
+ <text x="138.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">plugin dir</text>
26
+ <text x="138.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">the repository</text>
27
+ <path d="M231 249.0 C241.0 249.0, 241.0 249.0, 251 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
28
+ <path d="M241 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
29
+ <g filter="url(#soft)">
30
+ <rect x="256" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#4B67B4" stroke-width="2.6"/>
31
+ </g>
32
+ <circle cx="280" cy="214" r="12" fill="#ece7f9"/>
33
+ <text x="280" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">02</text>
34
+ <text x="344.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">DSC-01…13</text>
35
+ <text x="344.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">static checks</text>
36
+ <path d="M437 249.0 C447.0 249.0, 447.0 249.0, 457 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
37
+ <path d="M447 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
38
+ <g filter="url(#soft)">
39
+ <rect x="462" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
40
+ </g>
41
+ <circle cx="486" cy="214" r="12" fill="#ece7f9"/>
42
+ <text x="486" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">03</text>
43
+ <text x="550.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">L1–L3</text>
44
+ <text x="550.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime measurement</text>
45
+ <path d="M643 249.0 C653.0 249.0, 653.0 249.0, 663 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
46
+ <path d="M653 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
47
+ <g filter="url(#soft)">
48
+ <rect x="668" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#e6e3f0" stroke-width="1.3"/>
49
+ </g>
50
+ <circle cx="692" cy="214" r="12" fill="#ece7f9"/>
51
+ <text x="692" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">04</text>
52
+ <text x="756.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">report</text>
53
+ <text x="756.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">text / json / sarif</text>
54
+ <path d="M849 249.0 C859.0 249.0, 859.0 249.0, 869 249.0" stroke="url(#lineGrad)" stroke-width="2.2" fill="none"/>
55
+ <path d="M859 244.0 l8 5 -8 5" fill="none" stroke="#4B67B4" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
56
+ <g filter="url(#soft)">
57
+ <rect x="874" y="190" width="176" height="118" rx="17" fill="#fcfcfe" stroke="#16a34a" stroke-width="2.6"/>
58
+ </g>
59
+ <circle cx="898" cy="214" r="12" fill="#ece7f9"/>
60
+ <text x="898" y="219" text-anchor="middle" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="11.5" font-weight="700">05</text>
61
+ <text x="962.0" y="256" text-anchor="middle" fill="#141419" font-family="ui-monospace, monospace" font-size="15.5" font-weight="700">dsh-levels</text>
62
+ <text x="962.0" y="282" text-anchor="middle" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">ENTRY/FLOW/BOOST</text>
63
+ <g filter="url(#soft)">
64
+ <rect x="462" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#16a34a" stroke-width="1.2"/>
65
+ </g>
66
+ <text x="486" y="404" fill="#16a34a" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
67
+ <text x="486" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit pass</text>
68
+ <g filter="url(#soft)">
69
+ <rect x="592" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
70
+ </g>
71
+ <text x="616" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
72
+ <text x="616" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit fail</text>
73
+ <g filter="url(#soft)">
74
+ <rect x="722" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
75
+ </g>
76
+ <text x="746" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
77
+ <text x="746" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit config</text>
78
+ <g filter="url(#soft)">
79
+ <rect x="852" y="378" width="118" height="58" rx="14" fill="#fcfcfe" stroke="#bc4c00" stroke-width="1.2"/>
80
+ </g>
81
+ <text x="876" y="404" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
82
+ <text x="876" y="423" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">exit runtime</text>
83
+ <rect x="50" y="476" width="1000" height="58" rx="15" fill="#fcfcfe" stroke="#e6e3f0"/>
84
+ <text x="74" y="502" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">static ≠ runtime</text>
85
+ <text x="74" y="522" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13">a static pass never substitutes for a runtime run; not-run is reported, never upgraded to PASS</text>
86
+ <text x="50" y="596" fill="#4d5261" font-family="ui-monospace, monospace" font-size="13">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
87
+ </svg>
package/docs/assets/dsh-standards-flow-v4-dark.svg ADDED
@@ -0,0 +1,79 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards dual-channel funnel">
2
+ <defs>
3
+ <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
4
+ <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.55"/>
5
+ </filter>
6
+ <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
7
+ <circle cx="1.3" cy="1.3" r="1.3" fill="#182031"/>
8
+ </pattern>
9
+ <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
10
+ <path d="M0 0 L10 5 L0 10 z" fill="#8496f5"/>
11
+ </marker>
12
+ </defs>
13
+ <rect width="1100" height="660" fill="#0d1117"/>
14
+ <rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
15
+ <text x="50" y="58" fill="#f0f3f9" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
16
+ <text x="50" y="86" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">two channels, one report · static never pretends to be runtime</text>
17
+ <rect x="42" y="118" width="292" height="366" rx="20" fill="#121824" stroke="#2a3142"/>
18
+ <text x="62" y="146" fill="#8496f5" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">STATIC · DSC-01...13</text>
19
+ <rect x="348" y="118" width="292" height="366" rx="20" fill="#121824" stroke="#2a3142"/>
20
+ <text x="368" y="146" fill="#3fb950" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">RUNTIME · L1-L3</text>
21
+
22
+ <rect x="58" y="168" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
23
+ <circle cx="78" cy="199" r="8" fill="#8496f5"/>
24
+ <text x="96" y="194" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">contract</text>
25
+ <text x="96" y="214" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cordis.patch.yml</text>
26
+ <rect x="58" y="244" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
27
+ <circle cx="78" cy="275" r="8" fill="#8496f5"/>
28
+ <text x="96" y="270" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">manifest</text>
29
+ <text x="96" y="290" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">package.json</text>
30
+ <rect x="58" y="320" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
31
+ <circle cx="78" cy="351" r="8" fill="#8496f5"/>
32
+ <text x="96" y="346" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">layout</text>
33
+ <text x="96" y="366" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">files + imports</text>
34
+ <rect x="58" y="396" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
35
+ <circle cx="78" cy="427" r="8" fill="#8496f5"/>
36
+ <text x="96" y="422" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">docs</text>
37
+ <text x="96" y="442" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">README + topics</text>
38
+ <rect x="364" y="168" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
39
+ <circle cx="384" cy="199" r="8" fill="#3fb950"/>
40
+ <text x="402" y="194" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">install</text>
41
+ <text x="402" y="214" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cold profile</text>
42
+ <rect x="364" y="244" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
43
+ <circle cx="384" cy="275" r="8" fill="#3fb950"/>
44
+ <text x="402" y="270" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">smoke</text>
45
+ <text x="402" y="290" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">agent step</text>
46
+ <rect x="364" y="320" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
47
+ <circle cx="384" cy="351" r="8" fill="#3fb950"/>
48
+ <text x="402" y="346" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">perf</text>
49
+ <text x="402" y="366" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">p50 / p99</text>
50
+ <rect x="364" y="396" width="260" height="62" rx="13" fill="#161b26" stroke="#2a3142"/>
51
+ <circle cx="384" cy="427" r="8" fill="#3fb950"/>
52
+ <text x="402" y="422" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">evidence</text>
53
+ <text x="402" y="442" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">reproducible</text>
54
+ <path d="M188 484 V504 H672" stroke="#8496f5" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
55
+ <path d="M494 484 V496 H672" stroke="#3fb950" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
56
+ <rect x="680" y="380" width="176" height="120" rx="18" fill="#161b26" stroke="#8496f5" stroke-width="2.2" filter="url(#soft)"/>
57
+ <text x="700" y="408" fill="#8496f5" font-family="ui-monospace, monospace" font-size="13" font-weight="700">report</text>
58
+ <text x="700" y="436" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">text</text>
59
+ <text x="700" y="458" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">json</text>
60
+ <text x="700" y="480" fill="#f0f3f9" font-family="ui-monospace, monospace" font-size="12.5">sarif</text>
61
+ <path d="M856 440 H904" stroke="#8496f5" stroke-width="2.4" fill="none" marker-end="url(#arr)"/>
62
+ <text x="920" y="218" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13" font-weight="700">EXIT</text>
63
+ <rect x="920" y="240" width="120" height="46" rx="12" fill="#161b26" stroke="#3fb950" stroke-width="1.5"/>
64
+ <text x="938" y="269" fill="#3fb950" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
65
+ <text x="962" y="269" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">pass</text>
66
+ <rect x="920" y="298" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
67
+ <text x="938" y="327" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
68
+ <text x="962" y="327" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">fail</text>
69
+ <rect x="920" y="356" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
70
+ <text x="938" y="385" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
71
+ <text x="962" y="385" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">config</text>
72
+ <rect x="920" y="414" width="120" height="46" rx="12" fill="#161b26" stroke="#d29922" stroke-width="1.5"/>
73
+ <text x="938" y="443" fill="#d29922" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
74
+ <text x="962" y="443" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime</text>
75
+ <text x="680" y="540" fill="#8496f5" font-family="ui-monospace, monospace" font-size="13" font-weight="700">ENTRY / FLOW / BOOST</text>
76
+ <text x="680" y="562" fill="#a8b1c4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">dsh-levels: depth of adoption</text>
77
+
78
+ <text x="50" y="618" fill="#a8b1c4" font-family="ui-monospace, monospace" font-size="12.5">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
79
+ </svg>
package/docs/assets/dsh-standards-flow-v4-light.svg ADDED
@@ -0,0 +1,79 @@
1
+ <svg xmlns="http://www.w3.org/2000/svg" width="1100" height="660" viewBox="0 0 1100 660" role="img" aria-label="dsh-standards dual-channel funnel">
2
+ <defs>
3
+ <filter id="soft" x="-40%" y="-40%" width="180%" height="200%">
4
+ <feDropShadow dx="0" dy="9" stdDeviation="12" flood-color="#1b1735" flood-opacity="0.10"/>
5
+ </filter>
6
+ <pattern id="dots" width="28" height="28" patternUnits="userSpaceOnUse">
7
+ <circle cx="1.3" cy="1.3" r="1.3" fill="#f2f0f8"/>
8
+ </pattern>
9
+ <marker id="arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
10
+ <path d="M0 0 L10 5 L0 10 z" fill="#4B67B4"/>
11
+ </marker>
12
+ </defs>
13
+ <rect width="1100" height="660" fill="#ffffff"/>
14
+ <rect width="1100" height="660" fill="url(#dots)" opacity=".5"/>
15
+ <text x="50" y="58" fill="#141419" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="32" font-weight="700">dsh-standards</text>
16
+ <text x="50" y="86" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="16">two channels, one report · static never pretends to be runtime</text>
17
+ <rect x="42" y="118" width="292" height="366" rx="20" fill="#f7f5fc" stroke="#e6e3f0"/>
18
+ <text x="62" y="146" fill="#4B67B4" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">STATIC · DSC-01...13</text>
19
+ <rect x="348" y="118" width="292" height="366" rx="20" fill="#f7f5fc" stroke="#e6e3f0"/>
20
+ <text x="368" y="146" fill="#16a34a" font-family="ui-sans-serif, system-ui, sans-serif" font-size="14" font-weight="700">RUNTIME · L1-L3</text>
21
+
22
+ <rect x="58" y="168" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
23
+ <circle cx="78" cy="199" r="8" fill="#4B67B4"/>
24
+ <text x="96" y="194" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">contract</text>
25
+ <text x="96" y="214" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cordis.patch.yml</text>
26
+ <rect x="58" y="244" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
27
+ <circle cx="78" cy="275" r="8" fill="#4B67B4"/>
28
+ <text x="96" y="270" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">manifest</text>
29
+ <text x="96" y="290" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">package.json</text>
30
+ <rect x="58" y="320" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
31
+ <circle cx="78" cy="351" r="8" fill="#4B67B4"/>
32
+ <text x="96" y="346" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">layout</text>
33
+ <text x="96" y="366" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">files + imports</text>
34
+ <rect x="58" y="396" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
35
+ <circle cx="78" cy="427" r="8" fill="#4B67B4"/>
36
+ <text x="96" y="422" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">docs</text>
37
+ <text x="96" y="442" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">README + topics</text>
38
+ <rect x="364" y="168" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
39
+ <circle cx="384" cy="199" r="8" fill="#16a34a"/>
40
+ <text x="402" y="194" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">install</text>
41
+ <text x="402" y="214" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">cold profile</text>
42
+ <rect x="364" y="244" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
43
+ <circle cx="384" cy="275" r="8" fill="#16a34a"/>
44
+ <text x="402" y="270" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">smoke</text>
45
+ <text x="402" y="290" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">agent step</text>
46
+ <rect x="364" y="320" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
47
+ <circle cx="384" cy="351" r="8" fill="#16a34a"/>
48
+ <text x="402" y="346" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">perf</text>
49
+ <text x="402" y="366" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">p50 / p99</text>
50
+ <rect x="364" y="396" width="260" height="62" rx="13" fill="#ffffff" stroke="#e6e3f0"/>
51
+ <circle cx="384" cy="427" r="8" fill="#16a34a"/>
52
+ <text x="402" y="422" fill="#141419" font-family="ui-monospace, monospace" font-size="13.5" font-weight="700">evidence</text>
53
+ <text x="402" y="442" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">reproducible</text>
54
+ <path d="M188 484 V504 H672" stroke="#4B67B4" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
55
+ <path d="M494 484 V496 H672" stroke="#16a34a" stroke-width="2.4" fill="none" marker-end="url(#arr)" opacity=".85"/>
56
+ <rect x="680" y="380" width="176" height="120" rx="18" fill="#ffffff" stroke="#4B67B4" stroke-width="2.2" filter="url(#soft)"/>
57
+ <text x="700" y="408" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">report</text>
58
+ <text x="700" y="436" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">text</text>
59
+ <text x="700" y="458" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">json</text>
60
+ <text x="700" y="480" fill="#141419" font-family="ui-monospace, monospace" font-size="12.5">sarif</text>
61
+ <path d="M856 440 H904" stroke="#4B67B4" stroke-width="2.4" fill="none" marker-end="url(#arr)"/>
62
+ <text x="920" y="218" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="13" font-weight="700">EXIT</text>
63
+ <rect x="920" y="240" width="120" height="46" rx="12" fill="#ffffff" stroke="#16a34a" stroke-width="1.5"/>
64
+ <text x="938" y="269" fill="#16a34a" font-family="ui-monospace, monospace" font-size="16" font-weight="700">0</text>
65
+ <text x="962" y="269" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">pass</text>
66
+ <rect x="920" y="298" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
67
+ <text x="938" y="327" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">1</text>
68
+ <text x="962" y="327" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">fail</text>
69
+ <rect x="920" y="356" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
70
+ <text x="938" y="385" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">2</text>
71
+ <text x="962" y="385" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">config</text>
72
+ <rect x="920" y="414" width="120" height="46" rx="12" fill="#ffffff" stroke="#bc4c00" stroke-width="1.5"/>
73
+ <text x="938" y="443" fill="#bc4c00" font-family="ui-monospace, monospace" font-size="16" font-weight="700">3</text>
74
+ <text x="962" y="443" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12.5">runtime</text>
75
+ <text x="680" y="540" fill="#4B67B4" font-family="ui-monospace, monospace" font-size="13" font-weight="700">ENTRY / FLOW / BOOST</text>
76
+ <text x="680" y="562" fill="#4d5261" font-family="ui-sans-serif, system-ui, sans-serif" font-size="12">dsh-levels: depth of adoption</text>
77
+
78
+ <text x="50" y="618" fill="#4d5261" font-family="ui-monospace, monospace" font-size="12.5">Apache-2.0 + CC-BY-4.0 · PerryLink DSH plugin family</text>
79
+ </svg>
package/docs/coverage.md ADDED
@@ -0,0 +1,82 @@
1
+ # 覆盖说明（14 项）— `dsh-standards check` 默认查什么
2
+
3
+ `dsh-standards check <package-dir>` 是作者入口。**默认 `--entry-claim static --no-exec`：不执行插件代码**。本文只描述这套默认，不把 `not-run` / `NA` 写成 PASS。
4
+
5
+ 默认命令等价于：
6
+
7
+ ```sh
8
+ dsh-standards check <package-dir> \
9
+ --entry-claim static --no-exec --scope ds-c --profile package
10
+ ```
11
+
12
+ ## 一眼看总数
13
+
14
+ | 口径 | 数量 | 说明 |
15
+ |---|---|---|
16
+ | 报告固定携带 | **14** | `DSC-01` … `DSC-14` |
17
+ | 默认实际评估 | **6** | `DSC-01`、`DSC-02`、`DSC-10`、`DSC-11`、`DSC-12`、`DSC-13` |
18
+ | 默认未检查 | **8** | `DSC-03`（NA）+ `DSC-04`–`DSC-09`（not-run）+ `DSC-14`（NA） |
19
+
20
+ `not checked` 桶把 NA / not-run / ERROR 都列出来；**没检查不等于通过**。`DSC-10` 是 advisory，只提供信号，不改变结论。
21
+
22
+ ## 14 项逐条
23
+
24
+ | ID | 层 | 默认状态 | 默认为什么 | 怎么开启 |
25
+ |---|---|---|---|---|
26
+ | `DSC-01` | L0 | **检查** | manifest / name / version / license / 入口 / 导出形态 | 默认即查 |
27
+ | `DSC-02` | L0 | **检查** | `engines.dsh` / peer 是否被 anchor 的宿主版本满足 | 默认即查；版本源见下 |
28
+ | `DSC-03` | L0 | **NA** | 没有安装 spec / 市场索引可查 | `--install-spec <spec>`，或 `--market-index <file> --plugin-name <name>`（listing） |
29
+ | `DSC-04` | L1 | **not-run** | `--no-exec`，不导入插件 | `--runtime <cordis lib/index.js>`；bundle 用 `--host <app-boot lib/index.js>` |
30
+ | `DSC-05` | L1 | **not-run** | 同上 | 同上 |
31
+ | `DSC-06` | L1+L2 | **not-run** | 同上 | 同上 |
32
+ | `DSC-07` | L2 | **not-run** | 同上 | 同上 |
33
+ | `DSC-08` | L3 | **not-run** | 同上 | 同上 |
34
+ | `DSC-09` | L1 | **not-run** | 同上 | 同上 |
35
+ | `DSC-10` | L0 | **检查（advisory）** | import 期副作用静态信号 | 默认即查；不单独 FAIL |
36
+ | `DSC-11` | L0 | **检查** | `dsh.capabilities` 与高信号触发 | 默认即查 |
37
+ | `DSC-12` | L0 | **检查** | 凭据 backing file、`listRecords`、seam、commitments/disclosure 形状 | 默认即查 |
38
+ | `DSC-13` | L0 | **检查** | `dsh.labels` / `upstream` / 禁用语标签 | 默认即查 |
39
+ | `DSC-14` | L1 | **NA** | 默认 `entry-claim=static`，不声明运行时证据 | `--scope entry --entry-claim runtime --runtime <...>`（bundle 加 `--host`） |
40
+
41
+ ## 执行 opt-in
42
+
43
+ 默认不执行插件代码。以下任一参数出现，才算显式允许运行时检查：
44
+
45
+ - `--runtime <path>`：Cordis 运行时的 `lib/index.js`，开启 L1–L3；
46
+ - `--host <file>`：app-boot 入口，开启 bundle 的 G0–G3 冒烟；
47
+ - `--entry-claim runtime`：entry 门声明运行时证据（通常还要配 `--runtime` / `--host`）。
48
+
49
+ 想保留运行时声明但只看静态结果，显式加 `--no-exec`。`--runtime-version` 只是 anchor，**不是**执行开关。
50
+
51
+ ## host 版本从哪里来
52
+
53
+ `check` 不会无条件执行 PATH 里的 `dsh`。anchor 按以下顺序取：
54
+
55
+ 1. `--host-version <v>`；
56
+ 2. `DSH_HOST_VERSION` 环境变量；
57
+ 3. `--allow-host-probe`：解析 `dsh` 的 JS 入口，执行 `node <entry> --version`（仅此一种情况会探测）；
58
+ 4. 都没有：报告写「host 版本未知」，`anchor.runtimeSource=default`、`anchor.suspect=true`。
59
+
60
+ 三态在 JSON 里可直接核对：`anchor.hostVersionKnown`、`anchor.hostVersionSource`（`flag` / `env` / `probe` / `none`）、`anchor.runtimeSource`（`host` / `default`；显式 `--runtime-version` 时保留 `cli`）。
61
+
62
+ ## 跨平台
63
+
64
+ - **Windows：** `unshare -Urn` / `prlimit` 不可用 → sandbox degraded；本仓**不声称** Windows 上的 runtime 结论，矩阵里的 Windows / Node 22 行固定 `not-run`。静态检查（上表 6 项）仍可跑。
65
+ - **WSL2（Ubuntu 24.04）：** Linux 沙箱可用，能提供 `unshare` / `prlimit`；这是本仓做 runtime 采集的环境。WSL2 可用不等于某个 host × Node × checker 组合已经跑过，具体以 [SUPPORTED.md](../SUPPORTED.md) 的格子为准。
66
+ - **Node：** 包声明 `engines.node >=24.9.0`；Node 22 只在自测 / 静态矩阵中有记录（见 SUPPORTED.md）。
67
+
68
+ ## 复核命令
69
+
70
+ ```sh
71
+ # 默认：6/14 评估，8 项 not-run/NA
72
+ dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.safety)})'
73
+
74
+ # 显式声明宿主版本，仍不执行插件
75
+ dsh-standards check <package-dir> --host-version 0.2.2-rc.1
76
+
77
+ # 显式允许宿主版本探测（只跑 dsh --version，不跑插件）
78
+ dsh-standards check <package-dir> --allow-host-probe
79
+
80
+ # 显式开启 L1–L3（会执行插件代码）
81
+ dsh-standards check <package-dir> --runtime /path/to/cordis/lib/index.js
82
+ ```
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-standards",
3
- "version": "1.2.2",
3
+ "version": "1.4.0",
4
4
  "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
5
5
  "type": "module",
6
6
  "main": "40-checker/src/index.mjs",
package/spec/README.md CHANGED
@@ -16,6 +16,7 @@ Machine-readable:
16
16
  - [reference-suite.json](reference-suite.json) — versioned samples, anchors, change rules.
17
17
  - [remediation.json](remediation.json) — 68-key advice table for the additive `advice[]` report field (docs anchors + severity hints).
18
18
  - [schemas/evidence.schema.json](schemas/evidence.schema.json) — `dsh-levels/1` record.
19
+ - [schemas/advice.schema.json](schemas/advice.schema.json) — `dsh-advice/1` entry array: the additive `advice[]` field of a `dsh-conformance/1` report (13 required fields; `why`/`fix`/`docsUrl` may be null; `evidence` ≤ 10; `gate`/`severity` ∈ {FAIL,WARN}).
19
20
  - [flow-evidence.schema.json](flow-evidence.schema.json) — `dsh-flow-evidence/2` FLOW chain (J1–J8 checks, subject/host binding, `evidenceHash`). v1 and bare `{Jx:{status}}` rows are deprecated and never count as a pass.
20
21
  - [schemas/attestation.schema.json](schemas/attestation.schema.json) — `dsh-attestation/1` quality record.
21
22
  - [schemas/report.schema.json](schemas/report.schema.json) — `dsh-report/1` inspection report (no grade).
@@ -26,4 +27,5 @@ Rules:
26
27
 
27
28
  - Levels depend on `common` only; do not import each other.
28
29
  - A level is not a certification, badge, grade, or score.
30
+ - CI attribution (`producer.runUrl`/`repository`/`commit`) is read from the runner environment and is self-declared: **CI 归属 ≠ 证明**. It never upgrades `claims.claimLevel`, and `level-audit` reports it only as `attestation: ci | self-declared`.
29
31
  - `dsh-standard` is an alias; `dsh-standards` is canonical.