dsh-standards 1.4.1 → 1.6.0

package/40-checker/src/signature.mjs

@@ -0,0 +1,249 @@
+/**
+ * Ed25519 signatures for FLOW evidence (`dsh-flow-evidence/2`).
+ *
+ * Zero dependencies: `node:crypto` only. A signature is a detached Ed25519
+ * signature over the canonical JSON encoding of the document with the
+ * `signature` field removed. The chain hash is computed over the body (minus
+ * `chain` and `signature`); the signed payload includes `chain`, so the
+ * signature also binds the declared chain hash. Signing never changes
+ * `chain.evidenceHash`, because `signature` is excluded from both payloads.
+ *
+ * Signature record:
+ *
+ *   signature: {
+ *     alg: "ed25519",
+ *     keyId: "<first 16 hex of sha256(SPKI public key PEM)>",
+ *     publicKey: "<SPKI PEM>",
+ *     sig: "<base64 detached signature>",
+ *     at: "<ISO-8601 timestamp>"
+ *   }
+ *
+ * `keyId` is derived from the exact SPKI PEM string that is embedded as
+ * `publicKey` (line endings included), so a verifier can recompute it from the
+ * signature record. This is an integrity/origin mechanism only: an embedded
+ * public key is self-asserted, so a valid signature does not make the signer
+ * trustworthy.
+ */
+import crypto from 'node:crypto'
+
+export const SIGNATURE_ALG = 'ed25519'
+export const SIGNATURE_SCHEMA = 'dsh-evidence-signature/1'
+export const KEY_ID_LENGTH = 16
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** JSON with recursively sorted object keys; array order is preserved. */
+export function canonicalJson(value) {
+  const sort = (node) => {
+    if (Array.isArray(node)) return node.map(sort)
+    if (isPlainObject(node)) {
+      const out = {}
+      for (const key of Object.keys(node).sort()) out[key] = sort(node[key])
+      return out
+    }
+    return node
+  }
+  return JSON.stringify(sort(value))
+}
+
+/**
+ * The exact bytes an evidence signature covers: canonical JSON of every field
+ * except `signature`. Unlike `evidenceHash()` (which also removes `chain`),
+ * this includes `chain`, so a signature binds the declared chain hash as well.
+ */
+export function evidenceSigningPayload(document) {
+  if (!isPlainObject(document)) throw new TypeError('evidence document must be a JSON object')
+  const copy = { ...document }
+  delete copy.signature
+  return Buffer.from(canonicalJson(copy), 'utf8')
+}
+
+function asPublicKey(key) {
+  if (key instanceof crypto.KeyObject) {
+    if (key.type === 'public') return key
+    return crypto.createPublicKey(key)
+  }
+  return crypto.createPublicKey(key)
+}
+
+function asPrivateKey(key) {
+  if (key instanceof crypto.KeyObject) {
+    if (key.type === 'private') return key
+    return crypto.createPrivateKey(key)
+  }
+  return crypto.createPrivateKey(key)
+}
+
+export function publicKeyPem(key) {
+  return asPublicKey(key).export({ type: 'spki', format: 'pem' }).toString()
+}
+
+/** keyId = first 16 hex of sha256(SPKI public key PEM text). */
+export function keyIdFromPublicKey(key) {
+  let pem
+  if (typeof key === 'string' && key.includes('BEGIN PUBLIC KEY')) {
+    pem = key
+  } else if (Buffer.isBuffer(key) && key.toString('utf8').includes('BEGIN PUBLIC KEY')) {
+    pem = key.toString('utf8')
+  } else {
+    pem = publicKeyPem(key)
+  }
+  return crypto.createHash('sha256').update(pem).digest('hex').slice(0, KEY_ID_LENGTH)
+}
+
+export function generateEd25519KeyPair() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519')
+  return {
+    privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    publicKeyPem: publicKeyPem(publicKey),
+    keyId: keyIdFromPublicKey(publicKey),
+  }
+}
+
+export function loadPrivateKey(pem) {
+  return crypto.createPrivateKey(pem)
+}
+
+export function loadPublicKey(pem) {
+  return crypto.createPublicKey(pem)
+}
+
+/**
+ * Return a copy of `document` carrying an Ed25519 signature. Any previous
+ * signature is replaced (it is not part of the signed payload). `at` defaults
+ * to now; pass an explicit ISO timestamp for reproducible evidence.
+ */
+export function signEvidence(document, privateKey, { at = new Date().toISOString(), keyId = null } = {}) {
+  if (!isPlainObject(document)) throw new TypeError('evidence document must be a JSON object')
+  const privateObject = asPrivateKey(privateKey)
+  const publicObject = crypto.createPublicKey(privateObject)
+  const pem = publicKeyPem(publicObject)
+  const computed = keyIdFromPublicKey(pem)
+  const id = keyId ?? computed
+  if (typeof id !== 'string' || !/^[0-9a-f]{16}$/.test(id)) {
+    throw new Error('signature.keyId must be 16 lowercase hex characters')
+  }
+  if (id !== computed) {
+    throw new Error(`signature.keyId does not match the private key (expected ${computed})`)
+  }
+  if (typeof at !== 'string' || at.length === 0) {
+    throw new Error('signature.at must be a non-empty ISO-8601 string')
+  }
+  const sig = crypto.sign(null, evidenceSigningPayload(document), privateObject).toString('base64')
+  return {
+    ...document,
+    signature: {
+      alg: SIGNATURE_ALG,
+      keyId: id,
+      publicKey: pem,
+      sig,
+      at,
+    },
+  }
+}
+
+function invalid(reason, extra = {}) {
+  return { status: 'invalid', reason, ...extra }
+}
+
+/**
+ * Verify a signed evidence document.
+ *
+ * - `missing`: no `signature` (or `signature: null`), or no public key is
+ *   available to check it (embedded key absent and no pinned key supplied).
+ * - `invalid`: malformed signature, key mismatch, or a payload that does not
+ *   verify.
+ * - `valid`: the signature verifies against the embedded key (or `publicKey`
+ *   when pinned).
+ *
+ * `publicKey` pins the trust anchor: pass a PEM/KeyObject out-of-band and the
+ * embedded key is only used to check `keyId` consistency. Without a pin, the
+ * embedded key is self-asserted — valid means "these bytes were signed by the
+ * holder of this key", not "the signer is trusted".
+ */
+export function verifyEvidenceSignature(document, { publicKey = null } = {}) {
+  if (!isPlainObject(document)) return invalid('evidence document must be a JSON object')
+  const signature = document.signature
+  if (signature === undefined || signature === null) {
+    return { status: 'missing', reason: 'document has no signature' }
+  }
+  if (!isPlainObject(signature)) return invalid('signature must be an object')
+  if (signature.alg !== SIGNATURE_ALG) return invalid(`signature.alg must be ${SIGNATURE_ALG}`)
+  if (typeof signature.sig !== 'string' || signature.sig.length === 0) {
+    return invalid('signature.sig must be a non-empty base64 string')
+  }
+  if (typeof signature.keyId !== 'string' || !/^[0-9a-f]{16}$/.test(signature.keyId)) {
+    return invalid('signature.keyId must be 16 lowercase hex characters')
+  }
+
+  let embedded = null
+  if (signature.publicKey !== undefined && signature.publicKey !== null) {
+    if (typeof signature.publicKey !== 'string' || signature.publicKey.trim() === '') {
+      return invalid('signature.publicKey must be a non-empty PEM string when present')
+    }
+    try {
+      embedded = asPublicKey(signature.publicKey)
+    } catch {
+      return invalid('signature.publicKey is not a valid public key')
+    }
+    const embeddedId = keyIdFromPublicKey(signature.publicKey)
+    if (embeddedId !== signature.keyId) {
+      return invalid('signature.keyId does not match sha256(signature.publicKey)[:16]', {
+        keyId: embeddedId,
+        embeddedKeyId: embeddedId,
+        keyIdMatch: false,
+      })
+    }
+  }
+
+  let key = null
+  let source = null
+  if (publicKey !== null && publicKey !== undefined) {
+    try {
+      key = asPublicKey(publicKey)
+    } catch {
+      return invalid('pinned public key is not a valid public key')
+    }
+    source = 'pinned'
+    const pinnedId = keyIdFromPublicKey(key)
+    if (pinnedId !== signature.keyId) {
+      return invalid('signature.keyId does not match the pinned public key', {
+        keyId: pinnedId,
+        embeddedKeyId: embedded ? keyIdFromPublicKey(embedded) : null,
+        keyIdMatch: false,
+      })
+    }
+  } else if (embedded) {
+    key = embedded
+    source = 'embedded'
+  } else {
+    return {
+      status: 'missing',
+      reason: 'no public key: signature.publicKey is missing and no pinned public key was supplied',
+    }
+  }
+
+  const derivedKeyId = keyIdFromPublicKey(key)
+  let ok = false
+  try {
+    ok = crypto.verify(null, evidenceSigningPayload(document), key, Buffer.from(signature.sig, 'base64'))
+  } catch (error) {
+    return invalid(`signature verification failed: ${error.message}`, {
+      keyId: derivedKeyId,
+      keyIdMatch: true,
+    })
+  }
+  const result = {
+    status: ok ? 'valid' : 'invalid',
+    alg: SIGNATURE_ALG,
+    keyId: derivedKeyId,
+    embeddedKeyId: embedded ? keyIdFromPublicKey(embedded) : null,
+    keyIdMatch: true,
+    publicKeySource: source,
+    at: typeof signature.at === 'string' ? signature.at : null,
+  }
+  if (!ok) result.reason = 'signature does not verify against the public key'
+  return result
+}

package/40-checker/src/util.mjs

@@ -123,6 +123,59 @@ export function listSourceFiles(root, options = {}) {
   return scanSourceFiles(root, options).paths
 }
 
+/**
+ * Inventory every file in a package (not only source extensions) without
+ * following symlinks. Used by the security checks for binary/obfuscation and
+ * script-reference analysis. Same skip directories as the source walker so
+ * node_modules/tests/docs do not dominate the sample.
+ * @param {string} root
+ * @param {{maxFiles?: number, maxBytes?: number}} [options]
+ */
+export function inventoryFiles(root, options = {}) {
+  const maxFiles = options.maxFiles ?? 1000
+  const maxBytes = options.maxBytes ?? 20_000_000
+  const files = []
+  let bytes = 0
+  let truncated = false
+  const walk = (directory) => {
+    if (files.length >= maxFiles || bytes >= maxBytes) {
+      truncated = true
+      return
+    }
+    let entries
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }) } catch { return }
+    entries.sort((a, b) => a.name.localeCompare(b.name))
+    for (const entry of entries) {
+      if (files.length >= maxFiles || bytes >= maxBytes) {
+        truncated = true
+        return
+      }
+      const absolute = path.join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (SKIP_DIRECTORIES.has(entry.name)) continue
+        if (entry.name.startsWith('.')) continue
+        walk(absolute)
+        continue
+      }
+      if (!entry.isFile()) continue
+      let size = 0
+      try { size = fs.statSync(absolute).size } catch { continue }
+      if (bytes + size > maxBytes) {
+        truncated = true
+        continue
+      }
+      bytes += size
+      files.push({
+        file: absolute,
+        relative: posixRelative(root, absolute),
+        size,
+      })
+    }
+  }
+  walk(root)
+  return { files, stats: { files: files.length, bytes, maxFiles, maxBytes, truncated } }
+}
+
 /** Read all source files once, returning {file, relative, text} records. */
 export function readSources(root, options) {
   return scanSourceFiles(root, options).paths.map(file => ({

package/CHANGELOG.md

@@ -1,3 +1,37 @@
+## 1.6.0 — 2026-11-07
+
+### Added
+
+- 安全层 DSC-15…22：生命周期脚本、动态执行、敏感文件、外联端点、混淆/二进制、提示词注入线索、供应链、来源/完整性。
+- `--scope security`：22 项检查，DSC-15/16/17/21 为强制；默认 14 项判定不变，security 块内 FAIL 封顶 WARN。
+- 威胁模型与宿主边界（`34` §十）：同进程全权限、capabilities 不被宿主读取、sandbox 仅子进程文件写、approval 仅 tool ask、`!!js` 可执行、client 可调 Remote。
+- `SECURITY.md`（漏洞报告）、`spec/dsc-clauses.json` 22 父/113 条、`spec/remediation.json` C-15…22、coverage 口径 22。
+
+### Verified
+
+- `npm test` 269/269；恶意 fixture（curl|sh、eval、凭据读取、typosquat）在 security scope 下 FAIL；10 个真实包默认 entry 10/10 exit 0。
+- 静态安全 PASS 不代表无恶意；检查器不能证明安全。
+
+## 1.5.0 — 2026-11-07
+
+### Added
+
+- 真实运行时检查：`--runtime`/`--host` 自动解析已装 dsh，在临时 HOME/DSH_HOME + env 白名单 + 超时硬杀下跑 DSC-04–09；报告新增 `runtimeChecks`（executed/modes/durationMs/isolation/checks）。
+- Ed25519 证据签名：`sign-evidence.mjs keygen|sign|verify`（node:crypto，零依赖），`docs/SIGNING.md` 说明密钥与信任边界。
+- 沙箱加固：`setpriv --no-new-privs --bounding-set=-all`、`nofile/fsize` rlimit、`unshare -Urm` + 只读 bind，记录 `hardening[]/hardeningDegraded[]`。
+
+### Fixed
+
+- `incomplete` 只由「mandatory 且 not-run」触发；静态 `partial` 不再把 ds-c bundle 判成 incomplete（修复前 dsh-fast 静态 ds-c 为 incomplete/exit 2，修复后 pass/exit 0）。
+- runtime-child 写 fd3 后立即退出，不再被插件 timers 拖到超时导致六项全 not-run。
+- 裸 `--runtime` 对带入口 bundle 直接走 server-entry；无入口纯 patch bundle 仍需 `--host`。
+- `conformance.schema.json` 加 `runtimeChecks`。
+
+### Verified
+
+- `npm test` 249/249；真实宿主 dsh 0.2.1-rc.5：dsh-fast/mcp-panel 的 DSC-04–09 出 P/NA/P/P/W/P，security-pack 20.9s 完成 G0–G3。
+- Windows 11 + node 24.22.1 实测：check 结果与 WSL 逐字一致；sandbox 记 degraded（unshare/prlimit 缺失），`flow collect --sandbox` 因 `npm.cmd` 无法无 shell spawn 记 not-run。
+
 ## 1.4.1 — 2026-11-06
 
 - 建议的 `docsUrl` 基址跟到 `dsh-plugin-guide@v0.4.6`（FLOW 示例修正版），不再指向 0.4.4。

package/docs/SIGNING.md

@@ -0,0 +1,137 @@
+# Evidence signing (Ed25519)
+
+`dsh-flow-evidence/2` documents can carry a detached Ed25519 signature. The
+implementation uses only `node:crypto` (no dependencies) and lives in
+`40-checker/src/signature.mjs`; `40-checker/scripts/sign-evidence.mjs` is the
+CLI. Signing is optional: it does not change `validateFlowEvidence()`, does not
+change the chain hash, and never upgrades a claim level.
+
+## What is signed
+
+The payload is canonical JSON (recursively sorted object keys, array order
+preserved) of every field **except `signature`**. This includes `chain`, so a
+signature also binds the declared `chain.evidenceHash`. The chain hash itself
+is computed over the body only (it excludes `chain` and `signature`). A signed
+document keeps its existing `chain.evidenceHash`; `signature` is outside the
+hash, so signing and re-signing do not invalidate the chain.
+
+```
+signature: {
+  alg: "ed25519",
+  keyId: "<first 16 hex of sha256(SPKI public key PEM)>",
+  publicKey: "<SPKI PEM>",
+  sig: "<base64 detached signature>",
+  at: "<ISO-8601 timestamp>"
+}
+```
+
+`keyId` is the first 16 hex characters of sha256 over the exact SPKI PEM string
+embedded as `publicKey` (line endings included), so a verifier can recompute it
+from the signature record. `publicKey` is embedded for transport convenience;
+it is **self-asserted**.
+
+## Key management
+
+```sh
+# Generate once, outside the repository working tree.
+node 40-checker/scripts/sign-evidence.mjs keygen --out ~/.dsh-evidence-keys
+# ed25519.pem (PKCS#8 private) and ed25519.pub.pem (SPKI public), both mode 0600.
+```
+
+- Never commit `ed25519.pem`, put it in logs, or paste it into an issue. Back it
+  up in a secret manager; losing it means old signatures can no longer be
+  produced (they remain verifiable).
+- `keygen` refuses to overwrite an existing key unless `--force` is passed.
+- Distribute `ed25519.pub.pem` and its `keyId` through a separate, trusted
+  channel (release notes, repository file, pinned fingerprint). A public key
+  fetched from the same JSON it verifies proves nothing about identity.
+- Rotate by generating a new pair; signatures keep their old `keyId`. Verifiers
+  should accept a set of pinned keyIds and record which one matched.
+- The `at` field is signer-defined. It is evidence metadata, not a trusted
+  timestamp; a signer can backdate or replay. Add policy (expiry, nonce,
+  transparency log) outside this tool if that matters.
+
+## Usage
+
+```sh
+# Sign after the collector has written and finalized the evidence.
+node 40-checker/scripts/sign-evidence.mjs sign flow-evidence.json \
+  --key ~/.dsh-evidence-keys/ed25519.pem \
+  --out flow-evidence.signed.json
+
+# Verify. Prints exactly one of: valid | invalid | missing.
+node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json
+node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json \
+  --pub ~/.dsh-evidence-keys/ed25519.pub.pem
+```
+
+Exit codes: `0` valid, `1` invalid or missing, `2` usage/input error.
+`--json` prints the detailed result (`status`, `keyId`, `keyIdMatch`,
+`publicKeySource`, `reason`). `missing` means the document has no signature (or
+`signature: null`), or there is no public key to check it (no embedded
+`publicKey` and no readable `--pub`). `invalid` covers malformed records, key
+mismatch, and a payload that does not verify. When `--pub` is supplied, it is
+the trust anchor: the embedded key is only used to cross-check `keyId`.
+
+The same helpers are re-exported from `40-checker/src/flow-evidence.mjs`:
+`attachEvidenceSignature()`, `verifyEvidenceSignature()`,
+`evidenceSigningPayload()`, `keyIdFromPublicKey()`.
+
+## CI usage
+
+Keep the private key in a CI secret and materialize it as a 0600 file only for
+the signing step; delete it immediately afterwards. Never print it.
+
+```yaml
+- name: Sign FLOW evidence
+  env:
+    EVIDENCE_PRIVATE_KEY: ${{ secrets.EVIDENCE_PRIVATE_KEY }}
+  run: |
+    umask 077
+    printf '%s' "$EVIDENCE_PRIVATE_KEY" > "$RUNNER_TEMP/evidence-key.pem"
+    node 40-checker/scripts/sign-evidence.mjs sign flow-evidence.json \
+      --key "$RUNNER_TEMP/evidence-key.pem" \
+      --out flow-evidence.signed.json
+    rm -f "$RUNNER_TEMP/evidence-key.pem"
+
+- name: Verify with the pinned public key
+  run: |
+    node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json \
+      --pub .github/evidence-pub.pem
+```
+
+For PRs from forks, do not expose the signing secret to code from the fork.
+Sign on a trusted workflow (e.g. `workflow_run` after review, or a maintainer
+run); a signature produced by untrusted code is only as trustworthy as that
+code.
+
+## Trust boundary
+
+**A valid self-signature is not trust.** It proves that whoever held the
+private key signed these exact bytes. It does **not** prove:
+
+- who that holder is (no identity, no CA, no account binding);
+- that the evidence was produced honestly, or that commands ran where claimed;
+- that the subject package is safe, correct, or officially endorsed;
+- freshness: `at` can be backdated and a valid old document can be replayed;
+- that the signer is allowed to speak for a project or marketplace.
+
+Consequences:
+
+- A verifier must pin the public key or `keyId` out-of-band. Treat the embedded
+  `publicKey` as a hint, not as an identity.
+- Compromise of the private key compromises every signature made with it;
+  revocation and rotation are policy decisions this tool does not implement.
+- Signature + chain hash give integrity and origin-of-holding, not truth. The
+  structural rules of `validateFlowEvidence()` and `level-audit` are unchanged;
+  signing cannot turn `self-attested`/`ci-attested` into `sandbox-attested`.
+- A marketplace or adoption decision still needs its own policy: who is
+  allowed to sign, which keyIds are accepted, what evidence is required, how
+  long it is valid, and how disputes/revocations are handled. This repository
+  ships a mechanism, not a trust root and not a certification.
+
+For the sandbox side of the evidence, see `40-checker/src/sandbox-run.mjs`:
+`setpriv --no-new-privs --bounding-set=-all`, extra `nofile`/`fsize` rlimits,
+and a read-only bind of the package copy are attempted and recorded. They are
+containment, not seccomp/cgroup/OCI isolation, and they do not make a
+self-signed document trustworthy.

package/docs/coverage.md

@@ -1,4 +1,4 @@
-# 覆盖说明（14 项）— `dsh-standards check` 默认查什么
+# 覆盖说明（22 项口径）— `dsh-standards check` 默认查什么
 
 `dsh-standards check <package-dir>` 是作者入口。**默认 `--entry-claim static --no-exec`：不执行插件代码**。本文只描述这套默认，不把 `not-run` / `NA` 写成 PASS。
 
@@ -13,13 +13,15 @@ dsh-standards check <package-dir> \
 
 | 口径 | 数量 | 说明 |
 |---|---|---|
-| 报告固定携带 | **14** | `DSC-01` … `DSC-14` |
+| 完整口径 | **22** | `DSC-01` … `DSC-22`；`--scope security` 时 `checks[]` 带全 22 项 |
+| 默认 `checks[]` | **14** | `DSC-01` … `DSC-14`；默认 DS-C 判定只看这 14 项 |
 | 默认实际评估 | **6** | `DSC-01`、`DSC-02`、`DSC-10`、`DSC-11`、`DSC-12`、`DSC-13` |
 | 默认未检查 | **8** | `DSC-03`（NA）+ `DSC-04`–`DSC-09`（not-run）+ `DSC-14`（NA） |
+| 默认 security 块 | **8** | `DSC-15`–`DSC-22` 在 `security` 块里跑 advisory；FAIL 封顶 WARN，不改变 DS-C 结论 |
 
 `not checked` 桶把 NA / not-run / ERROR 都列出来；**没检查不等于通过**。`DSC-10` 是 advisory，只提供信号，不改变结论。
 
-## 14 项逐条
+## 22 项逐条
 
 | ID | 层 | 默认状态 | 默认为什么 | 怎么开启 |
 |---|---|---|---|---|
@@ -37,6 +39,33 @@ dsh-standards check <package-dir> \
 | `DSC-12` | L0 | **检查** | 凭据 backing file、`listRecords`、seam、commitments/disclosure 形状 | 默认即查 |
 | `DSC-13` | L0 | **检查** | `dsh.labels` / `upstream` / 禁用语标签 | 默认即查 |
 | `DSC-14` | L1 | **NA** | 默认 `entry-claim=static`，不声明运行时证据 | `--scope entry --entry-claim runtime --runtime <...>`（bundle 加 `--host`） |
+| `DSC-15` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；生命周期脚本，可 FAIL |
+| `DSC-16` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；动态执行，可 FAIL |
+| `DSC-17` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；敏感文件，可 FAIL |
+| `DSC-18` | L0 | **advisory（security 块）** | 端点线索，永不 FAIL | `--scope security`；外联端点 |
+| `DSC-19` | L0 | **advisory（security 块）** | 只登记不判恶 | `--scope security`；混淆/二进制 |
+| `DSC-20` | L0 | **advisory（security 块）** | 语义不可判、误报高 | `--scope security`；提示词注入 |
+| `DSC-21` | L0 | **advisory WARN（security 块）** | 名字线索；默认 scope 不 FAIL | `--scope security`；供应链，强制项但只 WARN |
+| `DSC-22` | L0 | **advisory（security 块）** | 只有字段自证 | `--scope security`；来源/完整性，v1 只读字段 |
+
+## security scope（C-15～C-22）
+
+`--scope security` 是**独立、opt-in** 的安全范围。它把 8 项加入 `checks[]`（14 → 22），但**不改变** `DS-C` 徽章、也不并入 DS-C 的 11/12 条强制。它只降低风险，**不证明无恶意**：
+
+| 项 | security scope 判定 | 触发 |
+|---|---|---|
+| `DSC-15` 生命周期脚本 | **blocking**（可 FAIL） | 安装期 `curl\|sh`、`base64 -d`、`node -e`、`sh -c`、`powershell -enc`、引用缺失脚本、写 `$HOME`/`/etc` |
+| `DSC-16` 动态执行 | **blocking**（可 FAIL） | `eval`/`new Function(非空)`/`vm`/`module._compile`/`process.binding` → FAIL；裸 `child_process` → WARN |
+| `DSC-17` 敏感文件 | **blocking**（可 FAIL） | 直接读 `~/.ssh`、`$DSH_HOME` credentials、`id_rsa`、`.aws`、`.npmrc`、`.netrc` 等；`.env` 只 WARN |
+| `DSC-18` 外联端点 | **advisory**（永不 FAIL） | 非 https、userinfo、公网裸 IP、webhook/paste/ngrok/onion、未披露端点 |
+| `DSC-19` 混淆/二进制 | **advisory** | 二进制 sha256、超长单行、大块 base64、高熵；只登记不判恶 |
+| `DSC-20` 提示词注入 | **advisory** | 外部文本进 systemPrompt、指令样字面量、无 untrusted 包裹；语义不可判 |
+| `DSC-21` 供应链 | **blocking（强制项）/ WARN（发现封顶）** | scope 同形字/近似 scope、近似名、元数据缺失；**永不 FAIL**，但未跑会使 security `incomplete` |
+| `DSC-22` 来源/完整性 | **advisory**（永不 FAIL） | 只读 `dist.integrity` / `dsh.attestation` / `dsh.signature` 字段是否存在；不验签、不比对 digest；无输入即 `not-run` |
+
+**默认不改变判定**：不传 `--scope security` 时，这 8 项不进 `checks[]`，只在 `security` 块里以 `scope=advisory` 运行；任何 FAIL 封顶 WARN，`DS-C` 的 11/12 条强制集合与 exit code 不变。security 的 FAIL 不能撤销 `DS-C` PASS，`DS-C` PASS 也不能证明 security 通过。
+
+**边界**：C-15/C-16/C-17 可以 FAIL；C-21 是强制项但发现只到 WARN；C-18/C-19/C-20/C-22 是 advisory；其余安全面（实际网络流量、审批绕过、同进程逃逸、client DOM、`!!js` 配置、Remote 调用方身份）**没有机械判据**。任何 PASS 都只是"本次覆盖内未见该类线索"，不是"安全/已审计"。
 
 ## 执行 opt-in
 
@@ -44,7 +73,8 @@ dsh-standards check <package-dir> \
 
 - `--runtime <path>`：Cordis 运行时的 `lib/index.js`，开启 L1–L3；
 - `--host <file>`：app-boot 入口，开启 bundle 的 G0–G3 冒烟；
-- `--entry-claim runtime`：entry 门声明运行时证据（通常还要配 `--runtime` / `--host`）。
+- `--entry-claim runtime`：entry 门声明运行时证据（通常还要配 `--runtime` / `--host`）；
+- `--scope security`：只跑 C-15～C-22 的静态/元数据检查，**仍不执行插件代码**（C-15 只读脚本文本，不跑 `npm install`）。
 
 想保留运行时声明但只看静态结果，显式加 `--no-exec`。`--runtime-version` 只是 anchor，**不是**执行开关。
 
@@ -68,8 +98,11 @@ dsh-standards check <package-dir> \
 ## 复核命令
 
 ```sh
-# 默认：6/14 评估，8 项 not-run/NA
-dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.safety)})'
+# 默认：6/14 评估，8 项 not-run/NA；security 块是 advisory
+dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.security)})'
+
+# 默认 + security scope：checks[] 变 22 项（不执行插件）
+dsh-standards check <package-dir> --scope security --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.security)})'
 
 # 显式声明宿主版本，仍不执行插件
 dsh-standards check <package-dir> --host-version 0.2.2-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",

package/spec/coverage-contract.md

@@ -1,6 +1,6 @@
 # coverage 契约（`dsh-conformance/1`）
 
-> 适用版本：dsh-standards **1.3.0**（`40-checker/src/report.mjs` 的 `buildReport()`）。
+> 适用版本：dsh-standards **1.6.0**（计划版本；1.5.0 及更早为 14 项）。`40-checker/src/report.mjs` 的 `buildReport()` 负责计数；`security` 块见 §6。
 > 机器可校验形状见 [`schemas/conformance.schema.json`](schemas/conformance.schema.json)；本文只统一字段含义。
 > 结论：`coverage` 是**加性计数**，不参与 verdict；`PASS/WARN/FAIL` 与 `status/level` 由 `conclusion` 和对应 profile 的强制项决定。
 
@@ -17,8 +17,8 @@
 
 | 字段 | 定义 |
 |---|---|
-| `total` | `checks[].length`，完整跑是 14（`DSC-01`…`DSC-14`）。 |
-| `mandatory` | 当前 `scope`/`profile`/`staticOnly`/`entryClaim` 选出的强制检查 ID 数，不是 14。 |
+| `total` | `checks[].length`：默认 `ds-c` 为 14（`DSC-01`…`DSC-14`）；`--scope security` 为 22（再加 `DSC-15`…`DSC-22`）。 |
+| `mandatory` | 当前 `scope`/`profile`/`staticOnly`/`entryClaim` 选出的强制检查 ID 数，不是 22；默认 package 11、listing 12、`--scope security` 4（`DSC-15/16/17/21`）。 |
 | `checked` | 结果属于 `PASS` / `WARN` / `FAIL` 的检查数，即**实际评估过**的项。 |
 | `pass` | 结果 `PASS` 的数量。 |
 | `warn` | 结果 `WARN` 的数量。 |
@@ -41,7 +41,7 @@
 
 - `checked = pass + warn + fail`（`advisory <= warn`）。
 - `error <= notRun`；`notRun` 统计的是“没拿到完整结论”的项，`NA` 不算没跑。
-- 常规完整跑（14 项、无缺失）满足 `checked + na + notRun = total`。
+- 默认 `ds-c` 完整跑（14 项、无缺失）与 `--scope security` 完整跑（22 项、无缺失）都满足 `checked + na + notRun = total`；两份报告的 `total` 不同，不能混算通过率。
 - **例外**：若某项 `coverage: "partial"` 但结果仍是 `WARN`/`FAIL`，它会同时出现在 `checked` 与 `notRun` 中——已评估但不完整，不能当成 `full`。有缺失强制项时，`notRun` 会含不在 `checks[]` 里的 ID，此时上述加法可大于 `total`。
 - `metrics = { checked, total, declaredFields }`：`checked`/`total` 与 `coverage` 同源；`declaredFields` 是 capabilities/labels/commitments/disclosure/engines.dsh 五个可选声明面中实际声明的个数（0–5），只作上下文。
 
@@ -78,23 +78,45 @@
 - `checked`：真正产出 detail 的前提；`notChecked`：没产出的前提。
 - `checked.length + notChecked.length = required`；`failed` 是 `checked` 中结果为 `FAIL` 的子集。
 - `pass` 仅在 `failed` 为空**且** `notChecked` 为空时为 `true`。没给 `--install-spec`/`--market-index` 时 C-3.x 未查，`pass` 必为 `false`。
-- `entryBlocking` 不替代 `coverage`；它回答“阻断前提齐不齐”，`coverage` 回答“14 项各是什么状态”。
+- `entryBlocking` 不替代 `coverage`；它回答“阻断前提齐不齐”，`coverage` 回答“`checks[]` 各是什么状态”（默认 14 项，security 22 项）。
 
-## 5. 示例（1.3.0，good fixture，`--no-exec`）
+## 5. 示例（`--scope security` 示意，22 项；数字非实测）
 
 ```json
 {
-  "total": 14, "mandatory": 11, "checked": 6,
-  "pass": 5, "warn": 0, "advisory": 0, "fail": 1,
-  "na": 1, "notRun": 7, "error": 7, "entryBlocking": null
+  "total": 22, "mandatory": 4, "checked": 14,
+  "pass": 12, "warn": 1, "advisory": 1, "fail": 1,
+  "na": 1, "notRun": 7, "error": 7, "entryBlocking": null,
+  "security": {
+    "scope": "security", "status": "fail",
+    "blocking": ["DSC-17"], "warn": [], "advisory": ["DSC-19"], "notRun": []
+  }
 }
 ```
 
-读法：5 项 PASS + 1 项 FAIL = 6 项实际评估；1 项显式 NA；7 项 ERROR/未跑；`checked + na + notRun = 14`；`error (7) <= notRun (7)`。`status` 仍由强制项决定（此处因 FAIL 为 `fail`），不能只看 `coverage` 反推通过。
+读法：12 PASS + 1 WARN + 1 FAIL = 14 项实际评估；1 项显式 NA；7 项 ERROR/未跑；`checked + na + notRun = 22`；`error (7) <= notRun (7)`。`conclusion.status` 由 `--scope security` 的 4 个强制项（`DSC-15/16/17/21`）决定；`security.status=fail` 只是 security 块的独立结论，不把 `DS-C` 徽章改写成 fail。
 
-## 6. 禁止事项
+## 6. security scope（C-15～C-22）
+
+`--scope security` 是独立 opt-in scope，不并入 `ds-c` / `entry` / `mvp`。8 个 security 检查**始终**在报告的 `security` 块里运行；是否进入 `checks[]`、是否可 FAIL，取决于 scope。
+
+| 项 | 语义 |
+|---|---|
+| 计入 `total` | **默认否**：`checks[]` 仍是 14，`security` 块单独存在、不计入 `coverage`。**security 是**：`checks[]` 22，`coverage.total=22`、`coverage.mandatory=4`。 |
+| 默认 `security.scope` | `"advisory"`。8 项照常评估，但任何 `FAIL` 封顶为 `WARN`，不改 `conclusion`/exit；`security.status` 可为 `pass`/`warn`。 |
+| `security.status=pass` | **security scope 下**：无 FAIL、无强制项结果不在 `PASS`/`WARN`/`FAIL`、无任何 WARN（含 advisory）。默认 advisory 模式只可能 `pass`/`warn`，且 `pass` 不代表覆盖完整。advisory 的 `not-run`（如 C-22 无元数据）不挡 `pass`，但必须留在 `security.notRun[]`；C-21 的传递依赖元数据缺失只记 check 级 `coverage: partial`，不等同 PASS。 |
+| `security.status=fail` | **仅 security scope**：`DSC-15`/`DSC-16`/`DSC-17` 任一 FAIL。`DSC-21` 永不 FAIL；默认模式 FAIL 封顶 WARN，不会出现 fail。 |
+| `security.status=warn` | 无 FAIL，但有 `DSC-21` 或 15/16/17 的 WARN，或 18/19/20/22 的 advisory WARN。 |
+| `security.status=incomplete` | **security scope 下** `DSC-15`/`DSC-16`/`DSC-17`/`DSC-21` 任一结果不在 `PASS`/`WARN`/`FAIL`（即 `NA`/`ERROR`/`not-run`）。 |
+| 与 DS-C 关系 | **独立**：security FAIL 不撤销 DS-C PASS；DS-C PASS 不证明 security 通过；反之亦然。 |
+| 徽章 | **不得**发 security 徽章；市场只透传 `security.status`、`security.checks[]` 与 `security.notRun[]`，不按安全分排序/筛选。 |
+
+严重度以 `spec/dsc-clauses.json` 的 `mandatory`/`advisory` 与 31 §2 C-15～C-22 为准：`DSC-15/16/17` 为 blocking（可 FAIL）；`DSC-21` 是强制项但发现封顶 WARN（永不 FAIL，未跑才 `incomplete`）；`DSC-18/19/20/22` 为 advisory（`advisory:true`，永不改 verdict）。`security` 块只汇总这 8 项，不与顶层 `coverage` 换算成第二套通过率。
+
+## 7. 禁止事项
 
 - 不得把 `na`、`notRun`、`error` 或 `partial` 写成 PASS。
 - 不得用 `coverage.pass / total` 当通过率或等级；`total` 含未跑项，且 `mandatory` 随 profile 变。
 - 不得把 `advisory` 计入 `fail` 或据其改变 `exitCode`。
 - 检查级 `coverage` 与报告级 `coverage` 同名不同义；引用时必须写全路径（`checks[].coverage` vs `coverage`）。
+- 不得把 `security.status` 写成安全认证/审计结论；security 的 `pass` 只覆盖这 8 项的静态/元数据证据。