dsh-standards 1.5.0 → 1.6.0

package/40-checker/src/util.mjs

@@ -123,6 +123,59 @@ export function listSourceFiles(root, options = {}) {
   return scanSourceFiles(root, options).paths
 }
 
+/**
+ * Inventory every file in a package (not only source extensions) without
+ * following symlinks. Used by the security checks for binary/obfuscation and
+ * script-reference analysis. Same skip directories as the source walker so
+ * node_modules/tests/docs do not dominate the sample.
+ * @param {string} root
+ * @param {{maxFiles?: number, maxBytes?: number}} [options]
+ */
+export function inventoryFiles(root, options = {}) {
+  const maxFiles = options.maxFiles ?? 1000
+  const maxBytes = options.maxBytes ?? 20_000_000
+  const files = []
+  let bytes = 0
+  let truncated = false
+  const walk = (directory) => {
+    if (files.length >= maxFiles || bytes >= maxBytes) {
+      truncated = true
+      return
+    }
+    let entries
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }) } catch { return }
+    entries.sort((a, b) => a.name.localeCompare(b.name))
+    for (const entry of entries) {
+      if (files.length >= maxFiles || bytes >= maxBytes) {
+        truncated = true
+        return
+      }
+      const absolute = path.join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (SKIP_DIRECTORIES.has(entry.name)) continue
+        if (entry.name.startsWith('.')) continue
+        walk(absolute)
+        continue
+      }
+      if (!entry.isFile()) continue
+      let size = 0
+      try { size = fs.statSync(absolute).size } catch { continue }
+      if (bytes + size > maxBytes) {
+        truncated = true
+        continue
+      }
+      bytes += size
+      files.push({
+        file: absolute,
+        relative: posixRelative(root, absolute),
+        size,
+      })
+    }
+  }
+  walk(root)
+  return { files, stats: { files: files.length, bytes, maxFiles, maxBytes, truncated } }
+}
+
 /** Read all source files once, returning {file, relative, text} records. */
 export function readSources(root, options) {
   return scanSourceFiles(root, options).paths.map(file => ({

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 1.6.0 — 2026-11-07
+
+### Added
+
+- 安全层 DSC-15…22：生命周期脚本、动态执行、敏感文件、外联端点、混淆/二进制、提示词注入线索、供应链、来源/完整性。
+- `--scope security`：22 项检查，DSC-15/16/17/21 为强制；默认 14 项判定不变，security 块内 FAIL 封顶 WARN。
+- 威胁模型与宿主边界（`34` §十）：同进程全权限、capabilities 不被宿主读取、sandbox 仅子进程文件写、approval 仅 tool ask、`!!js` 可执行、client 可调 Remote。
+- `SECURITY.md`（漏洞报告）、`spec/dsc-clauses.json` 22 父/113 条、`spec/remediation.json` C-15…22、coverage 口径 22。
+
+### Verified
+
+- `npm test` 269/269；恶意 fixture（curl|sh、eval、凭据读取、typosquat）在 security scope 下 FAIL；10 个真实包默认 entry 10/10 exit 0。
+- 静态安全 PASS 不代表无恶意；检查器不能证明安全。
+
 ## 1.5.0 — 2026-11-07
 
 ### Added

package/docs/SIGNING.md

@@ -0,0 +1,137 @@
+# Evidence signing (Ed25519)
+
+`dsh-flow-evidence/2` documents can carry a detached Ed25519 signature. The
+implementation uses only `node:crypto` (no dependencies) and lives in
+`40-checker/src/signature.mjs`; `40-checker/scripts/sign-evidence.mjs` is the
+CLI. Signing is optional: it does not change `validateFlowEvidence()`, does not
+change the chain hash, and never upgrades a claim level.
+
+## What is signed
+
+The payload is canonical JSON (recursively sorted object keys, array order
+preserved) of every field **except `signature`**. This includes `chain`, so a
+signature also binds the declared `chain.evidenceHash`. The chain hash itself
+is computed over the body only (it excludes `chain` and `signature`). A signed
+document keeps its existing `chain.evidenceHash`; `signature` is outside the
+hash, so signing and re-signing do not invalidate the chain.
+
+```
+signature: {
+  alg: "ed25519",
+  keyId: "<first 16 hex of sha256(SPKI public key PEM)>",
+  publicKey: "<SPKI PEM>",
+  sig: "<base64 detached signature>",
+  at: "<ISO-8601 timestamp>"
+}
+```
+
+`keyId` is the first 16 hex characters of sha256 over the exact SPKI PEM string
+embedded as `publicKey` (line endings included), so a verifier can recompute it
+from the signature record. `publicKey` is embedded for transport convenience;
+it is **self-asserted**.
+
+## Key management
+
+```sh
+# Generate once, outside the repository working tree.
+node 40-checker/scripts/sign-evidence.mjs keygen --out ~/.dsh-evidence-keys
+# ed25519.pem (PKCS#8 private) and ed25519.pub.pem (SPKI public), both mode 0600.
+```
+
+- Never commit `ed25519.pem`, put it in logs, or paste it into an issue. Back it
+  up in a secret manager; losing it means old signatures can no longer be
+  produced (they remain verifiable).
+- `keygen` refuses to overwrite an existing key unless `--force` is passed.
+- Distribute `ed25519.pub.pem` and its `keyId` through a separate, trusted
+  channel (release notes, repository file, pinned fingerprint). A public key
+  fetched from the same JSON it verifies proves nothing about identity.
+- Rotate by generating a new pair; signatures keep their old `keyId`. Verifiers
+  should accept a set of pinned keyIds and record which one matched.
+- The `at` field is signer-defined. It is evidence metadata, not a trusted
+  timestamp; a signer can backdate or replay. Add policy (expiry, nonce,
+  transparency log) outside this tool if that matters.
+
+## Usage
+
+```sh
+# Sign after the collector has written and finalized the evidence.
+node 40-checker/scripts/sign-evidence.mjs sign flow-evidence.json \
+  --key ~/.dsh-evidence-keys/ed25519.pem \
+  --out flow-evidence.signed.json
+
+# Verify. Prints exactly one of: valid | invalid | missing.
+node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json
+node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json \
+  --pub ~/.dsh-evidence-keys/ed25519.pub.pem
+```
+
+Exit codes: `0` valid, `1` invalid or missing, `2` usage/input error.
+`--json` prints the detailed result (`status`, `keyId`, `keyIdMatch`,
+`publicKeySource`, `reason`). `missing` means the document has no signature (or
+`signature: null`), or there is no public key to check it (no embedded
+`publicKey` and no readable `--pub`). `invalid` covers malformed records, key
+mismatch, and a payload that does not verify. When `--pub` is supplied, it is
+the trust anchor: the embedded key is only used to cross-check `keyId`.
+
+The same helpers are re-exported from `40-checker/src/flow-evidence.mjs`:
+`attachEvidenceSignature()`, `verifyEvidenceSignature()`,
+`evidenceSigningPayload()`, `keyIdFromPublicKey()`.
+
+## CI usage
+
+Keep the private key in a CI secret and materialize it as a 0600 file only for
+the signing step; delete it immediately afterwards. Never print it.
+
+```yaml
+- name: Sign FLOW evidence
+  env:
+    EVIDENCE_PRIVATE_KEY: ${{ secrets.EVIDENCE_PRIVATE_KEY }}
+  run: |
+    umask 077
+    printf '%s' "$EVIDENCE_PRIVATE_KEY" > "$RUNNER_TEMP/evidence-key.pem"
+    node 40-checker/scripts/sign-evidence.mjs sign flow-evidence.json \
+      --key "$RUNNER_TEMP/evidence-key.pem" \
+      --out flow-evidence.signed.json
+    rm -f "$RUNNER_TEMP/evidence-key.pem"
+
+- name: Verify with the pinned public key
+  run: |
+    node 40-checker/scripts/sign-evidence.mjs verify flow-evidence.signed.json \
+      --pub .github/evidence-pub.pem
+```
+
+For PRs from forks, do not expose the signing secret to code from the fork.
+Sign on a trusted workflow (e.g. `workflow_run` after review, or a maintainer
+run); a signature produced by untrusted code is only as trustworthy as that
+code.
+
+## Trust boundary
+
+**A valid self-signature is not trust.** It proves that whoever held the
+private key signed these exact bytes. It does **not** prove:
+
+- who that holder is (no identity, no CA, no account binding);
+- that the evidence was produced honestly, or that commands ran where claimed;
+- that the subject package is safe, correct, or officially endorsed;
+- freshness: `at` can be backdated and a valid old document can be replayed;
+- that the signer is allowed to speak for a project or marketplace.
+
+Consequences:
+
+- A verifier must pin the public key or `keyId` out-of-band. Treat the embedded
+  `publicKey` as a hint, not as an identity.
+- Compromise of the private key compromises every signature made with it;
+  revocation and rotation are policy decisions this tool does not implement.
+- Signature + chain hash give integrity and origin-of-holding, not truth. The
+  structural rules of `validateFlowEvidence()` and `level-audit` are unchanged;
+  signing cannot turn `self-attested`/`ci-attested` into `sandbox-attested`.
+- A marketplace or adoption decision still needs its own policy: who is
+  allowed to sign, which keyIds are accepted, what evidence is required, how
+  long it is valid, and how disputes/revocations are handled. This repository
+  ships a mechanism, not a trust root and not a certification.
+
+For the sandbox side of the evidence, see `40-checker/src/sandbox-run.mjs`:
+`setpriv --no-new-privs --bounding-set=-all`, extra `nofile`/`fsize` rlimits,
+and a read-only bind of the package copy are attempted and recorded. They are
+containment, not seccomp/cgroup/OCI isolation, and they do not make a
+self-signed document trustworthy.

package/docs/coverage.md

@@ -1,4 +1,4 @@
-# 覆盖说明（14 项）— `dsh-standards check` 默认查什么
+# 覆盖说明（22 项口径）— `dsh-standards check` 默认查什么
 
 `dsh-standards check <package-dir>` 是作者入口。**默认 `--entry-claim static --no-exec`：不执行插件代码**。本文只描述这套默认，不把 `not-run` / `NA` 写成 PASS。
 
@@ -13,13 +13,15 @@ dsh-standards check <package-dir> \
 
 | 口径 | 数量 | 说明 |
 |---|---|---|
-| 报告固定携带 | **14** | `DSC-01` … `DSC-14` |
+| 完整口径 | **22** | `DSC-01` … `DSC-22`；`--scope security` 时 `checks[]` 带全 22 项 |
+| 默认 `checks[]` | **14** | `DSC-01` … `DSC-14`；默认 DS-C 判定只看这 14 项 |
 | 默认实际评估 | **6** | `DSC-01`、`DSC-02`、`DSC-10`、`DSC-11`、`DSC-12`、`DSC-13` |
 | 默认未检查 | **8** | `DSC-03`（NA）+ `DSC-04`–`DSC-09`（not-run）+ `DSC-14`（NA） |
+| 默认 security 块 | **8** | `DSC-15`–`DSC-22` 在 `security` 块里跑 advisory；FAIL 封顶 WARN，不改变 DS-C 结论 |
 
 `not checked` 桶把 NA / not-run / ERROR 都列出来；**没检查不等于通过**。`DSC-10` 是 advisory，只提供信号，不改变结论。
 
-## 14 项逐条
+## 22 项逐条
 
 | ID | 层 | 默认状态 | 默认为什么 | 怎么开启 |
 |---|---|---|---|---|
@@ -37,6 +39,33 @@ dsh-standards check <package-dir> \
 | `DSC-12` | L0 | **检查** | 凭据 backing file、`listRecords`、seam、commitments/disclosure 形状 | 默认即查 |
 | `DSC-13` | L0 | **检查** | `dsh.labels` / `upstream` / 禁用语标签 | 默认即查 |
 | `DSC-14` | L1 | **NA** | 默认 `entry-claim=static`，不声明运行时证据 | `--scope entry --entry-claim runtime --runtime <...>`（bundle 加 `--host`） |
+| `DSC-15` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；生命周期脚本，可 FAIL |
+| `DSC-16` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；动态执行，可 FAIL |
+| `DSC-17` | L0 | **advisory（security 块）** | 默认 scope 下 FAIL 封顶 WARN | `--scope security`；敏感文件，可 FAIL |
+| `DSC-18` | L0 | **advisory（security 块）** | 端点线索，永不 FAIL | `--scope security`；外联端点 |
+| `DSC-19` | L0 | **advisory（security 块）** | 只登记不判恶 | `--scope security`；混淆/二进制 |
+| `DSC-20` | L0 | **advisory（security 块）** | 语义不可判、误报高 | `--scope security`；提示词注入 |
+| `DSC-21` | L0 | **advisory WARN（security 块）** | 名字线索；默认 scope 不 FAIL | `--scope security`；供应链，强制项但只 WARN |
+| `DSC-22` | L0 | **advisory（security 块）** | 只有字段自证 | `--scope security`；来源/完整性，v1 只读字段 |
+
+## security scope（C-15～C-22）
+
+`--scope security` 是**独立、opt-in** 的安全范围。它把 8 项加入 `checks[]`（14 → 22），但**不改变** `DS-C` 徽章、也不并入 DS-C 的 11/12 条强制。它只降低风险，**不证明无恶意**：
+
+| 项 | security scope 判定 | 触发 |
+|---|---|---|
+| `DSC-15` 生命周期脚本 | **blocking**（可 FAIL） | 安装期 `curl\|sh`、`base64 -d`、`node -e`、`sh -c`、`powershell -enc`、引用缺失脚本、写 `$HOME`/`/etc` |
+| `DSC-16` 动态执行 | **blocking**（可 FAIL） | `eval`/`new Function(非空)`/`vm`/`module._compile`/`process.binding` → FAIL；裸 `child_process` → WARN |
+| `DSC-17` 敏感文件 | **blocking**（可 FAIL） | 直接读 `~/.ssh`、`$DSH_HOME` credentials、`id_rsa`、`.aws`、`.npmrc`、`.netrc` 等；`.env` 只 WARN |
+| `DSC-18` 外联端点 | **advisory**（永不 FAIL） | 非 https、userinfo、公网裸 IP、webhook/paste/ngrok/onion、未披露端点 |
+| `DSC-19` 混淆/二进制 | **advisory** | 二进制 sha256、超长单行、大块 base64、高熵；只登记不判恶 |
+| `DSC-20` 提示词注入 | **advisory** | 外部文本进 systemPrompt、指令样字面量、无 untrusted 包裹；语义不可判 |
+| `DSC-21` 供应链 | **blocking（强制项）/ WARN（发现封顶）** | scope 同形字/近似 scope、近似名、元数据缺失；**永不 FAIL**，但未跑会使 security `incomplete` |
+| `DSC-22` 来源/完整性 | **advisory**（永不 FAIL） | 只读 `dist.integrity` / `dsh.attestation` / `dsh.signature` 字段是否存在；不验签、不比对 digest；无输入即 `not-run` |
+
+**默认不改变判定**：不传 `--scope security` 时，这 8 项不进 `checks[]`，只在 `security` 块里以 `scope=advisory` 运行；任何 FAIL 封顶 WARN，`DS-C` 的 11/12 条强制集合与 exit code 不变。security 的 FAIL 不能撤销 `DS-C` PASS，`DS-C` PASS 也不能证明 security 通过。
+
+**边界**：C-15/C-16/C-17 可以 FAIL；C-21 是强制项但发现只到 WARN；C-18/C-19/C-20/C-22 是 advisory；其余安全面（实际网络流量、审批绕过、同进程逃逸、client DOM、`!!js` 配置、Remote 调用方身份）**没有机械判据**。任何 PASS 都只是"本次覆盖内未见该类线索"，不是"安全/已审计"。
 
 ## 执行 opt-in
 
@@ -44,7 +73,8 @@ dsh-standards check <package-dir> \
 
 - `--runtime <path>`：Cordis 运行时的 `lib/index.js`，开启 L1–L3；
 - `--host <file>`：app-boot 入口，开启 bundle 的 G0–G3 冒烟；
-- `--entry-claim runtime`：entry 门声明运行时证据（通常还要配 `--runtime` / `--host`）。
+- `--entry-claim runtime`：entry 门声明运行时证据（通常还要配 `--runtime` / `--host`）；
+- `--scope security`：只跑 C-15～C-22 的静态/元数据检查，**仍不执行插件代码**（C-15 只读脚本文本，不跑 `npm install`）。
 
 想保留运行时声明但只看静态结果，显式加 `--no-exec`。`--runtime-version` 只是 anchor，**不是**执行开关。
 
@@ -68,8 +98,11 @@ dsh-standards check <package-dir> \
 ## 复核命令
 
 ```sh
-# 默认：6/14 评估，8 项 not-run/NA
-dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.safety)})'
+# 默认：6/14 评估，8 项 not-run/NA；security 块是 advisory
+dsh-standards check <package-dir> --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.anchor);console.log(r.security)})'
+
+# 默认 + security scope：checks[] 变 22 项（不执行插件）
+dsh-standards check <package-dir> --scope security --json | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const r=JSON.parse(s);console.log(r.coverage.checked+"/"+r.coverage.total);console.log(r.security)})'
 
 # 显式声明宿主版本，仍不执行插件
 dsh-standards check <package-dir> --host-version 0.2.2-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",

package/spec/coverage-contract.md

@@ -1,6 +1,6 @@
 # coverage 契约（`dsh-conformance/1`）
 
-> 适用版本：dsh-standards **1.3.0**（`40-checker/src/report.mjs` 的 `buildReport()`）。
+> 适用版本：dsh-standards **1.6.0**（计划版本；1.5.0 及更早为 14 项）。`40-checker/src/report.mjs` 的 `buildReport()` 负责计数；`security` 块见 §6。
 > 机器可校验形状见 [`schemas/conformance.schema.json`](schemas/conformance.schema.json)；本文只统一字段含义。
 > 结论：`coverage` 是**加性计数**，不参与 verdict；`PASS/WARN/FAIL` 与 `status/level` 由 `conclusion` 和对应 profile 的强制项决定。
 
@@ -17,8 +17,8 @@
 
 | 字段 | 定义 |
 |---|---|
-| `total` | `checks[].length`，完整跑是 14（`DSC-01`…`DSC-14`）。 |
-| `mandatory` | 当前 `scope`/`profile`/`staticOnly`/`entryClaim` 选出的强制检查 ID 数，不是 14。 |
+| `total` | `checks[].length`：默认 `ds-c` 为 14（`DSC-01`…`DSC-14`）；`--scope security` 为 22（再加 `DSC-15`…`DSC-22`）。 |
+| `mandatory` | 当前 `scope`/`profile`/`staticOnly`/`entryClaim` 选出的强制检查 ID 数，不是 22；默认 package 11、listing 12、`--scope security` 4（`DSC-15/16/17/21`）。 |
 | `checked` | 结果属于 `PASS` / `WARN` / `FAIL` 的检查数，即**实际评估过**的项。 |
 | `pass` | 结果 `PASS` 的数量。 |
 | `warn` | 结果 `WARN` 的数量。 |
@@ -41,7 +41,7 @@
 
 - `checked = pass + warn + fail`（`advisory <= warn`）。
 - `error <= notRun`；`notRun` 统计的是“没拿到完整结论”的项，`NA` 不算没跑。
-- 常规完整跑（14 项、无缺失）满足 `checked + na + notRun = total`。
+- 默认 `ds-c` 完整跑（14 项、无缺失）与 `--scope security` 完整跑（22 项、无缺失）都满足 `checked + na + notRun = total`；两份报告的 `total` 不同，不能混算通过率。
 - **例外**：若某项 `coverage: "partial"` 但结果仍是 `WARN`/`FAIL`，它会同时出现在 `checked` 与 `notRun` 中——已评估但不完整，不能当成 `full`。有缺失强制项时，`notRun` 会含不在 `checks[]` 里的 ID，此时上述加法可大于 `total`。
 - `metrics = { checked, total, declaredFields }`：`checked`/`total` 与 `coverage` 同源；`declaredFields` 是 capabilities/labels/commitments/disclosure/engines.dsh 五个可选声明面中实际声明的个数（0–5），只作上下文。
 
@@ -78,23 +78,45 @@
 - `checked`：真正产出 detail 的前提；`notChecked`：没产出的前提。
 - `checked.length + notChecked.length = required`；`failed` 是 `checked` 中结果为 `FAIL` 的子集。
 - `pass` 仅在 `failed` 为空**且** `notChecked` 为空时为 `true`。没给 `--install-spec`/`--market-index` 时 C-3.x 未查，`pass` 必为 `false`。
-- `entryBlocking` 不替代 `coverage`；它回答“阻断前提齐不齐”，`coverage` 回答“14 项各是什么状态”。
+- `entryBlocking` 不替代 `coverage`；它回答“阻断前提齐不齐”，`coverage` 回答“`checks[]` 各是什么状态”（默认 14 项，security 22 项）。
 
-## 5. 示例（1.3.0，good fixture，`--no-exec`）
+## 5. 示例（`--scope security` 示意，22 项；数字非实测）
 
 ```json
 {
-  "total": 14, "mandatory": 11, "checked": 6,
-  "pass": 5, "warn": 0, "advisory": 0, "fail": 1,
-  "na": 1, "notRun": 7, "error": 7, "entryBlocking": null
+  "total": 22, "mandatory": 4, "checked": 14,
+  "pass": 12, "warn": 1, "advisory": 1, "fail": 1,
+  "na": 1, "notRun": 7, "error": 7, "entryBlocking": null,
+  "security": {
+    "scope": "security", "status": "fail",
+    "blocking": ["DSC-17"], "warn": [], "advisory": ["DSC-19"], "notRun": []
+  }
 }
 ```
 
-读法：5 项 PASS + 1 项 FAIL = 6 项实际评估；1 项显式 NA；7 项 ERROR/未跑；`checked + na + notRun = 14`；`error (7) <= notRun (7)`。`status` 仍由强制项决定（此处因 FAIL 为 `fail`），不能只看 `coverage` 反推通过。
+读法：12 PASS + 1 WARN + 1 FAIL = 14 项实际评估；1 项显式 NA；7 项 ERROR/未跑；`checked + na + notRun = 22`；`error (7) <= notRun (7)`。`conclusion.status` 由 `--scope security` 的 4 个强制项（`DSC-15/16/17/21`）决定；`security.status=fail` 只是 security 块的独立结论，不把 `DS-C` 徽章改写成 fail。
 
-## 6. 禁止事项
+## 6. security scope（C-15～C-22）
+
+`--scope security` 是独立 opt-in scope，不并入 `ds-c` / `entry` / `mvp`。8 个 security 检查**始终**在报告的 `security` 块里运行；是否进入 `checks[]`、是否可 FAIL，取决于 scope。
+
+| 项 | 语义 |
+|---|---|
+| 计入 `total` | **默认否**：`checks[]` 仍是 14，`security` 块单独存在、不计入 `coverage`。**security 是**：`checks[]` 22，`coverage.total=22`、`coverage.mandatory=4`。 |
+| 默认 `security.scope` | `"advisory"`。8 项照常评估，但任何 `FAIL` 封顶为 `WARN`，不改 `conclusion`/exit；`security.status` 可为 `pass`/`warn`。 |
+| `security.status=pass` | **security scope 下**：无 FAIL、无强制项结果不在 `PASS`/`WARN`/`FAIL`、无任何 WARN（含 advisory）。默认 advisory 模式只可能 `pass`/`warn`，且 `pass` 不代表覆盖完整。advisory 的 `not-run`（如 C-22 无元数据）不挡 `pass`，但必须留在 `security.notRun[]`；C-21 的传递依赖元数据缺失只记 check 级 `coverage: partial`，不等同 PASS。 |
+| `security.status=fail` | **仅 security scope**：`DSC-15`/`DSC-16`/`DSC-17` 任一 FAIL。`DSC-21` 永不 FAIL；默认模式 FAIL 封顶 WARN，不会出现 fail。 |
+| `security.status=warn` | 无 FAIL，但有 `DSC-21` 或 15/16/17 的 WARN，或 18/19/20/22 的 advisory WARN。 |
+| `security.status=incomplete` | **security scope 下** `DSC-15`/`DSC-16`/`DSC-17`/`DSC-21` 任一结果不在 `PASS`/`WARN`/`FAIL`（即 `NA`/`ERROR`/`not-run`）。 |
+| 与 DS-C 关系 | **独立**：security FAIL 不撤销 DS-C PASS；DS-C PASS 不证明 security 通过；反之亦然。 |
+| 徽章 | **不得**发 security 徽章；市场只透传 `security.status`、`security.checks[]` 与 `security.notRun[]`，不按安全分排序/筛选。 |
+
+严重度以 `spec/dsc-clauses.json` 的 `mandatory`/`advisory` 与 31 §2 C-15～C-22 为准：`DSC-15/16/17` 为 blocking（可 FAIL）；`DSC-21` 是强制项但发现封顶 WARN（永不 FAIL，未跑才 `incomplete`）；`DSC-18/19/20/22` 为 advisory（`advisory:true`，永不改 verdict）。`security` 块只汇总这 8 项，不与顶层 `coverage` 换算成第二套通过率。
+
+## 7. 禁止事项
 
 - 不得把 `na`、`notRun`、`error` 或 `partial` 写成 PASS。
 - 不得用 `coverage.pass / total` 当通过率或等级；`total` 含未跑项，且 `mandatory` 随 profile 变。
 - 不得把 `advisory` 计入 `fail` 或据其改变 `exitCode`。
 - 检查级 `coverage` 与报告级 `coverage` 同名不同义；引用时必须写全路径（`checks[].coverage` vs `coverage`）。
+- 不得把 `security.status` 写成安全认证/审计结论；security 的 `pass` 只覆盖这 8 项的静态/元数据证据。