v0.4.0 — release-risk review: scan context, diff, and CI baselines

Every report now says what it actually checked, and any two reports can be honestly compared.

What's new

• x-dsh-vet scan-context extension (v1) — every report records its rule profile (with a derived digest), coverage (candidate/parsed/failed counts, named files, entry hints, omissions, fixed limitations), content identity (analysis-input manifest digest over the exact bytes analysis consumed + the exact archive digest for registry packages), and stable finding identities. Old reports stay valid; missing coverage reads as unknown, never complete — in the CLI (grade C · coverage: partial), PR comments, and badges (grade A (coverage unknown)). Spec: docs/scan-context-v1.md.
• dsh-vet diff — compares two reports into dsh-vet/diff/v1: added/removed/changed findings by stable identity (line moves and reformatting are not risk additions; a second endpoint is), observation deltas, and both sides of every severity/confidence/count transition. Pairs that can't be honestly compared say incomparable with explicit reasons instead of a diff that reads as "nothing changed". Also exported as compareReports(). Piloted on real release pairs — left-pad and chalk, every addition reconciled against the code.
• Action: optional baseline-report input — PRs get a bounded, escaped what-changed section with the full diff as an artifact. The baseline must come from a trusted base revision; see the merge-base recipe and trust boundary.

Grading, rules, and report semantics are unchanged — everything is additive, and previously valid reports still validate.

Full changelog: v0.3.0...v0.4.0

v0.3.0

v0.3.0 — dsh-vet validate: the contract grows a consumer side

v0.2 made plugin authors emit reports. v0.3.0 gives everyone else a
reason to trust them.

New: dsh-vet validate <report.json> — check any report against the
dsh-vet/v1 contract: field types, enums, rule-id shape, evidence
presence, RFC 3339 timestamps — and the load-bearing check, the derived
summary: grade and counts are recomputed from the findings, so a report
cannot assert a grade its evidence does not support. Unknown fields stay
ignored (design rule 4). Also exported as validateReport() for
pipelines.

A corpus test proves every report ever committed in this repo still
validates — including those emitted by scanner 0.1.0. The contract has
de facto been additive-only since first release.

New: renderMarkdown() exported from the package — the reference
grade/findings rendering (the same markdown the GitHub Action posts on
PRs), so marketplaces and integrations render reports without
reimplementing them.

The ecosystem round opens: verified-emitter checklist and registry
(docs/emitters.md), marketplace adoption one-pager
(docs/adopt-marketplace.md), and the announcement drafts
(docs/outreach/). The contract status is now consistent everywhere:
stable, additive-only since 0.1.0, formal freeze after the v0.3 feedback
round.

No scanner behavior change — rules, grades, and report shape are
untouched.

npx dsh-vet validate report.json   # after 0.3.0 lands on npm

v0.2.6

v0.2.6 — branch-based badge

Breaking (action): the badge now lives on the dsh-vet/report branch.

The PR-based publish path was architecturally incompatible with
GITHUB_TOKEN: workflows on Actions-created PRs require per-PR human
approval (action_required), so required checks can never pass and
auto-merge can never fire — established live after enabling PR creation.

The branch-based design needs no PR, no checks, and no repository
settings:

• The audit force-publishes report + badge to the unprotected
  dsh-vet/report branch (deduplicated against the branch tip beyond
  scanner.ranAt).
• shields.io reads badge.json straight from that branch; its history
  remains the D3 audit trail.
• The default branch drops .dsh-vet/ entirely.

Migration: badge URLs change from main to dsh-vet/report — see
action/README.md
for the snippet.

No scanner behavior change; the contract is unchanged.

v0.2.2

v0.2.2

Rule correction from the first public false-positive dispute:

• perm.undeclared-fs-write no longer asserts a runtime-value target is
  "outside any plausible plugin scope" — a claim a static scanner cannot
  make. It reports "scope not statically verifiable" at low/low with
  review guidance. Literal out-of-scope writes keep high/critical.
• Dispute #10 — whose
  guarded managed-directory removal was verified against source and tests
  before the rule changed — is the canonical record.

Scanner-only release; the contract is unchanged.

v0.1.0

v0.1.0 — first scanner release

The dsh-vet/v1 report contract now has a reference implementation:
npx dsh-vet <package> audits any npm-installable DSH plugin before you
install it. Requires Node >= 20.

• Resolution — npm packages via registry metadata only, tarballs verified
  against dist.integrity before extraction; local paths with zero network;
  git repos via depth-1 clone.
• 15 rules across perm.* / dep.* / obf.* / egress.*, each with a
  public rationale in docs/rules/ and conservative calibration: findings
  that depend on runtime values never lower a grade.
• CLI — human summary, --json dsh-vet/v1 reports, --strict /
  --fail-on thresholds, --rules filter.
• Calibrated on the real ecosystem — 11-package sweep, recorded in
  docs/calibration-v0.1.md.
• Self-audited in public — examples/dsh-vet.report.json is generated
  from the exact tarball that ships.