docs: make emitter verification self-service

[rogerdigital]

Ships milestone M4 of the release-risk plan — the public kit for detection quality and contract guarantees, expanded and executed per 2026-09-19-calibration-conformance-kit.md. No scanner behavior change; everything is data, tests, and docs around the published surfaces.

Calibration corpus (test/fixtures/calibration/, locked by test/calibration.test.ts): eight labeled cases — benign/detection pairs (hex palette vs encoded payload), charcode chain, secret-adjacent egress, a formatting-variant pair asserting zero risk deltas under dsh-vet diff, the imports-map false-positive regression from the chalk pilot (since: unreleased, bumped at release), and the empty-audit vacuity check. Each manifest records source, license, since, expectations, rationale, and limitations; docs/calibration-method.md publishes the method, the per-case table, and the revision record — deliberately no aggregate accuracy percentage.

Conformance corpus (test/fixtures/conformance/, locked by test/conformance.test.ts): eight committed reports covering legacy (no extension), complete/partial coverage, a forged summary (rejected — the summary is derived), a future v2 context (valid base report, never trusted), a comparable same-profile pair, and a profile-mismatch pair. Valid files regenerate via scripts/gen-conformance-fixtures.mjs; third parties reproduce with npx dsh-vet@<version> validate|diff as documented in docs/consumer-conformance.md.

Consumer example (examples/consumer/consume-report.mjs): the validate → coverage → applicability → render workflow in one file; unknown states stay visible and applicability says plainly that artifact matching is not supported yet (M3 keeps its entry gate).

Registry split (docs/emitters.md): structural conformance / detection calibration / origin verification are now separate claims; meeting one never implies another.

Two corrections surfaced by the red-green loop: egress.secret-adjacent grades D (not C) when the network call is statically reachable from the secret read — the manifest and method doc now state the escalation semantics; and the ROADMAP's "no maintainer has replied" was stale — it now reflects the dsh-wechat reply (used once, second release pending; the M2 gate conclusion is unchanged).

Out of scope, unchanged: M4 bullet 7 (exercising the kit with an external maintainer — outreach, separate authorized action) and the M2/M3 entry gates.

Verification: pnpm verify — 225 tests across 20 files, typecheck, build, and package checks pass; the documented reproduction commands re-run green through node bin/dsh-vet.mjs (validate ok, diff comparable with zero deltas).

[github-actions]

dsh-vet report

Grade: A · coverage: unknown · audited dsh-vet · run · report uploaded as the dsh-vet-report artifact

critical	high	medium	low	info
0	1	0	1	2

Findings

• [H] egress.secret-adjacent — Network calls reachable from code that reads secrets (low confidence)
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
  • lib/index.mjs:2056 — ``${homedir()}/.dsh,
  • lib/index.mjs:1013 — const dir = specifier.startsWith("~/") ? resolve(homedir(), specifier.slice(2)) : resolve(specifier);
• [L] perm.undeclared-fs-write — Write/delete target is a runtime value — scope not statically verifiable (low confidence)
  • lib/index.mjs:843 — writeFileSync(abs, data);
  • lib/index.mjs:845 — if (mode & 73) chmodSync(abs, mode);
  • lib/index.mjs:921 — rmSync(dir, {

2 info findings (never affect the grade)

• perm.network-client — Opens network connections
• perm.subprocess-spawn — Spawns subprocesses

---

Findings are signals, not verdicts — a low-confidence finding never lowers a grade. A finding you believe is wrong? Open a public dispute.