feat: publish DSH accessibility validation foundation

.github/ISSUE_TEMPLATE/assistive-technology-test-zh.yml

@@ -8,14 +8,16 @@ body:
   - type: markdown
     attributes:
       value: |
-        欢迎部分结果。每个产品／浏览器／辅助技术／语言组合单独提交一个 Issue。不要附加参与者原始录音或个人数据。
+        欢迎部分结果。每个产品／浏览器或终端／辅助技术／语言组合单独提交一个 Issue。请使用匹配的版本化规程：核心 Web 任务使用 dsh-core-at-lab/1.0.0-draft，实时回答与决策状态使用 dsh-live-at-lab/1.0.0-draft，companion 阅读／诊断任务使用 dsh-at-lab/1.0.0-draft，一次性 CLI 使用 dsh-cli-accessibility/1.0.0-draft，创作允许／拒绝任务使用 dsh-a11y-authoring-at-lab/0.1.0-draft。Issue 只是源材料；公开支持声明还必须具备按 dsh-a11y-human-evidence/0.1.0-draft 评审的记录。不要附加参与者原始录音、一次性登录 URL、未经检查的 session log 或个人数据。
   - type: checkboxes
     id: authority
     attributes:
       label: 同意与隐私
       options:
         - label: 我提交的是自己的结果，或已获得提交此去标识化结果的明确许可。
           required: true
+        - label: 真人直接操作了具名辅助技术，并观察了所报告的输出或交互；这不是自动化、仅无障碍树、从字幕推断或 AI 操作的结果。
+          required: true
         - label: 我已移除凭据、私人提示词、对话、用户名、个人数据和敏感路径。
           required: true
         - label: 我理解此公开结果只适用于这里记录的精确版本和场景。
@@ -25,10 +27,14 @@ body:
     attributes:
       label: 精确测试矩阵行
       placeholder: |
-        DSH tag/build：
-        Companion 版本：
+        规程及稳定目录任务 ID：
+        场景／任务 ID（例如 allow-once 或 reject）：
+        DSH 版本及完整 revision：
+        Companion 版本及完整 revision（如使用）：
+        创作组合版本及完整 revision（如使用）：
         操作系统及物理设备／虚拟机：
-        浏览器：
+        浏览器，或终端与 shell：
+        PTY 或重定向流（CLI）：
         辅助技术及版本：
         UI 与语音语言：
         详细度、标点、浏览／焦点模式、盲文或其他相关设置：
@@ -38,7 +44,7 @@ body:
     id: scenarios
     attributes:
       label: 场景与结果
-      description: 每个场景记录通过／失败／部分通过、任务是否完成、焦点落点、相关时的精确语音或盲文输出，以及变通方式。
+      description: 按每个稳定目录任务 ID 记录通过／失败／部分通过、是否独立完成、焦点落点、对每种已声明辅助技术模态的直接观察、审批理解／决策、协助情况及变通方式。未观察模态属于限制，不是通过。
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/assistive-technology-test.yml

@@ -8,14 +8,16 @@ body:
   - type: markdown
     attributes:
       value: |
-        Partial results are welcome. Submit one issue per product/browser/AT/language combination. Do not attach raw participant recordings or personal data.
+        Partial results are welcome. Submit one issue per product/browser-or-terminal/AT/language combination. Use the matching versioned protocol: dsh-core-at-lab/1.0.0-draft for core Web tasks, dsh-live-at-lab/1.0.0-draft for live response and decision states, dsh-at-lab/1.0.0-draft for companion reading/diagnostic tasks, dsh-cli-accessibility/1.0.0-draft for the one-shot CLI, or dsh-a11y-authoring-at-lab/0.1.0-draft for the authoring allow/reject task. An issue is source material; a public support claim additionally requires a reviewed record under dsh-a11y-human-evidence/0.1.0-draft. Do not attach raw participant recordings, one-use sign-in URLs, unreviewed session logs, or personal data.
   - type: checkboxes
     id: authority
     attributes:
       label: Consent and privacy
       options:
         - label: I am submitting my own result or have explicit permission to submit this de-identified result.
           required: true
+        - label: A person directly operated the named assistive technology and observed the reported output or interaction; this is not an automated, accessibility-tree-only, caption-inferred, or AI-operated result.
+          required: true
         - label: I removed credentials, private prompts, conversations, usernames, personal data, and sensitive paths.
           required: true
         - label: I understand that this public result will be used only within the exact versions and scenarios recorded here.
@@ -25,10 +27,14 @@ body:
     attributes:
       label: Exact test matrix row
       placeholder: |
-        DSH tag/build:
-        Companion version:
+        Protocol and stable catalog task IDs:
+        Scenario/task ID (for example allow-once or reject):
+        DSH version and full revision:
+        Companion version and full revision, if used:
+        Authoring composition version and full revision, if used:
         OS and hardware/VM:
-        Browser:
+        Browser, or terminal and shell:
+        PTY or redirected streams (CLI):
         Assistive technology and version:
         UI and speech language:
         Verbosity, punctuation, browse/focus mode, braille, or other relevant settings:
@@ -38,7 +44,7 @@ body:
     id: scenarios
     attributes:
       label: Scenarios and results
-      description: For each scenario, record pass/fail/partial, task completion, focus destination, exact spoken or braille output where relevant, and workaround.
+      description: For each stable catalog task ID, record pass/fail/partial, independent task completion, focus destination, a direct observation for every AT modality you claim, approval comprehension/decision where applicable, assistance, and workaround. An unobserved modality is a limitation, not a pass.
     validations:
       required: true
   - type: textarea

.github/ISSUE_TEMPLATE/config.yml

@@ -6,6 +6,9 @@ contact_links:
   - name: Security and privacy report
     url: https://github.com/omdsh-dev/dsh-accessibility/security/advisories/new
     about: Privately report vulnerabilities, credentials exposure, or participant-data risks.
+  - name: Evidence withdrawal or participant-data request
+    url: https://github.com/omdsh-dev/dsh-accessibility/security/advisories/new
+    about: Privately request withdrawal, correction, or deletion of covered accessibility-research material; never post participant contact details publicly.
   - name: Community conduct process
     url: https://github.com/omdsh-dev/community/blob/main/CODE_OF_CONDUCT.md
     about: Read the private reporting route for conduct incidents; do not file them publicly.

.github/ISSUE_TEMPLATE/disabled-developer-task-result-zh.yml

@@ -0,0 +1,100 @@
+name: 残障开发者任务结果
+description: 提交残障开发者完成版本化 DSH 任务规程后，经同意并去标识化的结果。
+title: "[残障开发者结果]: "
+labels:
+  - accessibility
+body:
+  - type: markdown
+    attributes:
+      value: |
+        欢迎部分通过与失败结果。每个 Issue 只对应一位参与者、一套版本化规程和一个精确产品／环境组合。专门辅助技术不是必填项：只记录实际使用的技术。不得披露身份、诊断、残障详情、联系方式、一次性 URL、凭据、私人提示词、原始录音或未经检查的日志。Issue 只是源材料，绝不会自行形成 `a11y-user-validated` 声明。
+  - type: checkboxes
+    id: authority
+    attributes:
+      label: 参与、同意与隐私
+      options:
+        - label: 任务执行者自我认同为残障开发者；无需且未包含诊断或残障详情。
+          required: true
+        - label: 我提交的是自己的结果，或已取得提交此去标识化摘要的明确许可。
+          required: true
+        - label: 参与者已单独明确同意公开此去标识化摘要；该同意不同于参与或录制同意。
+          required: true
+        - label: 已提供私密撤回渠道；研究负责人无需公开参与者联系方式即可定位并删除相关材料。
+          required: true
+        - label: 我已移除凭据、私人提示词、对话、用户名、个人数据、敏感路径、原始录音、同意记录和联系方式。
+          required: true
+  - type: textarea
+    id: protocol
+    attributes:
+      label: 版本化规程与任务清单
+      description: 从证据目录中选择一套规程并列出所有尝试过的稳定任务 ID。要满足一行残障开发者基线，同一位参与者必须在这一条记录中完成该规程的全部代表性核心任务。
+      placeholder: |
+        规程：
+        尝试的稳定任务 ID：
+        使用的精确实验室或 CLI 说明：
+        测试日期：
+    validations:
+      required: true
+  - type: textarea
+    id: matrix
+    attributes:
+      label: 精确构建与环境
+      placeholder: |
+        DSH 版本及完整 revision：
+        参与组件版本及完整 revision：
+        操作系统／build、物理设备或虚拟机：
+        浏览器及版本，或终端／shell 及版本：
+        实际使用的辅助技术及版本（如有）：
+        输入与输出方式：
+        UI locale 与相关设置：
+    validations:
+      required: true
+  - type: dropdown
+    id: assistance
+    attributes:
+      label: 使用过的最高协助等级
+      description: 选择与账本完全一致的类别；即使任务成功，也必须披露协助。
+      options:
+        - 无（`none`）
+        - 仅设置（`setup-only`）
+        - 任务中的口头指导（`verbal`）
+        - 任务中的明眼人代操作（`sighted-operation`）
+        - 其他操作协助（`other`）
+    validations:
+      required: true
+  - type: textarea
+    id: tasks
+    attributes:
+      label: 逐任务结果
+      description: 每个稳定任务 ID 都要记录通过／部分／失败；是否独立、有效、安全地完成；焦点／光标行为；仅在确实观察到时记录真实辅助技术输出；协助；必要时的耗时；变通方式及最小可复现障碍。
+      placeholder: |
+        task-id：
+        - 结果：通过 / 部分 / 失败
+        - 独立：是 / 否
+        - 有效：是 / 否
+        - 安全：是 / 否
+        - 焦点／光标及真实辅助技术观察（如适用）：
+        - 协助、变通方式与障碍：
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: 安全与控制权
+      description: 记录参与者是否理解审批、拒绝、破坏性或隐私后果、错误、恢复路径和最终任务结果；说明任何失去控制或信心的时刻。
+    validations:
+      required: true
+  - type: textarea
+    id: limitations
+    attributes:
+      label: 限制与不得推广的范围
+      description: 说明未测试内容、所有目视或人工协助渠道，以及为何这一条结果不能代表所有残障开发者或环境。
+    validations:
+      required: true
+  - type: checkboxes
+    id: claim_boundary
+    attributes:
+      label: 证据边界
+      options:
+        - label: 我理解维护者必须另行完成脱敏、编码、验证、公开评审和日期确认，证据记录才能支持严格限定范围的声明。
+          required: true

.github/ISSUE_TEMPLATE/disabled-developer-task-result.yml

@@ -0,0 +1,100 @@
+name: Disabled-developer task result
+description: Submit a consented, de-identified result from a disabled developer completing a versioned DSH task protocol.
+title: "[Disabled developer result]: "
+labels:
+  - accessibility
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Partial and failed results are welcome. Use one Issue for one participant, one versioned protocol, and one exact product/environment combination. A dedicated assistive technology is optional: record it only when it was actually used. Do not disclose identity, diagnosis, disability details, contact information, one-use URLs, credentials, private prompts, raw recordings, or unreviewed logs. This Issue is source material and never creates an `a11y-user-validated` claim by itself.
+  - type: checkboxes
+    id: authority
+    attributes:
+      label: Participation, consent, and privacy
+      options:
+        - label: The task performer identifies as a disabled developer; no diagnosis or disability detail is required or included.
+          required: true
+        - label: I am submitting my own result or have explicit permission to submit this de-identified summary.
+          required: true
+        - label: The participant separately consented to publication of this de-identified summary.
+          required: true
+        - label: A private withdrawal route was provided; covered material can be removed without publishing participant contact details.
+          required: true
+        - label: I removed credentials, private prompts, conversations, usernames, personal data, sensitive paths, raw recordings, consent records, and contact details.
+          required: true
+  - type: textarea
+    id: protocol
+    attributes:
+      label: Versioned protocol and task inventory
+      description: Use one protocol from the evidence catalog. List every stable task ID attempted. To satisfy a disabled-developer baseline row, one participant must complete every representative-core task for that protocol in this one record.
+      placeholder: |
+        Protocol:
+        Stable task IDs attempted:
+        Exact lab or CLI instructions used:
+        Date of the run:
+    validations:
+      required: true
+  - type: textarea
+    id: matrix
+    attributes:
+      label: Exact build and environment
+      placeholder: |
+        DSH version and full revision:
+        Participating component versions and full revisions:
+        OS/build and physical hardware or VM:
+        Browser and version, or terminal/shell and versions:
+        Assistive technologies and versions actually used, if any:
+        Input and output methods:
+        UI locale and relevant settings:
+    validations:
+      required: true
+  - type: dropdown
+    id: assistance
+    attributes:
+      label: Highest assistance level used
+      description: Select the exact ledger category. Disclose assistance even when the task succeeded.
+      options:
+        - None (`none`)
+        - Setup only (`setup-only`)
+        - Verbal guidance during the task (`verbal`)
+        - Sighted operation during the task (`sighted-operation`)
+        - Other operational assistance (`other`)
+    validations:
+      required: true
+  - type: textarea
+    id: tasks
+    attributes:
+      label: Task-by-task result
+      description: For every stable task ID, record pass, partial, or fail; whether it was completed independently, effectively, and safely; focus/cursor behavior; actual AT output only when observed; assistance; elapsed time if useful; workaround; and the smallest reproducible barrier.
+      placeholder: |
+        task-id:
+        - Outcome: pass / partial / fail
+        - Independent: yes / no
+        - Effective: yes / no
+        - Safe: yes / no
+        - Focus/cursor and actual AT observation, if applicable:
+        - Assistance, workaround, and barrier:
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Safety and control
+      description: Record whether the participant understood approvals, rejection, destructive or privacy consequences, errors, recovery, and the final task outcome. State any moment when control or confidence was lost.
+    validations:
+      required: true
+  - type: textarea
+    id: limitations
+    attributes:
+      label: Limitations and non-generalization
+      description: State what was not tested, every visual or human assistance channel used, and why this one result cannot represent all disabled developers or environments.
+    validations:
+      required: true
+  - type: checkboxes
+    id: claim_boundary
+    attributes:
+      label: Evidence boundary
+      options:
+        - label: I understand that a support claim requires a separate sanitized, validated, dated, and publicly reviewed evidence record.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,7 +14,9 @@ Describe the behavior, the product boundary that owns it, and any compatibility
 - [ ] Keyboard behavior and focus lifecycle are covered for changed interaction.
 - [ ] Names, roles, states, relationships, and announcements are covered for changed UI.
 - [ ] English and Simplified Chinese product/support documentation remain aligned.
-- [ ] Support claims identify exact DSH, OS, browser, AT, language, and configuration versions.
+- [ ] The public human-evidence ledger validates when evidence files change.
+- [ ] Aggregate evidence coverage was reviewed when records, catalog tasks, or coverage policy changed; incompatible environments were not combined.
+- [ ] Support claims identify exact DSH and component revisions, OS, browser or terminal, AT when used, language, configuration, task, and validity period.
 - [ ] Automated evidence is not described as manual screen-reader or disabled-user validation.
 
 List commands, scenarios, artifacts, and assistive-technology results:
@@ -27,4 +29,4 @@ List commands, scenarios, artifacts, and assistive-technology results:
 
 ## Release evidence
 
-Does this change add, expand, invalidate, or renew an accessibility support claim or evidence badge? If yes, link the updated matrix, limitations, evidence, owner, and review date.
+Does this change add, expand, invalidate, or renew an accessibility support claim or evidence badge? If yes, link the updated matrix, limitations, validated `dsh-a11y-human-evidence/0.1.0-draft` record, public review, owner, and review date.

.github/workflows/ci.yml

@@ -28,18 +28,61 @@ jobs:
           node-version: ${{ matrix.node }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - if: matrix.os == 'ubuntu-latest' && matrix.node == '24.x'
+        run: pnpm run evidence:validate
       - run: pnpm run typecheck
       - run: pnpm test
       - run: pnpm run build
       - run: npm pack --dry-run --json
 
+  assembled-browser:
+    name: Assembled DSH browser contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out companion
+        uses: actions/checkout@v7
+      - name: Check out exact patched DSH baseline
+        uses: actions/checkout@v7
+        with:
+          repository: omdsh-dev/deepseek-harness
+          ref: dsh-v0.1.1-rc.2-a11y.4
+          path: .assembled/dsh
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11.7.0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24.x
+          cache: pnpm
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            .assembled/dsh/pnpm-lock.yaml
+      - name: Install and build companion
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm run build
+      - name: Install and build DSH baseline
+        working-directory: .assembled/dsh
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm run build:official
+          pnpm --dir apps/web exec playwright install --with-deps chromium firefox webkit
+      - name: Run external-plugin assembled browser protocol
+        run: pnpm run test:assembled .assembled/dsh . chromium,firefox,webkit
+      - name: Smoke-test disposable AT lab startup and cleanup
+        run: pnpm run lab:at .assembled/dsh . none 500
+
   ci:
     name: CI gate
     if: always()
-    needs: validate
+    needs: [validate, assembled-browser]
     runs-on: ubuntu-latest
     steps:
       - name: Require every matrix job
         env:
           VALIDATE_RESULT: ${{ needs.validate.result }}
-        run: test "$VALIDATE_RESULT" = success
+          ASSEMBLED_RESULT: ${{ needs.assembled-browser.result }}
+        run: |
+          test "$VALIDATE_RESULT" = success
+          test "$ASSEMBLED_RESULT" = success

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 lib/
 artifacts/
+.assembled/
 *.tgz
 .DS_Store