@enwithai/product-check 0.0.0-stage → 0.1.0

package/ATTRIBUTION.md

@@ -0,0 +1,52 @@
+# Attribution and provenance
+
+## Publisher
+
+- **Project:** Product Check (`@enwithai/product-check`).
+- **Commons:** EnWithAI Engineering Commons. Question: _does this software work, can it be trusted, and what needs to
+  improve?_
+- **Copyright holder:** EnWithAI Technologies (as stated in [LICENSE](LICENSE)).
+- **License:** MIT (decided 2026-10-12, same as the other Commons tools). It applies to all code, documentation, schemas
+  and examples in this repository.
+- **Maintainer:** Koushik Ramani ([@aiwithrk](https://github.com/aiwithrk)), EnWithAI Technologies.
+- **Contact:** [hello@enwithai.com](mailto:hello@enwithai.com)
+- **Security issues:** see [SECURITY.md](SECURITY.md).
+
+## Development provenance
+
+Product Check was written for this repository with substantial AI assistance (Claude Code), directed and reviewed by
+the project's human sponsor. Commits carry a `Co-Authored-By` trailer. It has **no runtime dependencies** and contains
+no vendored third-party code. Test fixtures and the demo application are synthetic; credential-like strings in them
+are generated at run time and are not real.
+
+## Built on
+
+| Upstream                                                                 | Version        | License | How Product Check uses it                       |
+| ------------------------------------------------------------------------ | -------------- | ------- | ----------------------------------------------- |
+| [Node.js](https://nodejs.org)                                            | 22 / 24 / ≥ 26 | MIT     | Runtime only (built-in `fetch`, `crypto`, `fs`) |
+| [JSON Schema](https://json-schema.org)                                   | draft 2020-12  | —       | Contract format for every artifact              |
+| JUnit XML (de facto format)                                              | —              | —       | Input format for executed test results          |
+| [HAR 1.2](https://w3c.github.io/web-performance/specs/HAR/Overview.html) | 1.2 (draft)    | —       | Input format for recorded browser traffic       |
+
+Development tools (TypeScript, Vitest, ESLint, typescript-eslint, Prettier, Ajv) are not distributed. Design
+references are in [REFERENCES.md](REFERENCES.md). Listing a project does not mean its maintainers endorse Product Check.
+
+## Frameworks
+
+| Framework        | Owner                  | Relationship   | Note                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ---------------- | ---------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| CLEAR (CLEAR CT) | NetworkGain Consulting | `inspired`     | The design of the assessment model — separate Customer, Technology and Trust pillars, CT-T0…T6 lifecycle tiers, points of presence, evidence statuses, the rule that strong pillars never hide weak ones, and hard gates overriding scores — was inspired by NetworkGain's CLEAR CT method (v3.1, internal and unpublished). No text, catalog, prompt or scoring table from it is reproduced, and there is no structural relationship. Wording approved for publication on 2026-10-12. |
+| TRACE            | EnWithAI Technologies  | `not-assessed` | Each finding carries an intent → evidence → remediation → retest chain, which may match TRACE's intent; alignment cannot be stated until the TRACE specification is available.                                                                                                                                                                                                                                                                                                         |
+
+## Ecosystem
+
+Product Check is independently usable. It has no dependency on CrewPE, any EnWithAI service or NetworkGain, and it
+contacts no service except an origin the user explicitly authorizes. CrewPE is EnWithAI's enterprise engineering
+lifecycle product and could consume Product Check's JSON results and work packets in governed workflows; no such
+integration exists today. NetworkGain Consulting contributes enterprise value and governance perspective to the
+Commons; using Product Check creates no obligation to engage it.
+
+## Not affiliated
+
+Product Check is not affiliated with, endorsed by or certified by GitHub, Vercel, Supabase, OpenAI, Anthropic, Stripe,
+Google, the OWASP Foundation, the W3C or any framework vendor named in its rules or documentation.

package/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes are documented here. The format follows Keep a Changelog; versions follow SemVer (pre-1.0: minor
+versions may break the results schema, which carries its own `schema_version`, and the rubric, which carries
+`rubric_version`).
+
+## Unreleased
+
+## 0.1.0 — 2026-10-12
+
+First release without a pre-release suffix, so `npm install @enwithai/product-check` and `npx @enwithai/product-check` work without a
+tag. No functional changes from 0.1.0-alpha.0. Still pre-1.0: the report schema and command options may change in minor
+versions.
+
+## 0.1.0-alpha.0 — 2026-10-12 (published to npm)
+
+First alpha. MIT licensed.
+
+- `product-check run|retest|scan|init|validate|report|blueprint|dashboard|controls|schema`.
+- Scan → Test → Validate → Blueprint → Dashboard → (advisory) Remediate → Retest, recorded per run.
+- 47 controls across Customer, Technology and Trust, lifecycle tiers CT-T0…CT-T6 with carry-forward, three hard gates.
+- Source inspection (read-only; git metadata parsed without running git; ignored files never read), passive HTTP
+  probe (authorized origin only; optional exposure probe), HAR and recorded-observation replay.
+- Importers: JUnit XML, Jest/Vitest JSON, `npm audit --json`, Spec Check 1.0, Impact Check 2.0, Outcome Check 1.0;
+  contract `control_mappings` link executed tests to any control.
+- Scoring with coverage, confidence, caps and withheld scores; verdict rules; risk acceptances (never for P0).
+- Blueprint with as-is/to-be, remediations, work packets, regression-test candidates, test architecture, traceability.
+- Retest with stable finding IDs, preserved baseline evidence, RESOLVED only with new evidence, PC-T-16 regressions.
+- JSON Schemas (2020-12) for every artifact; built-in validator plus integrity/recomputation checks.
+- Self-contained dashboard (five views, light/dark, accessible, hash-pinned script).
+- Synthetic Vibe Notes demo with baseline, retest, repository-only and aborted examples.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 EnWithAI Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,18 @@
+# NOTICE
+
+Product Check
+Copyright (c) 2026 EnWithAI Technologies
+
+Product Check is licensed under the MIT License (see [LICENSE](LICENSE)). This NOTICE adds no conditions to that
+license.
+
+## Third-party material
+
+Product Check has **no runtime dependencies** and contains no vendored source code. It reads formats defined by others
+(JSON Schema, JUnit XML, HAR, `npm audit` JSON, and the report schemas of Spec Check, Impact Check and Outcome Check);
+no code from those projects is included.
+
+## Trademarks
+
+EnWithAI, CrewPE, CLEAR, TRACE, NetworkGain and related names are not licensed by this repository. See
+[TRADEMARKS.md](TRADEMARKS.md).

package/README.md

@@ -1,3 +1,172 @@
-# Temporary Holding Version
+# Product Check
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Does this software work, can it be trusted, and what needs to improve?**
+_Scan. Validate. Blueprint. Improve._ Evidence-led product assurance and software blueprinting.
+
+Product Check looks at your **repository**, your **deployed app**, or **both**, checks them against a catalog of
+Customer, Technology and Trust controls, and gives you:
+
+- **findings backed by evidence**: file and line, or the exact HTTP response, with a checksum and a redacted excerpt;
+- **three separate scores** (Customer, Technology, Trust), each with coverage and confidence, never averaged together;
+- a **readiness verdict** (`READY`, `READY_WITH_CONDITIONS`, `NOT_READY`, `INCONCLUSIVE`) that hard gates can block
+  and that states exactly what it does and does not cover;
+- an **engineering blueprint**: prioritized fixes, acceptance criteria, regression-test candidates and one
+  **work packet** per fix that you (or any coding agent) can act on;
+- a **local dashboard** and a **retest** loop that shows verified fixes, regressions and trends.
+
+Everything is written to one versioned JSON file. The report, blueprint and dashboard are renderings of it.
+
+> Status: **early release** (`0.1.0`, pre-1.0, results schema `0.1.0`). Install with
+> `npm install --global @enwithai/product-check`, or build from source as in the demo below.
+
+## What it will not pretend
+
+Untested is never passed. Product Check reports `BLOCKED` or `NOT_TESTED` (with the reason) for anything it could not
+check, lowers coverage accordingly, and withholds a score when evidence is thin. It is **not** a penetration test, a
+compliance certification or a guarantee of production readiness. It never runs your repository's code, never logs in,
+never submits forms and never sends anything anywhere except passive GET requests to an origin you authorize.
+
+## Two-minute demo
+
+Requires Node.js 22, 24 or ≥ 26, and git. No account, no network, no runtime dependencies.
+
+```bash
+git clone https://github.com/enwithai/product-check.git && cd product-check
+npm ci --ignore-scripts && npm run build
+cd examples/vibe-app-demo
+node create-app.mjs                     # generates a deliberately weak, synthetic vibe-coded app in ./app
+node ../../dist/cli/main.js run --contract scan-contract.json --observations inputs/observations-baseline.json --out-dir output/baseline
+```
+
+```text
+Verdict: NOT_READY at CT-T2 ("NOT READY")
+  - Hard gate failed: G-SECRETS.
+  - 8 open P0 finding(s).
+  - 1 open P1 finding(s).
+Customer   40/100 (coverage 77%, confidence MEDIUM)
+Technology 4/100 (coverage 80%, confidence MEDIUM)
+Trust      2/100 (coverage 67%, confidence MEDIUM)
+```
+
+Then apply the fixes and retest against that baseline (the app's own tests were run against its fixed build and
+their JUnit output is in `inputs/`):
+
+```bash
+node create-app.mjs --remediate
+node ../../dist/cli/main.js retest --contract scan-contract.json --observations inputs/observations-remediated.json \
+  --test-results inputs/test-results-remediated.xml --baseline output/baseline/product-check-results.json --out-dir output/retest
+open output/retest/dashboard.html       # or xdg-open / start
+```
+
+```text
+Verdict: READY_WITH_CONDITIONS at CT-T2 ("CONDITIONAL")
+  - 2 open P2 finding(s).
+Customer   100/100 (coverage 92%, confidence HIGH)
+Technology 94/100 (coverage 100%, confidence MEDIUM)
+Trust      97/100 (coverage 83%, confidence HIGH)
+Retest vs PCR-20261014T100000Z-7386B1: 35 verified fixed, 0 new, 0 reopened, 0 regressed control(s)
+```
+
+The two remaining P2s (no error monitoring, no AI evaluation suite) are real gaps in the fixed demo app. A
+[repository-only scan](examples/repo-only/report.md) of the same weak app shows the other side of honesty: Customer
+and Trust are **not scored** because, without the running app, too little could be checked.
+
+The committed [baseline](examples/vibe-app-demo/output/baseline/report.md) and
+[retest](examples/vibe-app-demo/output/retest/report.md) outputs are what these commands produce (the test suite
+checks that). See [examples/vibe-app-demo](examples/vibe-app-demo/README.md) for the live version, where the probe
+talks to a local stand-in deployment of the demo app.
+
+## Use it on your project
+
+```bash
+# Your repository (read-only; nothing is executed):
+product-check run --repo .
+
+# Your deployed app (only if you own it or may test it): passive GETs to fixed paths on that origin.
+product-check run --repo . --url https://your-app.example --authorize passive-http
+
+# Also check whether /.env or /.git are publicly served (more intrusive; separately authorized):
+product-check run --repo . --url https://your-app.example --authorize passive-http,exposure-probe
+
+# Add evidence you already have:
+npx vitest run --reporter=junit --outputFile=junit.xml   # or jest-junit, playwright --reporter=junit, pytest --junitxml
+npm audit --json > npm-audit.json
+product-check run --repo . --test-results junit.xml --npm-audit npm-audit.json --stage PRE_LAUNCH
+```
+
+Results go to `.product-check/`: `product-check-results.json`, `report.md`, `blueprint.md`, `work-packets/*.md` and
+`dashboard.html` (open it directly; no server). After changing things, run
+`product-check retest --baseline .product-check/product-check-results.json …` with the same inputs.
+
+No deployed URL you can scan? Export a HAR file from your browser's DevTools on your app and pass `--har app.har`.
+
+For repeatable setups, `product-check init --repo . --url … --stage …` writes a
+[scan contract](docs/assessment-model.md#the-scan-contract) you can edit: declare tenancy, personal data and AI use,
+critical journeys, risk acceptances, and **control mappings** that link your own executed tests (for example
+authorization or tenant-isolation tests) to the controls Product Check cannot test by itself.
+
+## Commands
+
+| Command                            | What it does                                                                                      |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------- |
+| `run`                              | Scan → Test → Validate → Blueprint; writes results and renderings                                 |
+| `retest --baseline <file>`         | `run` plus comparison: verified fixes, reopened and new findings, regressions, trends             |
+| `scan`                             | Discovery only: which points of presence exist and what could be checked (no requests, no checks) |
+| `init`                             | Writes an editable scan contract                                                                  |
+| `validate <file>…`                 | Schema validation; for results also referential integrity and recomputation of scores and verdict |
+| `report`, `blueprint`, `dashboard` | Re-render from a results file                                                                     |
+| `controls`, `schema [name]`        | The control catalog and the JSON Schemas                                                          |
+
+Exit codes: `0` ok · `1` internal error · `2` usage · `3` input · `4` safety refusal · `5` invalid artifact ·
+`6` `--fail-on` matched (for CI gating, for example `--fail-on NOT_READY`). Full reference: [docs/cli.md](docs/cli.md).
+
+## How it decides
+
+- **Pillars** ([assessment model](docs/assessment-model.md)): Customer (can people use it and get value?),
+  Technology (is it built, tested and operated soundly?), Trust (secrets, access, isolation, privacy, AI boundaries).
+- **Lifecycle tiers** CT-T0…CT-T6 ([lifecycle tiers](docs/lifecycle-tiers.md)), selected from your declared stage,
+  with carry-forward: a later tier always includes earlier tiers' controls.
+- **Scoring and gates** ([scoring and gates](docs/scoring-and-gates.md)): pass = 1, partial = ½, fail = 0, weighted;
+  coverage and confidence shown beside every score; open P0/P1 cap the pillar; failed hard gates force `NOT_READY`;
+  unverified gates force `INCONCLUSIVE`.
+- **Safety** ([safety and authorization](docs/safety-and-authorization.md)): what is never done, and what needs
+  explicit, scoped authorization.
+
+## Privacy and security
+
+No telemetry, account, model call or child process. The repository is read, never executed; git-ignored files (such
+as your local `.env`) are listed but never read. Evidence keeps short redacted excerpts, never file or response
+contents; response headers are filtered to a security-relevant allowlist with cookie values removed. The dashboard is
+a single file with a hash-pinned script and a `default-src 'none'` Content-Security-Policy. See
+[SECURITY.md](SECURITY.md) and [docs/threat-model.md](docs/threat-model.md).
+
+## Documentation
+
+[Philosophy](docs/philosophy.md) · [Architecture](docs/architecture.md) ·
+[Assessment model](docs/assessment-model.md) · [Scoring and gates](docs/scoring-and-gates.md) ·
+[Lifecycle tiers](docs/lifecycle-tiers.md) · [Safety and authorization](docs/safety-and-authorization.md) ·
+[Interoperability](docs/interoperability.md) · [CLI](docs/cli.md) · [Threat model](docs/threat-model.md) ·
+[Branding and attribution](docs/branding-and-attribution.md) · [Implementation status](IMPLEMENTATION_STATUS.md) ·
+[Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Governance](GOVERNANCE.md)
+
+## License
+
+MIT © EnWithAI Technologies. Not affiliated with or endorsed by any
+platform or framework vendor named in this repository.
+
+---
+
+<sub>**Check the spec. Check the impact. Check the outcome. Check the product.** Product Check is the fourth check, with
+[Impact Check](https://github.com/enwithai/impact-check), [Spec Check](https://github.com/enwithai/spec-check) and
+[Outcome Check](https://github.com/enwithai/outcome-check).</sub>
+
+<sub>An **EnWithAI Engineering Commons** initiative. Developed and maintained by EnWithAI Technologies, contributing to
+open, verifiable and accountable AI-assisted software engineering. Part of the broader [CrewPE](https://crewpe.ai)
+engineering ecosystem. Product Check is independently usable and does not require CrewPE. Enterprise advisory and
+transformation perspectives are supported through [NetworkGain Consulting](https://networkgain.com).
+Attribution: [ATTRIBUTION.md](ATTRIBUTION.md) · Notices: [NOTICE.md](NOTICE.md) · Trademarks:
+[TRADEMARKS.md](TRADEMARKS.md) · References: [REFERENCES.md](REFERENCES.md).</sub>
+
+<sub>The design of Product Check's assessment model (separate Customer, Technology and Trust pillars, lifecycle tiers,
+points of presence, evidence-before-opinion) was inspired by NetworkGain's CLEAR CT method. There is no structural
+relationship — see [ATTRIBUTION.md](ATTRIBUTION.md#frameworks).</sub>

package/SECURITY.md

@@ -0,0 +1,27 @@
+# Security policy
+
+## Supported versions
+
+Pre-release. Once published, only the latest `0.x` alpha will receive fixes.
+
+## Reporting a vulnerability
+
+Please **do not open a public issue**. Use GitHub's private vulnerability reporting (once the repository is public)
+or write to [hello@enwithai.com](mailto:hello@enwithai.com). Include the Product Check version, the command and a
+minimal **synthetic** reproduction. Never send real results, HAR files or repositories: they can contain secrets.
+
+## Security properties Product Check is designed to keep
+
+- It never executes repository code, starts processes or uses `eval`/dynamic imports.
+- It never reads git-ignored files, and stores only short redacted excerpts and checksums as evidence.
+- It sends network requests only when explicitly authorized, only passive GETs to fixed paths on one origin, with no
+  cookies, credentials or bodies, a request budget and timeouts. It never follows redirects to other origins.
+- It refuses prohibited actions (production writes, destructive tests, outreach, payments, active scanning,
+  credentialed access, personal-data extraction) whatever a contract says.
+- It has no telemetry, account or model calls.
+- Generated Markdown and HTML escape all untrusted text; the dashboard has a `default-src 'none'` CSP and one
+  hash-pinned inline script.
+- A results file whose figures do not recompute is flagged and cannot be used as a baseline.
+
+A violation of any of these is a security bug. See [docs/threat-model.md](docs/threat-model.md) and
+[docs/safety-and-authorization.md](docs/safety-and-authorization.md).

package/TRADEMARKS.md

@@ -0,0 +1,23 @@
+# Trademarks and names
+
+The MIT License covers this repository's code and documentation. **It does not grant rights to use
+the names below**, except as allowed by law (for example, to truthfully say that you use or modify Product Check).
+
+None of these names is a registered trademark. EnWithAI Technologies uses its names together with the EnWithAI name
+(for example "EnWithAI CrewPE"), and NetworkGain Consulting uses CLEAR together with the NetworkGain name.
+
+| Name                                             | Used by                | Status                                                                                                         |
+| ------------------------------------------------ | ---------------------- | -------------------------------------------------------------------------------------------------------------- |
+| EnWithAI ("Engineering with AI for Enterprises") | EnWithAI Technologies  | company and brand name; not registered                                                                         |
+| CrewPE                                           | EnWithAI Technologies  | product name, used as "EnWithAI CrewPE"; not registered                                                        |
+| TRACE                                            | EnWithAI Technologies  | framework name, used as "EnWithAI TRACE"; not registered                                                       |
+| NetworkGain                                      | NetworkGain Consulting | company and brand name; not registered                                                                         |
+| CLEAR, CLEAR CT                                  | NetworkGain Consulting | framework name, used as "NetworkGain CLEAR"; not registered                                                    |
+| Product Check                                    | EnWithAI Technologies  | descriptive project name, used as "EnWithAI Product Check"; not claimed as a trademark; name clearance pending |
+
+**You may:** say your work uses, is based on or is compatible with Product Check; fork it; rename your fork.
+**Please don't:** use these names to suggest endorsement, certification or affiliation by EnWithAI Technologies or
+NetworkGain Consulting, or describe a Product Check result as a certification.
+
+Other names (GitHub, Node.js, Next.js, Supabase, OpenAI, Stripe, …) belong to their owners and are used only to
+identify those projects or formats.

package/dashboard/README.md

@@ -0,0 +1,6 @@
+# Dashboard assets
+
+`dashboard.css` and `dashboard.js` are inlined into every generated `dashboard.html` by `src/dashboard/render.ts`.
+All figures are rendered server-side from `product-check-results.json`; the script only adds tabs, table filters and
+a theme toggle, and is allowed by a SHA-256 hash in the page's Content-Security-Policy. Generate a dashboard with
+`product-check dashboard <results.json>` (also written by `run`).