@marinjursic/prc-linux-arm64 0.1.0 → 0.1.9

package/DISCLOSURE

@@ -0,0 +1,21 @@
+Production Readiness Checklist is a defensive, read-only assessment tool for
+software projects that the user owns or is authorized to inspect.
+
+The scanner includes security-related capabilities that can resemble dual-use
+security tooling. It can identify exposed-secret patterns with bundled,
+version-pinned Gitleaks rules. With an explicit verify-local capability grant,
+it can invoke pinned Gitleaks, Syft, Grype, or Checkov container images against
+local project files. It can also prepare bounded project context for an
+explicitly selected Codex or Claude review. These features are intended to help
+maintainers find production-readiness gaps in their own software.
+
+The default scan does not change project files, install project dependencies,
+run project lifecycle scripts, exploit a target, upload project contents, or
+contact external analyzers. External adapters are opt-in, use exact manifests
+and pinned inputs, and are designed to run without network access. AI review is
+opt-in and advisory; it cannot create a verified pass.
+
+The package contains no exploit payloads and is not intended for unauthorized
+access, credential collection, persistence, evasion, or harm. Users are
+responsible for scanning only projects and systems they are authorized to
+assess.

package/README.md

@@ -1,3 +1,7 @@
 # Production Readiness Checklist native package
 
-This internal platform package is installed automatically by `@marinjursic/prc`. Install and invoke the launcher package instead of depending on this package directly.
+This is one operating-system and CPU build of the native `prc` scanner. It is an internal package installed automatically by `@marinjursic/prc`; install and invoke the launcher instead of depending on this package directly.
+
+The package has no npm dependencies and no install, update, or lifecycle scripts. It does not download a binary after installation. The launcher selects the exact package for the current machine, verifies the release-bound manifest, checks the SHA-256 and size of the native executable and every runtime support file, and fails closed if anything is missing or changed.
+
+A normal scan reads a user-selected project and writes a private report outside that project. It does not fix project files, install project dependencies, or run project scripts. Security analyzers and Codex or Claude review require explicit opt-in. See the launcher package and project documentation for installation, supported commands, the dual-use disclosure, checksums, SBOM, and provenance information.