@marinjursic/prc-windows-arm64 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Production Readiness Checklist contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,3 @@
+# Production Readiness Checklist native package
+
+This internal platform package is installed automatically by `@marinjursic/prc`. Install and invoke the launcher package instead of depending on this package directly.

package/bin/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Production Readiness Checklist contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/README.md

@@ -0,0 +1,335 @@
+<div align="center">
+
+<img src="docs/assets/social-card.png" alt="Production Readiness Checklist — Know what's ready and what still needs work" width="100%">
+
+# Production Readiness Checklist
+
+**Know what's ready and what still needs work.**
+
+10,042 evidence-driven controls plus a read-only scanner for understanding what a project has proved, what failed, and what still needs review.
+
+[![Controls](https://img.shields.io/badge/controls-10%2C042-2563eb)](docs/engineering/00-overview.md)
+[![Validate](https://github.com/MarinJursic/production-readiness-checklist/actions/workflows/validate.yml/badge.svg)](https://github.com/MarinJursic/production-readiness-checklist/actions/workflows/validate.yml)
+[![Docs](https://img.shields.io/badge/docs-GitHub%20Pages-0f766e)](https://marinjursic.github.io/production-readiness-checklist/)
+[![GitHub stars](https://img.shields.io/github/stars/MarinJursic/production-readiness-checklist?logo=github&color=f59e0b)](https://github.com/MarinJursic/production-readiness-checklist)
+[![License: MIT](https://img.shields.io/badge/license-MIT-f59e0b.svg)](LICENSE)
+
+[Begin the complete review](docs/engineering/00-overview.md) · [Check a release quickly](docs/guides/getting-started.md) · [Use with an AI agent](docs/guides/ai-assisted-review.md) · [Contribute](CONTRIBUTING.md)
+
+⭐ [Star this project](https://github.com/MarinJursic/production-readiness-checklist) · 🤝 [Help improve it](CONTRIBUTING.md) · [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fmarinjursic.github.io%2Fproduction-readiness-checklist%2F) · [Share on X](https://twitter.com/intent/tweet?text=Production%20Readiness%20Checklist%3A%20know%20what%27s%20ready%20and%20what%20still%20needs%20work.&url=https%3A%2F%2Fmarinjursic.github.io%2Fproduction-readiness-checklist%2F)
+
+</div>
+
+---
+
+Production readiness is not “all tests are green.” It is an evidence-backed decision about the exact product and artifact you intend to operate.
+
+This repository provides one start-to-finish review path:
+
+1. **Engineering lifecycle:** 8,621 unique `USEQ-*` controls across 16 phases, from governance and requirements through implementation, delivery, operations, AI, and specialized domains.
+2. **Production decision:** 1,421 `PRC-*` controls across ten release tracks, ending with evidence, sign-off, deployment, and verification.
+
+The source material contained 25,359 checkbox lines across 215 documents. It was consolidated into 16 navigable lifecycle manuals, with exact duplicates, repeated boilerplate, mirrored production controls, and 1,969 repeated cross-volume occurrences in the final corpus removed. The [source consolidation manifest](docs/engineering/source-manifest.md) records the treatment of every source document and section.
+
+> [!IMPORTANT]
+> No checklist or AI review can prove that a nontrivial application has zero defects. A credible decision requires current evidence, explicit risk ownership, and tested recovery paths. One material failure can block approval regardless of how many unrelated controls pass.
+
+## Start here
+
+For a product-wide assessment, begin with the [complete engineering review](docs/engineering/00-overview.md) and follow phases 1–16 in order. Then complete the production-release tracks.
+
+For an imminent release with an established engineering baseline:
+
+1. Copy the [release assessment template](docs/records/release-assessment.md).
+2. Run the [immediate no-go screen](docs/checklists/01-release-foundations.md#2-immediate-no-go-conditions).
+3. Review affected lifecycle controls and every applicable production track.
+4. Record Pass, Fail, Blocked, or Not Applicable against each stable control ID.
+5. Complete the [evidence and decision track](docs/checklists/10-evidence-and-decision.md).
+
+## Complete engineering review
+
+| Phases | Coverage |
+| --- | --- |
+| [1. Governance](docs/engineering/01-governance-and-foundations.md) · [2. Product](docs/engineering/02-product-and-requirements.md) · [3. UX](docs/engineering/03-user-experience-web-and-content.md) · [4. Architecture](docs/engineering/04-architecture-and-design.md) | Scope, ownership, risk, requirements, user experience, and system design |
+| [5. Code](docs/engineering/05-code-quality-and-implementation.md) · [6. Services and APIs](docs/engineering/06-application-services-and-apis.md) · [7. Data](docs/engineering/07-data-and-information-lifecycle.md) · [8. Security](docs/engineering/08-security-and-cryptography.md) · [9. Privacy](docs/engineering/09-privacy-and-data-protection.md) · [10. Testing](docs/engineering/10-verification-and-testing.md) | Product construction and verification |
+| [11. Platform and delivery](docs/engineering/11-developer-experience-platform-and-delivery.md) · [12. Operations and SRE](docs/engineering/12-operations-sre-and-support.md) · [13. Documentation](docs/engineering/13-documentation-and-knowledge.md) | Build, deploy, observe, recover, support, and maintain |
+| [14. Trust and safety](docs/engineering/14-trust-safety-and-ecosystems.md) · [15. AI and ML](docs/engineering/15-ai-ml-and-ai-assisted-development.md) · [16. Specialized domains](docs/engineering/16-specialized-domains-and-release-assurance.md) | Triggered and emerging product risks, connected to final release assurance |
+
+The order is for dependable navigation, not a waterfall mandate. Iterative teams can revisit phases continuously, but every applicable control still needs a disposition before final approval.
+
+## Final production review
+
+The ten production tracks cover release identity and no-go conditions; product risk and architecture; source, build, and supply chain; environments, quality, and experience; application security; data, privacy, and performance; reliability and operations; maintenance, vendors, and compliance; conditional features; and the final evidence-backed decision.
+
+[Start the production review](docs/checklists/01-release-foundations.md) or read the [readiness principle](docs/checklists/00-readiness-principle.md).
+
+## Use it with Claude or another coding agent
+
+The root [`CLAUDE.md`](CLAUDE.md) and copy-ready prompts teach an agent to distinguish verified evidence from assumptions, cite repository evidence, and leave production-only or organizational questions Blocked.
+
+```text
+Perform a read-only, full-lifecycle review using CLAUDE.md.
+Review docs/engineering phases 1–16, then docs/checklists for the final release gate.
+Cite evidence for every Pass and list every unknown separately.
+Do not modify code and do not make the final release decision.
+```
+
+- [Full repository review prompt](docs/prompts/full-readiness-review.md)
+- [Release-diff review prompt](docs/prompts/release-diff-review.md)
+- [Evidence challenge prompt](docs/prompts/evidence-challenge.md)
+- [AI-assisted review guide](docs/guides/ai-assisted-review.md)
+
+## Scanner: quickest path
+
+The experimental scanner turns the checklist into a repeatable repository assessment. Every scan puts all **10,042 controls** in the detailed report. The quick profile runs 18 high-signal local checks, while the default `prc/core-repository@1.0` profile runs 40 narrow deterministic checks. A narrow check can prove one exact fact, but it cannot silently mark a broader control as fully passed. Everything that still needs proof stays visible.
+
+A normal scan is read-only. It does **not** fix files, run project code, install project dependencies, or turn missing evidence into a pass.
+
+<div align="center">
+
+<a href="docs/assets/production-readiness-scan-demo.mp4"><img src="docs/assets/production-readiness-scan-demo.gif" alt="A continuous 27-second demo of prc scan checking a sample project, showing pass and fail evidence, and opening the readiness report" width="960"></a>
+
+<sub>Run one command, review exact evidence, then explore the full 10,042-control report. Click the demo for the sharper MP4.</sub>
+
+</div>
+
+### Easiest setup with npm
+
+The npm package source, launcher, six native platform packages, and release builder are implemented. The public package names were still unpublished when checked on August 25, 2026, so the commands below start working after the first release is listed in this project's release notes.
+
+```bash
+npm install -D @marinjursic/prc
+npx prc quick
+```
+
+Use `npx prc scan` for the larger 40-check local scan. That is the normal short path. The package has no install scripts and no third-party JavaScript dependencies. It does not download a binary after installation. npm selects one platform package; the launcher checks its release manifest and native binary hash, then starts it without a shell.
+
+For a security-sensitive or repeatable install, pin a version from the scanner release notes and disable dependency install hooks:
+
+```bash
+npm install -D -E --ignore-scripts --no-audit --no-fund @marinjursic/prc@X.Y.Z
+npm exec --offline --no -- prc scan
+```
+
+The install places reviewed package files in `node_modules` and updates `package.json` and `package-lock.json`; review those changes before committing them. The offline run fails instead of downloading a missing package.
+
+For a short command that the whole project can reuse, add this to `package.json`:
+
+```json
+{
+  "scripts": {
+    "scan": "prc scan"
+  }
+}
+```
+
+Run it with `npm run scan`. npm reserves its top-level command names, so a project cannot add a custom `npm scan` command. Use `npm run --ignore-scripts scan` when you also want npm to skip `prescan` and `postscan` hooks.
+
+### One-time setup from source
+
+You need Git and Go 1.27 or a compatible later supported toolchain.
+
+```bash
+git clone https://github.com/MarinJursic/production-readiness-checklist.git
+cd production-readiness-checklist
+go mod verify
+go build -trimpath -o prc ./cmd/prc
+./prc doctor
+```
+
+The `prc` binary is now ready. `doctor` checks that the target and bundled catalog
+can be read and explains any missing optional tool; it does not run the target.
+Keep the binary in this directory, because the scanner automatically finds the compatible bundled `catalog/` beside it. Published scanner release archives already contain the binary, catalog, adapter manifests, schemas, and scanner guides together; verify a downloaded archive as described in the [release guide](docs/scanner/releases.md), extract it, and run from anywhere without installing project dependencies.
+
+To use `prc` without the `./` prefix, add this entire directory to `PATH`; do not move only the binary away from its compatible catalog. On macOS or Linux, for example: `export PATH="/absolute/path/to/production-readiness-checklist:$PATH"`.
+
+### Scan a project
+
+Choose one of three clear levels:
+
+```bash
+# Fast local screen: 18 high-signal checks, no AI.
+./prc quick /path/to/your/project
+
+# Core local scan: 40 checks, no AI.
+./prc scan /path/to/your/project
+
+# Full catalog AI advice, after provider login.
+./prc full codex /path/to/your/project
+# or: ./prc full claude /path/to/your/project
+```
+
+Every level still lists all 10,042 controls in the report. `quick` means fewer
+local checks and less terminal noise; it does not mean the other controls
+passed. `full` runs the core local scan and asks the selected AI provider for
+advice on every active control. AI advice remains unverified.
+
+From the extracted or cloned scanner directory:
+
+```bash
+./prc scan /path/to/your/project
+```
+
+To scan the current directory, use:
+
+```bash
+./prc scan
+```
+
+The command accepts options before or after the project path. The terminal shows every deterministic result with a word and symbol. On a real terminal, Pass is green and Fail is red; redirected and machine output has no color:
+
+```text
+  ╭────────────────────────────────────────────────────╮
+  │  ✓  PRODUCTION READINESS CHECKLIST                 │
+  │     Know what's ready and what still needs work.   │
+  ╰────────────────────────────────────────────────────╯
+
+Production Readiness Checklist 0.1.0-dev
+
+Run: 91c2…
+Profile: prc/core-repository@1.0
+Target: example-api (4c0e…)
+Mode: scan only — no fixes and no project scripts
+
+Checking 40 deterministic assertions...
+
+  ✓ PASS     PRC-A-CORE-001  Observed README.md.
+  ✗ FAIL     PRC-A-CORE-007  No supported lock file was found for node.
+  ! BLOCKED  PRC-A-CORE-013  The optional analysis was not authorized.
+  ? MANUAL   PRC-A-CORE-012  An accountable reviewer must supply evidence.
+
+  ╭─ SCAN COMPLETE
+  │ Needs work
+  │ ██████████████████░░ 93% · 37/40 applicable checks passed
+  │ 1 failed · 1 unresolved · 1 manual · 0 not applicable
+  ╰─ One or more required local checks failed.
+
+Needs attention
+  ✗ FAIL     HIGH     PRC-A-CORE-007  No supported lock file was found for node.
+  ! BLOCKED  MEDIUM   PRC-A-CORE-013  The optional analysis was not authorized.
+  ? MANUAL   LOW      PRC-A-CORE-012  An accountable reviewer must supply evidence.
+
+Coverage
+  Local checks     40 total · 37 passed · 3 need attention · 0 did not apply
+  Full catalog     10042/10042 included · 10020 need evidence or review
+
+Report
+  Detailed report: /Users/you/Library/Caches/prc/reports/example-api-91c2….html
+  Open it for remediation steps, evidence, category scores, and all controls.
+  Scan mode: report only; no fixes were applied. No project scripts were run.
+```
+
+Open the reported HTML file in a browser. The first screen shows the project, one large score, the readiness result, and four counts: passed, failed, review, and not needed. Smaller category scores come next, followed by verified problems sorted from critical to informational. Each problem begins as a compact, severity-colored row; open it to see the full reason and suggested next action. Scoring notes, passed checks, raw evidence, long file lists, IDs, scan metadata, and the complete 10,042-control catalog stay behind clearly labeled detail controls until you need them. `needs_review` means the scanner has not proved the broad rule. `partially_verified` means linked narrow checks passed; it is still not a complete Pass. Reports are private and stored outside the scanned project by default, so creating one does not change the project being scanned.
+
+The report separates verified problems, narrow checks that passed, unresolved
+local checks, manual decisions, broad controls still needing evidence, and AI
+advice. An AI citation can be marked `snapshot_location_validated` only when it
+points to a real line in the exact screened snapshot. Its claim is still marked
+`advisory_unverified`: a real line can be irrelevant or misunderstood.
+
+A result-bearing exit code is not a crash: `0` means the selected profile passed, `1` means an active gate failed, and `2` means evidence remains incomplete or blocked. Use `--exit-policy never` only when a script should always receive `0` after a completed report; the report still preserves the real terminal state.
+
+Useful report options:
+
+```bash
+# Choose a new output path; an existing file is never overwritten.
+./prc scan /path/to/project --report /safe/path/readiness.html
+
+# Print JSON for another tool. Machine formats do not create an extra HTML file.
+./prc scan /path/to/project --format json --exit-policy never > readiness.json
+
+# Explicitly suppress the default HTML report.
+./prc scan /path/to/project --no-report
+```
+
+The native `prc scan` command remains available for Go, Python, Java, Rust, infrastructure, air-gapped, and mixed repositories that do not use npm.
+
+### Optional deep review with Codex or Claude Code
+
+The ordinary scan is local and deterministic. AI review is a separate option for broad or subjective rules such as project-appropriate folder structure. First sign in through an installed provider CLI, then scan:
+
+```bash
+prc login codex
+prc full codex
+```
+
+For Claude Code, use:
+
+```bash
+prc login claude
+prc full claude
+```
+
+`prc auth` shows login status and `prc logout codex` or `prc logout claude` clears the scanner's saved login. These commands use each provider's official sign-in flow. The scanner stores that login in a private scanner-only directory, separate from the provider's normal configuration, plugins, instructions, and sessions. Existing supported API-key environment variables remain an alternative.
+
+`prc full` uses the same guarded path as `prc scan --ai`. Selecting the provider is also your explicit permission to send bounded, secret-screened source excerpts to that remote provider. The provider receives no target workspace path and gets no shell, file-reading, write, web, MCP, or install tools. Do not enable AI review for source that its provider is not allowed to process.
+
+The full run is intentionally large: controls are sent in sealed batches of at most eight, and the coordinator must create one separate subagent for every control. Completed batches are saved outside the target and reused when the same scan resumes. This can take a long time and use many tokens. AI results are always labeled advisory; they cannot create a verified Pass, a final Not Applicable decision, or modify the project.
+
+Advanced options such as reviewing one control, changing effort, or setting a Claude cost limit remain available in the [safe AI control review](docs/scanner/ai-control-review.md).
+
+### What it checks today
+
+The default profile checks repository governance, immutable source identity, dependency and runtime declarations, discoverable tests, GitHub Actions safety, private-key armor, OpenAPI contracts, Go HTTP timeout hazards, container definitions, Terraform locks, and Kubernetes workload policy. Focused API, Kubernetes, supply-chain, and infrastructure-as-code profiles are also available. Reviewed offline OCI adapters exist for Gitleaks, Syft, Grype, and Checkov, but external analyzers are never launched by the simple command; they require an explicit `verify-local` capability grant, an exact profile binding, and pinned local inputs. The [infrastructure policy guide](docs/scanner/infrastructure-policy.md) includes the exact Checkov command and its limits.
+
+The scanner includes every production concern in its report, but it does not pretend every concern can be proved from source code. Unsupported runtime, organizational, environment, legal, and human evidence stays visibly blocked or in review. That is intentional: the report describes what was actually proven for one target and evidence set, not an unqualified claim that software has no defects.
+
+Fixing is a separate workflow. `prc scan` never calls it. The bounded `prc fix` command works only in isolated candidate directories and supports a deliberately small set of independently verifiable changes; it never merges, deploys, or releases anything automatically.
+
+Continue with the [complete scanner quick start](docs/scanner/getting-started.md), [safe start-to-finish walkthrough](docs/scanner/security-walkthrough.md), [CLI and exit codes](docs/scanner/cli-contract.md), [diagnostics](docs/scanner/doctor.md), [read-only agent integration](docs/scanner/mcp-agent-integration.md), [project configuration](docs/scanner/configuration.md), [state and history](docs/scanner/state-and-history.md), [supply-chain scanning](docs/scanner/supply-chain.md), and [isolated remediation](docs/scanner/remediation.md). The [research findings and improvement plan](research/PROJECT_RESEARCH_AND_IMPROVEMENT_PLAN.md) records the Reddit audit, standards review, coverage gaps, and prioritized next work. Architecture details live in the [product contract](docs/architecture/product-contract.md), [trust model](docs/architecture/trust-model.md), [adapter protocol](docs/architecture/adapters.md), [evidence model](docs/architecture/evidence-and-results.md), and [remediation contract](docs/architecture/remediation-contract.md).
+
+## Evidence, not checkbox theater
+
+| Field | Example |
+| --- | --- |
+| Control | `USEQ-1A2B3C4D` or `PRC-34-017` |
+| Status | Pass / Fail / Blocked / Not Applicable |
+| Owner | One accountable person |
+| Evidence | Test run, configuration export, dashboard, decision record, or drill report |
+| Scope | Product, commit, artifact, configuration, data, and environment |
+| Reviewed | Reviewer, date, freshness, and limitations |
+| Exception | Risk owner, compensating control, remediation date, and expiry |
+
+Use the [evidence record](docs/records/evidence-record.md) and [risk exception](docs/records/risk-exception.md) templates to keep reviews auditable.
+
+## Repository structure
+
+```text
+.
+├── adapters/                 # Reviewed, immutable external-analyzer manifests
+├── CLAUDE.md                  # Guardrails for AI-assisted reviews
+├── catalog/                   # Versioned objectives, assertions, and profiles
+├── cmd/prc/                   # Experimental scanner CLI
+├── docs/
+│   ├── engineering/           # 16-phase lifecycle review + source manifest
+│   ├── checklists/            # 10 final production tracks
+│   ├── guides/                # Adoption and AI-review guidance
+│   ├── prompts/               # Copy-ready agent prompts
+│   ├── records/               # Evidence, risk, release, and decision templates
+│   └── scanner/               # Scanner usage and generated profile documentation
+├── fixtures/                  # Positive, negative, and adversarial scanner cases
+├── scanner/                   # Inventory, evaluation, adapters, and bounded remediation
+├── schemas/                   # Versioned catalog and scanner JSON schemas
+├── scripts/                   # Generation, validation, and integrity tooling
+└── .github/                   # Issue forms, PR template, and CI workflows
+```
+
+## Standards and scope
+
+The structure was researched against whole-lifecycle and engineering-quality sources including ISO/IEC/IEEE 12207:2026, SWEBOK Guide V4.0, ISO/IEC 25010:2023, NIST SSDF 1.1, OWASP ASVS, WCAG 2.2, NIST AI RMF, and DORA guidance. See [references and scope](docs/references.md) for primary links and limitations.
+
+This project is engineering guidance, not legal advice, a certification, or a substitute for qualified security, privacy, accessibility, safety, or compliance review.
+
+## Contributing
+
+This project should improve through real-world experience. If a control is missing, duplicated, unclear, outdated, incorrectly categorized, or difficult to verify, please help fix it. Contributions can expand the checklist, improve existing wording and evidence guidance, strengthen the documentation and tooling, or advance the future AI scanner.
+
+- [Propose a missing or improved control](https://github.com/MarinJursic/production-readiness-checklist/issues/new?template=control-proposal.yml)
+- [Report a documentation or navigation problem](https://github.com/MarinJursic/production-readiness-checklist/issues/new?template=documentation.yml)
+- Read the [contribution guide](CONTRIBUTING.md) and open a focused pull request
+
+First-time contributors are welcome. Please report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
+If this project helps your team, [star the repository](https://github.com/MarinJursic/production-readiness-checklist), share the [documentation site](https://marinjursic.github.io/production-readiness-checklist/), or use GitHub’s **Cite this repository** action via [CITATION.cff](CITATION.cff).
+
+Released under the [MIT License](LICENSE).

package/bin/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,74 @@
+# Third-party notices
+
+## Checkov executable image and embedded policies
+
+`adapters/checkov-v3.3.8.yaml` references the official immutable
+[Checkov v3.3.8](https://github.com/bridgecrewio/checkov/releases/tag/3.3.8)
+OCI image for offline Terraform, Kubernetes, and Dockerfile policy analysis.
+The image and its embedded policies are not vendored in this repository.
+Checkov is copyright Bridgecrew and contributors and is licensed under the
+[Apache License 2.0](https://github.com/bridgecrewio/checkov/blob/3.3.8/LICENSE).
+
+The adapter disables network access, policy downloads, result uploads,
+external module downloads, and variable evaluation. Policy results remain
+subject to the licenses and notices of the checks and dependencies included in
+the upstream image.
+
+## Grype executable image and vulnerability database
+
+`adapters/grype-v0.116.1.yaml` references the official immutable
+[Grype v0.116.1](https://github.com/anchore/grype/releases/tag/v0.116.1) OCI
+image for offline repository dependency-vulnerability analysis. The image and
+the separately acquired vulnerability database are not vendored in this
+repository. Grype is copyright Anchore, Inc. and contributors and is licensed
+under the [Apache License 2.0](https://github.com/anchore/grype/blob/v0.116.1/LICENSE).
+
+Grype databases are distributed by Anchore from `grype.anchore.io`. A scan
+accepts only a locally mounted schema-v6 database whose official archive URL
+contains an immutable SHA-256 checksum and whose recorded build time is no more
+than 120 hours old. Database content and provider feeds retain their respective
+upstream terms; consult the database source metadata before redistribution.
+
+## Syft executable image
+
+`adapters/syft-v1.51.0.yaml` references the official immutable non-root
+[Syft v1.51.0](https://github.com/anchore/syft/releases/tag/v1.51.0) OCI image
+for offline software bill-of-materials generation. The image is not vendored in
+this repository. Syft is copyright Anchore, Inc. and contributors and is
+licensed under the [Apache License 2.0](https://github.com/anchore/syft/blob/v1.51.0/LICENSE).
+
+## Gitleaks default configuration
+
+`scanner/adapter/gitleaks-v8.30.0.toml.gz` is a deterministic gzip container for
+the unmodified default configuration from
+[Gitleaks v8.30.0](https://github.com/gitleaks/gitleaks/tree/v8.30.0), embedded
+for deterministic offline secret scanning. The archive SHA-256 is
+`da1838bd7cedb1bbd297163435c1675e777babb98ddf641a653f309733bd1fd1`;
+the exact decompressed configuration SHA-256 is
+`e163e53b9e7e8a8511e77271e2b323ed057759542a6d988258afe3a1fa329caf`.
+
+The repository's `.gitleaksignore` contains one full fingerprint for the
+historical uncompressed vendored configuration, whose own detector patterns
+triggered one of its rules. It does not suppress a rule or current path.
+
+MIT License
+
+Copyright (c) 2019 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/adapters/checkov-v3.3.8.yaml

@@ -0,0 +1,50 @@
+schema_version: prc.adapter-manifest/v0.4
+id: prc.adapter.checkov@3.3
+title: Checkov offline infrastructure policy analysis
+description: Runs the reviewed Checkov 3.3.8 image against exactly the inventoried Terraform, Kubernetes, and container definition files with scanner-owned offline policy.
+publisher:
+  id: prc-project
+  name: Production Readiness Checklist
+owner: scanner-maintainers
+maintenance: active
+protocol: prc-adapter-checkov-json-v1
+output_schema: checkov.report/v3.3.8+prc-v1
+observation_kinds: [iac-policy]
+compatibility:
+  engine_apis: [prc.engine/v0.1]
+tool:
+  name: checkov
+  version: 3.3.8
+  upstream: https://github.com/bridgecrewio/checkov
+  formats:
+    - name: checkov-json
+      versions: [3.3.8]
+limitations:
+  - Evaluates only statically inventoried Terraform, Terraform JSON, Kubernetes, and Dockerfile inputs with the checks embedded in the pinned Checkov image.
+  - Does not run Helm, Kustomize, CDK, Serverless, external modules, external checks, variable evaluation, Prisma Cloud enrichment, result upload, or network-backed policy downloads.
+  - Target Checkov configuration cannot change the scanner-owned framework, input, output, suppression, download, or failure policy; inline suppressions and parsing errors fail the adapter closed.
+  - A file for which Checkov produces no passed or failed policy record is reported as unsupported rather than clean.
+  - Static policy analysis can contain false positives and false negatives and does not prove the security or behavior of deployed infrastructure.
+runner: oci
+image: docker.io/bridgecrew/checkov@sha256:c64ffb6d6fc8087c896341a2c697770a04a1cf558db04fa7b8129d8ca6bce336
+command:
+  - --config-file
+  - /workspace/.prc/checkov-config.json
+capabilities:
+  read_workspace: true
+  write_scratch: true
+  network: deny
+  network_hosts: []
+  secret_handles: []
+  child_processes: true
+resources:
+  timeout_seconds: 300
+  memory_mb: 2048
+  cpus: 1
+  pids: 128
+  tmpfs_mb: 256
+  max_line_bytes: 262144
+  max_messages: 100000
+  max_stdin_bytes: 1024
+  max_stdout_bytes: 134217728
+  max_stderr_bytes: 65536

package/bin/adapters/gitleaks-v8.30.0.yaml

@@ -0,0 +1,63 @@
+schema_version: prc.adapter-manifest/v0.4
+id: prc.adapter.gitleaks@8.30
+title: Gitleaks current-tree secret detection
+description: Runs the reviewed Gitleaks 8.30.0 image against the exact sealed inventory snapshot and normalizes a fully redacted JSON report.
+publisher:
+  id: prc-project
+  name: Production Readiness Checklist
+owner: scanner-maintainers
+maintenance: active
+protocol: prc-adapter-gitleaks-json-v1
+output_schema: gitleaks.report/v8.30.0
+observation_kinds: [secret-detection]
+compatibility:
+  engine_apis: [prc.engine/v0.1]
+tool:
+  name: gitleaks
+  version: 8.30.0
+  upstream: https://github.com/gitleaks/gitleaks
+  formats:
+    - name: gitleaks-json
+      versions: [8.30.0]
+limitations:
+  - Scans only regular files in the current sealed inventory; Git history and symlinks are not scanned.
+  - Files larger than 10 MiB, archives, and recursively decoded content are not scanned.
+  - Uses the pinned upstream default rules and ignores target-owned Gitleaks configuration, ignore files, and allow comments.
+  - Secret detection can produce false positives and false negatives; a clean result is not proof that no secret exists.
+runner: oci
+image: ghcr.io/gitleaks/gitleaks@sha256:691af3c7c5a48b16f187ce3446d5f194838f91238f27270ed36eef6359a574d9
+command:
+  - dir
+  - --no-banner
+  - --no-color
+  - --log-level=fatal
+  - --config=/dev/stdin
+  - --gitleaks-ignore-path=/dev/null
+  - --ignore-gitleaks-allow
+  - --max-archive-depth=0
+  - --max-decode-depth=0
+  - --max-target-megabytes=10
+  - --timeout=110
+  - --redact=100
+  - --report-format=json
+  - --report-path=-
+  - --exit-code=0
+  - /workspace
+capabilities:
+  read_workspace: true
+  write_scratch: false
+  network: deny
+  network_hosts: []
+  secret_handles: []
+  child_processes: true
+resources:
+  timeout_seconds: 120
+  memory_mb: 512
+  cpus: 1
+  pids: 64
+  tmpfs_mb: 1
+  max_line_bytes: 262144
+  max_messages: 10000
+  max_stdin_bytes: 1048576
+  max_stdout_bytes: 16777216
+  max_stderr_bytes: 65536

package/bin/adapters/grype-v0.116.1.yaml

@@ -0,0 +1,58 @@
+schema_version: prc.adapter-manifest/v0.4
+id: prc.adapter.grype@0.116
+title: Grype offline dependency vulnerability analysis
+description: Runs the reviewed Grype 0.116.1 image against the exact sealed inventory with a hash-bound fresh offline database and preserves a canonical enriched report.
+publisher:
+  id: prc-project
+  name: Production Readiness Checklist
+owner: scanner-maintainers
+maintenance: active
+protocol: prc-adapter-grype-json-v1
+output_schema: grype.report/v0.116.1+prc-v1
+observation_kinds: [dependency-vulnerability]
+compatibility:
+  engine_apis: [prc.engine/v0.1]
+tool:
+  name: grype
+  version: 0.116.1
+  upstream: https://github.com/anchore/grype
+  formats:
+    - name: grype-json
+      versions: [0.116.1]
+limitations:
+  - Scans packages discoverable from regular files in the current sealed repository inventory; it does not assess a built release artifact or container image.
+  - Requires an operator-supplied Grype schema-v6 database built no more than 120 hours before the scan and acquired separately with the reviewed Grype database workflow.
+  - Package discovery, ecosystem matching, advisory correlation, severity, fixes, CVSS, EPSS, KEV, and risk data can contain false positives, false negatives, aliases, delays, or incomplete metadata.
+  - The scanner-owned configuration disables network access, application update checks, database updates, external Maven lookup, target ignore/VEX policy, and target Grype configuration.
+  - Default Grype matcher behavior and its built-in kernel-header ignore rules remain in effect; ignored or suppressed matches and package alerts cause this adapter to fail closed.
+  - A clean repository result is time-bound to the recorded database and is not proof that no vulnerability exists or that dependencies are reachable in production.
+runner: oci
+image: ghcr.io/anchore/grype@sha256:1e71065c0a4cff3e6bd3b8add525ffac4343eb4971694eb90a31cf6d4d3e85db
+command:
+  - dir:/workspace
+  - --quiet
+  - --config=/workspace/.prc/grype-config.yaml
+  - --output=json
+capabilities:
+  read_workspace: true
+  write_scratch: true
+  network: deny
+  network_hosts: []
+  secret_handles: []
+  child_processes: true
+resources:
+  timeout_seconds: 300
+  memory_mb: 2048
+  cpus: 1
+  pids: 128
+  tmpfs_mb: 256
+  max_line_bytes: 262144
+  max_messages: 10000
+  max_stdin_bytes: 1024
+  max_stdout_bytes: 134217728
+  max_stderr_bytes: 65536
+data_mounts:
+  - name: grype-db
+    destination: /prc-inputs/grype-db
+    max_files: 16
+    max_bytes: 3221225472