agent-security-lens 0.1.0

package/scripts/verify-examples.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+
+import { assess } from "../src/assessment/assess.mjs";
+import { compareAssessmentResults } from "../src/results/compare-results.mjs";
+
+const EXAMPLES = [
+  {
+    name: "openclaw-like",
+    target: "./examples/openclaw-like",
+    profile: "openclaw-like",
+    expectedProfile: "openclaw-like",
+    minFindings: 8
+  },
+  {
+    name: "hermes-like",
+    target: "./examples/hermes-like",
+    profile: "hermes-like",
+    expectedProfile: "hermes-like",
+    minFindings: 8
+  },
+  {
+    name: "dot-openclaw autodetect",
+    target: "./examples/dot-openclaw",
+    expectedProfile: "openclaw-like",
+    minFindings: 3
+  },
+  {
+    name: "dot-hermes autodetect",
+    target: "./examples/dot-hermes",
+    expectedProfile: "hermes-like",
+    minFindings: 3
+  }
+];
+
+let failed = false;
+const results = new Map();
+
+for (const example of EXAMPLES) {
+  const result = await assess({
+    targetPath: example.target,
+    requestedProfile: example.profile
+  });
+  results.set(example.name, result);
+
+  const findingCount = result.findings.length;
+  const profileIds = result.profiles.map((profile) => profile.id);
+  const hasRecommendations = result.findings.every((finding) => {
+    return finding.recommended_actions.length && finding.recommended_alternatives.length;
+  });
+  const hasLineage =
+    result.assessment.id &&
+    result.lineage.profile_selection.selected_profile &&
+    result.lineage.algorithms.length &&
+    result.rule_packs.length &&
+    result.recommendation_packs.length &&
+    result.trust_signal_taxonomies.length;
+  const hasStructuredRecommendations = result.findings.every((finding) => {
+    return finding.recommendations?.length && finding.recommendations[0].one_step_commands?.length;
+  });
+  const hasTrustSignals =
+    result.trust_signals.length &&
+    result.summary.trust_signal_summary?.total === result.trust_signals.length;
+
+  console.log(
+    `${example.name}: ${findingCount} findings, trust score ${result.summary.trust_score}, profiles ${profileIds.join(", ")}`
+  );
+
+  if (!profileIds.includes(example.expectedProfile)) {
+    console.error(`Expected ${example.name} to include profile ${example.expectedProfile}.`);
+    failed = true;
+  }
+
+  if (findingCount < example.minFindings) {
+    console.error(`Expected at least ${example.minFindings} findings for ${example.name}.`);
+    failed = true;
+  }
+
+  if (!hasRecommendations) {
+    console.error(`Expected every finding to include actions and alternatives for ${example.name}.`);
+    failed = true;
+  }
+
+  if (!hasLineage) {
+    console.error(`Expected assessment lineage and rule pack metadata for ${example.name}.`);
+    failed = true;
+  }
+
+  if (!hasStructuredRecommendations) {
+    console.error(`Expected every finding to include structured recommendations for ${example.name}.`);
+    failed = true;
+  }
+
+  if (!hasTrustSignals) {
+    console.error(`Expected trust signals and trust signal summary for ${example.name}.`);
+    failed = true;
+  }
+}
+
+const comparison = compareAssessmentResults(
+  results.get("openclaw-like"),
+  results.get("dot-openclaw autodetect")
+);
+
+if (!Number.isInteger(comparison.score.delta)) {
+  console.error("Expected comparison score delta to be an integer.");
+  failed = true;
+}
+
+if (
+  comparison.finding_counts.added +
+    comparison.finding_counts.resolved +
+    comparison.finding_counts.persistent ===
+  0
+) {
+  console.error("Expected comparison to include finding delta data.");
+  failed = true;
+}
+
+if (failed) {
+  process.exitCode = 1;
+}

package/scripts/verify-mcp-server.mjs

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+const child = spawn(process.execPath, ["./apps/mcp-server/agent-security-lens-mcp.mjs"], {
+  cwd: process.cwd(),
+  env: { ...process.env, ASL_MODE: "local" },
+  stdio: ["pipe", "pipe", "pipe"]
+});
+
+let output = "";
+let errorOutput = "";
+child.stdout.on("data", (chunk) => {
+  output += chunk.toString("utf8");
+});
+child.stderr.on("data", (chunk) => {
+  errorOutput += chunk.toString("utf8");
+});
+
+function send(message) {
+  child.stdin.write(`${JSON.stringify(message)}\n`);
+}
+
+send({
+  jsonrpc: "2.0",
+  id: 1,
+  method: "initialize",
+  params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "smoke", version: "0.1.0" } }
+});
+send({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} });
+send({
+  jsonrpc: "2.0",
+  id: 4,
+  method: "tools/call",
+  params: {
+    name: "get_install_policy",
+    arguments: {}
+  }
+});
+send({
+  jsonrpc: "2.0",
+  id: 5,
+  method: "tools/call",
+  params: {
+    name: "get_intelligence_status",
+    arguments: {}
+  }
+});
+send({
+  jsonrpc: "2.0",
+  id: 3,
+  method: "tools/call",
+  params: {
+    name: "review_before_install",
+    arguments: {
+      component_name: "filesystem",
+      component_type: "mcp",
+      install_command: "npx -y @modelcontextprotocol/server-filesystem ."
+    }
+  }
+});
+send({
+  jsonrpc: "2.0",
+  id: 6,
+  method: "tools/call",
+  params: {
+    name: "review_before_install",
+    arguments: {
+      component_name: "mcp-chrome",
+      component_type: "mcp",
+      source_url: "https://github.com/hangwin/mcp-chrome",
+      planned_use: "Browser automation for autonomous web tasks.",
+      requested_permissions: ["browser-access", "network-access"],
+      submit_if_unknown: true
+    }
+  }
+});
+send({
+  jsonrpc: "2.0",
+  id: 7,
+  method: "tools/call",
+  params: {
+    name: "report_install_outcome",
+    arguments: {
+      component_name: "filesystem",
+      component_type: "mcp",
+      decision: "allow_with_restrictions",
+      outcome: "restriction_applied",
+      restriction_applied: true
+    }
+  }
+});
+send({
+  jsonrpc: "2.0",
+  id: 8,
+  method: "tools/call",
+  params: {
+    name: "submit_decision_feedback",
+    arguments: {
+      component_name: "filesystem",
+      component_type: "mcp",
+      decision: "allow_with_restrictions",
+      feedback_type: "helpful",
+      rating: 5
+    }
+  }
+});
+
+const responseDeadline = Date.now() + 5000;
+while (Date.now() < responseDeadline) {
+  const responseIds = new Set(
+    output
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .map((line) => {
+        try {
+          return JSON.parse(line).id;
+        } catch {
+          return null;
+        }
+      })
+  );
+  if ([1, 2, 3, 4, 5, 6, 7, 8].every((id) => responseIds.has(id))) break;
+  await new Promise((resolve) => setTimeout(resolve, 50));
+}
+child.kill();
+
+const lines = output
+  .split(/\r?\n/)
+  .filter(Boolean)
+  .map((line) => JSON.parse(line));
+
+const toolList = lines.find((line) => line.id === 2);
+const review = lines.find((line) => line.id === 3);
+if (!toolList?.result?.tools?.some((tool) => tool.name === "review_before_install")) {
+  console.error("MCP smoke failed: review_before_install not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!toolList?.result?.tools?.some((tool) => tool.name === "get_install_policy")) {
+  console.error("MCP smoke failed: get_install_policy not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!toolList?.result?.tools?.some((tool) => tool.name === "get_intelligence_status")) {
+  console.error("MCP smoke failed: get_intelligence_status not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!toolList?.result?.tools?.some((tool) => tool.name === "report_install_outcome")) {
+  console.error("MCP smoke failed: report_install_outcome not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!toolList?.result?.tools?.some((tool) => tool.name === "submit_decision_feedback")) {
+  console.error("MCP smoke failed: submit_decision_feedback not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!toolList?.result?.tools?.some((tool) => tool.name === "get_research_status")) {
+  console.error("MCP smoke failed: get_research_status not listed");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+const reviewText = review?.result?.content?.[0]?.text || "";
+if (!reviewText.includes("ask_user") || !reviewText.includes("filesystem-write")) {
+  console.error("MCP smoke failed: review result did not include expected decision and risk");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+const reviewJson = JSON.parse(reviewText);
+if (
+  reviewJson.agent_decision_contract?.contract_version !== "asl-agent-decision-contract@0.2.0" ||
+  reviewJson.agent_decision_contract?.automatic_install_allowed !== false ||
+  reviewJson.component?.curated_baseline !== true ||
+  reviewJson.component?.reviewed !== false
+) {
+  console.error("MCP smoke failed: review result did not include expected agent decision contract");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!reviewJson.one_step_action || reviewJson.one_step_action.action_type !== "ask_user_before_install") {
+  console.error("MCP smoke failed: one_step_action was not machine executable");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+if (!reviewJson.agent_actions?.some((action) => action.id === "report-install-outcome" && action.tool === "report_install_outcome")) {
+  console.error("MCP smoke failed: agent action lifecycle did not require outcome reporting");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+const policy = lines.find((line) => line.id === 4);
+const policyText = policy?.result?.content?.[0]?.text || "";
+if (!policyText.includes("review_before_install") || !policyText.includes("agent_decision_contract")) {
+  console.error("MCP smoke failed: install policy did not include expected agent behavior");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+const status = lines.find((line) => line.id === 5);
+const statusText = status?.result?.content?.[0]?.text || "";
+if (!statusText.includes('"mode": "local"') || !statusText.includes("offline fallback")) {
+  console.error("MCP smoke failed: intelligence status did not include expected local mode");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+const candidateReview = lines.find((line) => line.id === 6);
+const candidateText = candidateReview?.result?.content?.[0]?.text || "";
+const candidateJson = JSON.parse(candidateText);
+const candidateCatalogAvailable = existsSync(
+  join(process.cwd(), "data", "intelligence", "candidates", "2026-06-07-component-catalog.json")
+);
+if (candidateCatalogAvailable) {
+  if (
+    candidateJson.component?.intelligence_state !== "monitored" ||
+    candidateJson.intelligence_coverage?.source !== "monitored_catalog" ||
+    candidateJson.decision !== "ask_user" ||
+    candidateJson.agent_decision_contract?.research_status_required_before_retry !== true ||
+    candidateJson.recommended_alternatives?.length !== 0 ||
+    candidateJson.alternative_coverage?.status !== "not_applicable"
+  ) {
+    console.error("MCP smoke failed: candidate intelligence path did not return expected contract");
+    console.error(output || errorOutput);
+    process.exit(1);
+  }
+  if (
+    !candidateJson.catalog_research_submission?.queued ||
+    candidateJson.catalog_research_submission?.research_task?.next_agent_action?.automatic_install_retry_allowed !== false
+  ) {
+    console.error("MCP smoke failed: cataloged candidate was not queued for ASL research");
+    console.error(output || errorOutput);
+    process.exit(1);
+  }
+} else {
+  if (
+    candidateJson.component?.intelligence_state !== "unknown" ||
+    candidateJson.intelligence_coverage?.source !== "submitted_metadata_inference" ||
+    candidateJson.agent_decision_contract?.blocks_install !== true ||
+    candidateJson.agent_decision_contract?.research_status_required_before_retry !== true ||
+    candidateJson.recommended_alternatives?.length !== 0 ||
+    candidateJson.alternative_coverage?.status !== "not_applicable"
+  ) {
+    console.error("MCP smoke failed: public fallback unknown-component path did not return expected contract");
+    console.error(output || errorOutput);
+    process.exit(1);
+  }
+  if (
+    !candidateJson.unknown_component?.submission?.queued ||
+    candidateJson.unknown_component?.submission?.research_task?.next_agent_action?.automatic_install_retry_allowed !== false
+  ) {
+    console.error("MCP smoke failed: unknown public component was not queued for ASL research");
+    console.error(output || errorOutput);
+    process.exit(1);
+  }
+}
+
+const outcome = lines.find((line) => line.id === 7);
+const outcomeText = outcome?.result?.content?.[0]?.text || "";
+if (!outcomeText.includes('"source": "local_fallback"') && !outcomeText.includes('"source": "asl_cloud"')) {
+  console.error("MCP smoke failed: install outcome was not recorded");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+const feedback = lines.find((line) => line.id === 8);
+const feedbackText = feedback?.result?.content?.[0]?.text || "";
+if (!feedbackText.includes('"source": "local_fallback"') && !feedbackText.includes('"source": "asl_cloud"')) {
+  console.error("MCP smoke failed: decision feedback was not recorded");
+  console.error(output || errorOutput);
+  process.exit(1);
+}
+
+console.log("mcp server: tools/list and review_before_install checked");

package/scripts/verify-registry.mjs

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+
+import { readdir, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const VALID_SEVERITIES = new Set(["critical", "high", "medium", "low", "info"]);
+const VALID_CATEGORIES = new Set([
+  "execution-risk",
+  "remote-access-risk",
+  "data-exposure-risk",
+  "supply-chain-risk",
+  "persistence-automation-risk"
+]);
+
+async function readJson(path) {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+
+async function listJsonFiles(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...(await listJsonFiles(path)));
+    } else if (entry.name.endsWith(".json")) {
+      files.push(path);
+    }
+  }
+  return files;
+}
+
+function requireString(item, field, label, failures) {
+  if (!item[field] || typeof item[field] !== "string") {
+    failures.push(`${label} missing string field: ${field}`);
+  }
+}
+
+function requireArray(item, field, label, failures) {
+  if (!Array.isArray(item[field])) {
+    failures.push(`${label} missing array field: ${field}`);
+  }
+}
+
+const profileFiles = await listJsonFiles(join(ROOT, "profiles"));
+const rulePackFiles = await listJsonFiles(join(ROOT, "rule-packs"));
+const recommendationPackFiles = await listJsonFiles(join(ROOT, "data", "recommendations"));
+const ecosystemFiles = await listJsonFiles(join(ROOT, "data", "ecosystems"));
+const trustFiles = await listJsonFiles(join(ROOT, "data", "trust"));
+const profiles = [];
+const rulePacks = [];
+const recommendationPacks = [];
+const ecosystemRegistries = [];
+const trustRegistries = [];
+const failures = [];
+
+for (const file of profileFiles) {
+  profiles.push({ file, data: await readJson(file) });
+}
+
+for (const file of rulePackFiles) {
+  rulePacks.push({ file, data: await readJson(file) });
+}
+
+for (const file of recommendationPackFiles) {
+  recommendationPacks.push({ file, data: await readJson(file) });
+}
+
+for (const file of ecosystemFiles) {
+  ecosystemRegistries.push({ file, data: await readJson(file) });
+}
+
+for (const file of trustFiles) {
+  trustRegistries.push({ file, data: await readJson(file) });
+}
+
+const profileIds = new Map();
+const rulePackIds = new Map();
+
+for (const { file, data } of profiles) {
+  const label = `profile ${data.id || file}`;
+  requireString(data, "id", label, failures);
+  requireString(data, "version", label, failures);
+  requireString(data, "status", label, failures);
+  requireArray(data, "rule_packs", label, failures);
+  requireArray(data, "known_limitations", label, failures);
+
+  if (profileIds.has(data.id)) failures.push(`duplicate profile id: ${data.id}`);
+  profileIds.set(data.id, data);
+}
+
+for (const { file, data } of rulePacks) {
+  const label = `rule pack ${data.id || file}`;
+  requireString(data, "id", label, failures);
+  requireString(data, "version", label, failures);
+  requireArray(data, "rules", label, failures);
+
+  if (rulePackIds.has(data.id)) failures.push(`duplicate rule pack id: ${data.id}`);
+  rulePackIds.set(data.id, data);
+}
+
+for (const { data } of profiles) {
+  for (const parentId of data.extends || []) {
+    if (!profileIds.has(parentId)) failures.push(`profile ${data.id} extends unknown profile ${parentId}`);
+  }
+
+  for (const packId of data.rule_packs || []) {
+    if (!rulePackIds.has(packId)) failures.push(`profile ${data.id} references unknown rule pack ${packId}`);
+  }
+}
+
+const ruleIds = new Set();
+for (const { data: pack } of rulePacks) {
+  for (const rule of pack.rules || []) {
+    const label = `rule ${pack.id}/${rule.id || "unknown"}`;
+    requireString(rule, "id", label, failures);
+    requireString(rule, "title", label, failures);
+    requireString(rule, "category", label, failures);
+    requireString(rule, "severity", label, failures);
+    requireArray(rule, "permissions", label, failures);
+    requireArray(rule, "patterns", label, failures);
+    requireArray(rule, "recommended_actions", label, failures);
+    requireArray(rule, "recommended_alternatives", label, failures);
+    requireString(rule, "migration_instruction", label, failures);
+
+    if (ruleIds.has(rule.id)) failures.push(`duplicate rule id: ${rule.id}`);
+    ruleIds.add(rule.id);
+    if (!VALID_SEVERITIES.has(rule.severity)) failures.push(`${label} has invalid severity: ${rule.severity}`);
+    if (!VALID_CATEGORIES.has(rule.category)) failures.push(`${label} has invalid category: ${rule.category}`);
+    if (typeof rule.confidence !== "number" || rule.confidence < 0 || rule.confidence > 1) {
+      failures.push(`${label} confidence must be between 0 and 1`);
+    }
+    if (!rule.recommended_actions?.length) failures.push(`${label} must include recommended actions`);
+    if (!rule.recommended_alternatives?.length) failures.push(`${label} must include recommended alternatives`);
+  }
+}
+
+const recommendationIds = new Set();
+for (const { data: pack } of recommendationPacks) {
+  const label = `recommendation pack ${pack.id}`;
+  requireString(pack, "id", label, failures);
+  requireString(pack, "version", label, failures);
+  requireString(pack, "status", label, failures);
+  requireArray(pack, "recommendations", label, failures);
+
+  for (const recommendation of pack.recommendations || []) {
+    const itemLabel = `recommendation ${pack.id}/${recommendation.id || "unknown"}`;
+    requireString(recommendation, "id", itemLabel, failures);
+    requireString(recommendation, "title", itemLabel, failures);
+    requireString(recommendation, "type", itemLabel, failures);
+    requireString(recommendation, "status", itemLabel, failures);
+    requireString(recommendation, "source", itemLabel, failures);
+    requireArray(recommendation, "recommended_actions", itemLabel, failures);
+    requireArray(recommendation, "recommended_alternatives", itemLabel, failures);
+    requireString(recommendation, "agent_instruction", itemLabel, failures);
+    requireString(recommendation, "rollback_note", itemLabel, failures);
+
+    if (recommendationIds.has(recommendation.id)) {
+      failures.push(`duplicate recommendation id: ${recommendation.id}`);
+    }
+    recommendationIds.add(recommendation.id);
+
+    if (typeof recommendation.confidence !== "number" || recommendation.confidence < 0 || recommendation.confidence > 1) {
+      failures.push(`${itemLabel} confidence must be between 0 and 1`);
+    }
+    if (!Number.isInteger(recommendation.rank)) {
+      failures.push(`${itemLabel} rank must be an integer`);
+    }
+    if (!recommendation.applies_to || typeof recommendation.applies_to !== "object") {
+      failures.push(`${itemLabel} missing applies_to object`);
+    }
+    if (!recommendation.recommended_actions?.length) {
+      failures.push(`${itemLabel} must include recommended actions`);
+    }
+    if (!recommendation.recommended_alternatives?.length) {
+      failures.push(`${itemLabel} must include recommended alternatives`);
+    }
+    if (!recommendation.one_step_commands?.length) {
+      failures.push(`${itemLabel} must include at least one one-step command or instruction`);
+    }
+  }
+}
+
+const ecosystemCandidateIds = new Set();
+for (const { data: registry } of ecosystemRegistries) {
+  const label = `ecosystem registry ${registry.id}`;
+  requireString(registry, "id", label, failures);
+  requireString(registry, "version", label, failures);
+  requireString(registry, "status", label, failures);
+  requireArray(registry, "candidates", label, failures);
+
+  for (const candidate of registry.candidates || []) {
+    const itemLabel = `ecosystem candidate ${registry.id}/${candidate.id || "unknown"}`;
+    requireString(candidate, "id", itemLabel, failures);
+    requireString(candidate, "name", itemLabel, failures);
+    requireString(candidate, "entity_type", itemLabel, failures);
+    requireString(candidate, "lifecycle_status", itemLabel, failures);
+    requireString(candidate, "claim_status", itemLabel, failures);
+    requireArray(candidate, "regions", itemLabel, failures);
+    requireArray(candidate, "why_candidate", itemLabel, failures);
+    requireArray(candidate, "known_or_expected_artifacts", itemLabel, failures);
+    requireArray(candidate, "data_needs", itemLabel, failures);
+    requireArray(candidate, "profile_impacts", itemLabel, failures);
+
+    if (ecosystemCandidateIds.has(candidate.id)) {
+      failures.push(`duplicate ecosystem candidate id: ${candidate.id}`);
+    }
+    ecosystemCandidateIds.add(candidate.id);
+    if (!Number.isInteger(candidate.priority)) {
+      failures.push(`${itemLabel} priority must be an integer`);
+    }
+    if (!candidate.why_candidate?.length) {
+      failures.push(`${itemLabel} must explain why it is tracked`);
+    }
+    if (!candidate.data_needs?.length) {
+      failures.push(`${itemLabel} must list data needs`);
+    }
+  }
+}
+
+const trustSignalIds = new Set();
+for (const { data: registry } of trustRegistries) {
+  const label = `trust registry ${registry.id}`;
+  requireString(registry, "id", label, failures);
+  requireString(registry, "version", label, failures);
+  requireString(registry, "status", label, failures);
+  requireArray(registry, "signals", label, failures);
+
+  for (const signal of registry.signals || []) {
+    const itemLabel = `trust signal ${registry.id}/${signal.id || "unknown"}`;
+    requireString(signal, "id", itemLabel, failures);
+    requireString(signal, "title", itemLabel, failures);
+    requireString(signal, "direction", itemLabel, failures);
+    requireString(signal, "source_type", itemLabel, failures);
+    requireArray(signal, "applies_to", itemLabel, failures);
+    requireArray(signal, "evidence_required", itemLabel, failures);
+    requireString(signal, "description", itemLabel, failures);
+
+    if (trustSignalIds.has(signal.id)) {
+      failures.push(`duplicate trust signal id: ${signal.id}`);
+    }
+    trustSignalIds.add(signal.id);
+    if (!Number.isInteger(signal.weight) || signal.weight < -100 || signal.weight > 100) {
+      failures.push(`${itemLabel} weight must be an integer between -100 and 100`);
+    }
+    if (!["positive", "negative", "neutral"].includes(signal.direction)) {
+      failures.push(`${itemLabel} has invalid direction: ${signal.direction}`);
+    }
+    if (!signal.evidence_required?.length) {
+      failures.push(`${itemLabel} must define required evidence`);
+    }
+  }
+}
+
+console.log(
+  `registry: ${profiles.length} profiles, ${rulePacks.length} rule packs, ${ruleIds.size} rules, ${recommendationIds.size} recommendations, ${ecosystemCandidateIds.size} ecosystem candidates, ${trustSignalIds.size} trust signals checked`
+);
+
+if (failures.length) {
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exitCode = 1;
+}