memento-mori-jester 0.1.102 → 0.1.104

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to Memento Mori Jester are tracked here.
 
 ## Unreleased
 
+## 0.1.104
+
+- Added checked `installed-package-support.md/json` notes so maintainers can verify and use support examples from the npm package rather than a repo checkout.
+- Extended the support examples index, `npm run support:check`, and `npm run pack:contents:check` so package-relative support paths and repo-only path exclusions stay aligned.
+- Updated README, maintainer triage docs, production-readiness docs, roadmap, and release notes for installed-package support provenance.
+
+## 0.1.103
+
+- Added `npm run pack:contents:check` to verify dry-run package contents include the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example.
+- Wired `pack:dry` and `npm test` through the package contents smoke so release dry runs also exclude repo-local promo, site, private, cache, GitHub workflow, and credential-shaped files.
+- Updated README, release docs, production-readiness docs, roadmap, and release notes for the package surface guard.
+
 ## 0.1.102
 
 - Added a checked public-safe support examples quickstart for a 60-second maintainer handoff from incoming report to lifecycle map, blank worksheet, filled synthetic example, backlog record, and backlog review.

package/README.md

@@ -76,7 +76,7 @@ For trust-building output examples, see [examples/reports](examples/reports). `n
 
 If one of those reports is confusing or stale, use the public-safe [report gallery feedback template](examples/reports/feedback-template.md). It asks for version, nearest gallery example, sanitized command/output summaries, and redacted diagnostics without private repo code or secrets.
 
-Maintainers can use the checked [support examples quickstart](examples/support/support-examples-quickstart.md), [support examples index](examples/support/support-examples-index.md), [support lifecycle map](examples/support/support-lifecycle-map.md), [support lifecycle worksheet](examples/support/support-lifecycle-worksheet.md), synthetic [filled worksheet example](examples/support/support-lifecycle-filled-example.md), [support lifecycle overview](examples/support/support-lifecycle.md), [outcome prioritization guide](examples/support/outcome-prioritization.md), [support backlog records](examples/support/backlog-records.md), [support backlog review](examples/support/backlog-review.md), [support triage playbook](examples/support), [response snippets](examples/support/response-snippets.md), and [support closeout checklist](examples/support/closeout-checklist.md) to turn sanitized reports into a docs example, fixture backlog item, or rule-review candidate without changing behavior first.
+Maintainers can use the checked [support examples quickstart](examples/support/support-examples-quickstart.md), [support examples index](examples/support/support-examples-index.md), [installed-package support note](examples/support/installed-package-support.md), [support lifecycle map](examples/support/support-lifecycle-map.md), [support lifecycle worksheet](examples/support/support-lifecycle-worksheet.md), synthetic [filled worksheet example](examples/support/support-lifecycle-filled-example.md), [support lifecycle overview](examples/support/support-lifecycle.md), [outcome prioritization guide](examples/support/outcome-prioritization.md), [support backlog records](examples/support/backlog-records.md), [support backlog review](examples/support/backlog-review.md), [support triage playbook](examples/support), [response snippets](examples/support/response-snippets.md), and [support closeout checklist](examples/support/closeout-checklist.md) to turn sanitized reports into a docs example, fixture backlog item, or rule-review candidate without changing behavior first.
 
 Expected vibe:
 
@@ -452,6 +452,7 @@ More setup examples:
 - [Report Gallery Feedback Template](examples/reports/feedback-template.md)
 - [Support Examples Quickstart](examples/support/support-examples-quickstart.md)
 - [Support Examples Index](examples/support/support-examples-index.md)
+- [Installed Package Support Examples](examples/support/installed-package-support.md)
 - [Support Lifecycle Map](examples/support/support-lifecycle-map.md)
 - [Support Lifecycle Worksheet](examples/support/support-lifecycle-worksheet.md)
 - [Filled Support Lifecycle Worksheet Example](examples/support/support-lifecycle-filled-example.md)
@@ -485,6 +486,7 @@ Framework CI examples:
 - [Report Gallery Feedback Template](examples/reports/feedback-template.md)
 - [Support Examples Quickstart](examples/support/support-examples-quickstart.md)
 - [Support Examples Index](examples/support/support-examples-index.md)
+- [Installed Package Support Examples](examples/support/installed-package-support.md)
 - [Support Lifecycle Map](examples/support/support-lifecycle-map.md)
 - [Support Lifecycle Worksheet](examples/support/support-lifecycle-worksheet.md)
 - [Filled Support Lifecycle Worksheet Example](examples/support/support-lifecycle-filled-example.md)
@@ -551,10 +553,11 @@ Maintainers can use [docs/MAINTAINER_TRIAGE.md](docs/MAINTAINER_TRIAGE.md) to tu
 Run `npm run fixtures:check` before merging fixture changes; it catches duplicate IDs, missing rule metadata, weak descriptions, unsafe-looking content, and duplicate content.
 Run `npm run fixtures:report` to see fixture coverage by rule, rule family, preset slice, kind, verdict, quiet-pass boundaries, feasible pass-case gaps, and curation-next guidance before choosing the next fixture. Use `npm run fixtures:report -- --markdown` when you want a paste-ready summary for release notes or GitHub issues.
 Run `npm run reports:check` after editing [examples/reports](examples/reports); it verifies the public report gallery against an installed package in a temporary consumer project.
-Run `npm run support:check` after editing issue templates, support docs, the report gallery feedback path, the [support examples quickstart](examples/support/support-examples-quickstart.md), [support examples index](examples/support/support-examples-index.md), [support lifecycle map](examples/support/support-lifecycle-map.md), [support lifecycle worksheet](examples/support/support-lifecycle-worksheet.md), [filled worksheet example](examples/support/support-lifecycle-filled-example.md), [support lifecycle overview](examples/support/support-lifecycle.md), [outcome prioritization guide](examples/support/outcome-prioritization.md), [support backlog records](examples/support/backlog-records.md), [support backlog review](examples/support/backlog-review.md), [support triage playbook](examples/support), [response snippets](examples/support/response-snippets.md), or [support closeout checklist](examples/support/closeout-checklist.md); it verifies the public templates ask for useful redacted context without inviting secrets or private code.
+Run `npm run support:check` after editing issue templates, support docs, the report gallery feedback path, the [support examples quickstart](examples/support/support-examples-quickstart.md), [support examples index](examples/support/support-examples-index.md), [installed-package support note](examples/support/installed-package-support.md), [support lifecycle map](examples/support/support-lifecycle-map.md), [support lifecycle worksheet](examples/support/support-lifecycle-worksheet.md), [filled worksheet example](examples/support/support-lifecycle-filled-example.md), [support lifecycle overview](examples/support/support-lifecycle.md), [outcome prioritization guide](examples/support/outcome-prioritization.md), [support backlog records](examples/support/backlog-records.md), [support backlog review](examples/support/backlog-review.md), [support triage playbook](examples/support), [response snippets](examples/support/response-snippets.md), or [support closeout checklist](examples/support/closeout-checklist.md); it verifies the public templates ask for useful redacted context without inviting secrets or private code.
 Run `npm run promo:card` to regenerate the repo-local social preview card after changing its copy or design.
 Run `npm run promo:check` after editing promo assets; it checks the current demo video, stills, docs, and fixture evidence numbers stay in sync.
 Run `npm run site:check` after editing the repo-local landing page; it verifies the start command, demo links, social card, repo, release, and npm links.
+Run `npm run pack:contents:check` when package contents change; it verifies the dry-run package includes the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example, while excluding repo-local promo, site, private, cache, and credential-shaped files.
 
 For vulnerabilities, private code exposure, or credential-handling concerns, follow [SECURITY.md](SECURITY.md) instead of opening a public issue with sensitive details.
 
@@ -568,6 +571,7 @@ npm.cmd run consumer:quickstart:check
 npm.cmd run reports:check
 npm.cmd run promo:check
 npm.cmd run production:check
+npm.cmd run pack:contents:check
 npm.cmd run pack:dry
 git tag -a v0.1.x -m "Memento Mori Jester v0.1.x"
 git push origin main

package/ROADMAP.md

@@ -6,6 +6,8 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Recently Shipped
 
+- Checked installed-package support provenance in v0.1.104, showing maintainers how to verify and use support examples from the npm package with package-relative paths.
+- Checked package contents support manifest smoke in v0.1.103, proving dry-run packages include the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example while excluding repo-local/private-ish files.
 - Checked support examples quickstart in v0.1.102, giving maintainers a 60-second handoff path from incoming report to map, worksheet, synthetic example, backlog record, and backlog review.
 - Checked support examples index in v0.1.101, telling maintainers when to use the lifecycle map, blank worksheet, and filled synthetic example.
 - Checked filled support lifecycle worksheet example in v0.1.100, showing a synthetic `docs-example` report through report, triage, response, closeout, prioritization, backlog record, and backlog review.

package/docs/MAINTAINER_TRIAGE.md

@@ -21,7 +21,7 @@ For users who just need to understand what a healthy report looks like, point th
 
 For users who say a gallery report is confusing, stale, or hard to compare with their local output, point them at [examples/reports/feedback-template.md](../examples/reports/feedback-template.md) or the GitHub [report gallery feedback issue template](../.github/ISSUE_TEMPLATE/report_gallery_feedback.yml). It asks for the nearest checked example, sanitized command and output summaries, version, and redacted diagnostics without asking for private code.
 
-When a report has enough public-safe detail to triage, start with the checked [support examples quickstart](../examples/support/support-examples-quickstart.md) for a 60-second handoff path, or use the checked [support examples index](../examples/support/support-examples-index.md) to choose the right support artifact. Use the checked [support lifecycle map](../examples/support/support-lifecycle-map.md) for a quick scan of the path, then use the checked [support lifecycle worksheet](../examples/support/support-lifecycle-worksheet.md) to record each stage during active review. Use the synthetic [filled lifecycle worksheet example](../examples/support/support-lifecycle-filled-example.md) when you need to compare a real public-safe report against one completed `docs-example` path. Use the full [support lifecycle overview](../examples/support/support-lifecycle.md) to see the whole path from report to backlog review. Then compare it with the checked [support triage playbook](../examples/support). The playbook walks sanitized report-gallery and false-positive reports through first response, classification, and a follow-up outcome. Use [response-snippets.md](../examples/support/response-snippets.md) to reply consistently after choosing the outcome, then use [closeout-checklist.md](../examples/support/closeout-checklist.md) to record whether the docs clarification shipped or queued, fixture backlog was created, or rule-review candidate was opened. Use [outcome-prioritization.md](../examples/support/outcome-prioritization.md) after closeout to decide whether the follow-up work is low-priority docs, medium-priority fixture backlog, or high-priority rule review. Use [backlog-records.md](../examples/support/backlog-records.md) when that prioritized follow-up needs a public-safe backlog artifact, then use [backlog-review.md](../examples/support/backlog-review.md) to revisit whether that artifact remains active or closes with no action.
+When a report has enough public-safe detail to triage, start with the checked [support examples quickstart](../examples/support/support-examples-quickstart.md) for a 60-second handoff path, or use the checked [support examples index](../examples/support/support-examples-index.md) to choose the right support artifact. If you are working from an installed npm package instead of a repo checkout, use [installed-package-support.md](../examples/support/installed-package-support.md) to verify package-relative support paths with `npm explore memento-mori-jester -- npm run pack:contents:check`. Use the checked [support lifecycle map](../examples/support/support-lifecycle-map.md) for a quick scan of the path, then use the checked [support lifecycle worksheet](../examples/support/support-lifecycle-worksheet.md) to record each stage during active review. Use the synthetic [filled lifecycle worksheet example](../examples/support/support-lifecycle-filled-example.md) when you need to compare a real public-safe report against one completed `docs-example` path. Use the full [support lifecycle overview](../examples/support/support-lifecycle.md) to see the whole path from report to backlog review. Then compare it with the checked [support triage playbook](../examples/support). The playbook walks sanitized report-gallery and false-positive reports through first response, classification, and a follow-up outcome. Use [response-snippets.md](../examples/support/response-snippets.md) to reply consistently after choosing the outcome, then use [closeout-checklist.md](../examples/support/closeout-checklist.md) to record whether the docs clarification shipped or queued, fixture backlog was created, or rule-review candidate was opened. Use [outcome-prioritization.md](../examples/support/outcome-prioritization.md) after closeout to decide whether the follow-up work is low-priority docs, medium-priority fixture backlog, or high-priority rule review. Use [backlog-records.md](../examples/support/backlog-records.md) when that prioritized follow-up needs a public-safe backlog artifact, then use [backlog-review.md](../examples/support/backlog-review.md) to revisit whether that artifact remains active or closes with no action.
 
 Do not ask users to paste secrets, private code, customer data, live credentials, complete CI logs, or unredacted SARIF. If the report involves credential exposure, command execution, unexpected network access, private code disclosure, package publishing, or MCP data exposure, route it through [SECURITY.md](../SECURITY.md).
 

package/docs/PRODUCTION_READINESS.md

@@ -9,6 +9,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - GitHub Releases and npm publishing are automated from annotated `v*` tags through GitHub Actions trusted publishing.
 - CI runs tests and a package dry run on every push to `main` and pull request.
 - The local playground, GitHub Action, MCP setup snippets, preset examples, fixtures, and release notes ship in the npm package.
+- Package dry runs include a support examples manifest smoke so the installed-package support note, index, quickstart, lifecycle map, blank worksheet, and filled synthetic example keep shipping from the tarball.
 - Repo-local promo assets stay outside the npm package, but `npm run promo:check` keeps the current demo video, stills, social card, docs, and fixture evidence numbers aligned.
 - The repo-local landing page stays outside the npm package, but `npm run site:check` keeps its start command and public links aligned.
 
@@ -16,7 +17,8 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 
 - `package.json` includes repository, homepage, bugs, binaries, exports, public package files, and public publish access.
 - `package-lock.json` version matches `package.json`.
-- `npm run pack:dry` confirms the package includes `dist`, `docs`, `examples`, `scripts`, `README.md`, `CHANGELOG.md`, `ROADMAP.md`, and `LICENSE`.
+- `npm run pack:dry` confirms the package includes `dist`, `docs`, `examples`, `scripts`, `README.md`, `CHANGELOG.md`, `ROADMAP.md`, and `LICENSE`, then runs `npm run pack:contents:check`.
+- `npm run pack:contents:check` verifies the dry-run package includes the installed-package support note, support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example, and excludes repo-local promo, site, private, cache, GitHub workflow, and credential-shaped files.
 - `SECURITY.md` ships with the package so vulnerability reporting guidance is visible from the repository and npm tarball.
 - `prepublishOnly` runs tests and a package dry run for local publish attempts.
 
@@ -47,7 +49,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - `README.md` leads with a no-write first run, project bootstrap, agent setup, and optional hooks/CI.
 - `docs/GETTING_STARTED.md`, `docs/CLI.md`, `docs/RELEASE.md`, and `docs/TRUSTED_PUBLISHING.md` cover the core adoption and release paths.
 - `examples/reports` provides checked, public-safe report examples for fresh install diagnostics, summary output, blocked command reviews, and report-gallery feedback.
-- `examples/support` provides a checked support examples quickstart, support examples index, compact support lifecycle map, active-review worksheet, synthetic filled worksheet example, and full support lifecycle overview covering report, triage, response, closeout, prioritization, backlog record, and backlog review, plus the supporting outcome prioritization guide, backlog records, backlog review checklist, maintainer triage playbook, response snippets, and closeout checklist.
+- `examples/support` provides a checked support examples quickstart, support examples index, installed-package support note, compact support lifecycle map, active-review worksheet, synthetic filled worksheet example, and full support lifecycle overview covering report, triage, response, closeout, prioritization, backlog record, and backlog review, plus the supporting outcome prioritization guide, backlog records, backlog review checklist, maintainer triage playbook, response snippets, and closeout checklist.
 - `site/index.html` gives maintainers a static one-page share surface that reuses the demo, social card, start command, and public links.
 - Every public release has matching `CHANGELOG.md` notes and `docs/RELEASE_NOTES_vX.Y.Z.md`.
 
@@ -60,16 +62,17 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - GitHub issue templates collect bug reports, false-positive reports, report-gallery feedback, and feature requests with the diagnostic context maintainers need.
 - `SECURITY.md` routes vulnerability reports away from public issues and asks for redacted diagnostics.
 - `docs/MAINTAINER_TRIAGE.md` explains how to turn useful false-positive reports into fixture coverage before changing rule logic.
-- `examples/support` shows maintainers how to use the quickstart for a live 60-second handoff, choose the right support artifact from the examples index, scan the support lifecycle map, use the support lifecycle worksheet during active review, compare against a synthetic filled worksheet example, audit the full lifecycle overview, classify sanitized reports as a docs example, fixture backlog item, or rule-review candidate before changing behavior, then reply with public-safe response snippets, record the closeout, prioritize follow-up work, create a public-safe backlog record, and review aging records for keep-or-close decisions.
+- `examples/support` shows maintainers how to use the quickstart for a live 60-second handoff, choose the right support artifact from the examples index, verify the same package-relative support artifacts from an installed npm package, scan the support lifecycle map, use the support lifecycle worksheet during active review, compare against a synthetic filled worksheet example, audit the full lifecycle overview, classify sanitized reports as a docs example, fixture backlog item, or rule-review candidate before changing behavior, then reply with public-safe response snippets, record the closeout, prioritize follow-up work, create a public-safe backlog record, and review aging records for keep-or-close decisions.
 - `npm run fixtures:check` validates fixture IDs, metadata, unsafe-looking content, duplicate content, and explicit expected/absent rule intent.
 - `npm run fixtures:report` shows fixture coverage by rule, rule family, preset slice, kind, verdict, quiet-pass rule boundaries, and feasible pass-case gaps so maintainers can pick the next fixture target; `npm run fixtures:report -- --markdown` produces a paste-ready maintainer snapshot.
 - `npm run framework:tuning:check` keeps the framework tuning guide, cookbook JSON, cookbook README, and fixture IDs aligned.
 - `npm run framework:tuning:doctor` runs the cookbook tune commands through the built CLI with temporary preset configs, so package consumers do not inherit stale recipes.
 - `npm run consumer:quickstart:check` installs the package into a temporary minimal project and runs `doctor`, `summary`, and packaged framework tuning checks from that consumer side.
 - `npm run reports:check` installs the package into a temporary minimal project and runs the report gallery's `doctor`, `summary`, and blocked-command examples through that consumer side.
-- `npm run support:check` verifies issue templates, support docs, the report gallery feedback template, support examples quickstart, support examples index, support lifecycle map, support lifecycle worksheet, filled worksheet example, support lifecycle overview, outcome prioritization guide, backlog records, backlog review checklist, maintainer triage playbook, response snippets, and closeout checklist stay public-safe and ask for useful redacted context.
+- `npm run support:check` verifies issue templates, support docs, the report gallery feedback template, support examples quickstart, support examples index, installed-package support note, support lifecycle map, support lifecycle worksheet, filled worksheet example, support lifecycle overview, outcome prioritization guide, backlog records, backlog review checklist, maintainer triage playbook, response snippets, and closeout checklist stay public-safe and ask for useful redacted context.
 - `npm run promo:card` regenerates the deterministic social preview card, and `npm run promo:check` verifies current repo-local promo assets against the current fixture evidence before maintainers post or refresh the demo.
 - `npm run site:check` verifies the static landing page before maintainers post or host it.
+- `npm run pack:contents:check` verifies the npm package surface keeps the support examples manifest files and installed-package provenance note available while excluding repo-only or private-ish paths.
 - npm publish has a manual workflow fallback, but the normal release path is tag-driven trusted publishing.
 
 ## Static Guard
@@ -93,6 +96,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - support triage checks are wired into `npm test`.
 - promo freshness checks are wired into `npm test`.
 - site checks are wired into `npm test`.
+- package contents checks are wired into `npm test` and `npm run pack:dry`.
 
 `npm test` runs this check after the TypeScript build and unit tests.
 

package/docs/RELEASE.md

@@ -21,6 +21,7 @@ npm.cmd run support:check
 npm.cmd run promo:card:check
 npm.cmd run promo:check
 npm.cmd run site:check
+npm.cmd run pack:contents:check
 npm.cmd run pack:dry
 git diff --check
 ```
@@ -89,6 +90,7 @@ npx.cmd -y memento-mori-jester@latest config validate --config jester-security.c
 npm.cmd run consumer:quickstart:check -- --package memento-mori-jester@latest
 npm.cmd run reports:check -- --package memento-mori-jester@latest
 npm.cmd run support:check
+npm.cmd run pack:contents:check
 ```
 
 ## 4. MCP Copy-Paste

package/docs/RELEASE_NOTES_v0.1.103.md

@@ -0,0 +1,45 @@
+# Memento Mori Jester v0.1.103
+
+## Summary
+
+This release adds a checked package contents smoke so maintainers can prove the npm package surface still ships the support examples index, quickstart, lifecycle map, blank worksheet, and filled synthetic example while keeping repo-local/private-ish files out.
+
+## Changes
+
+- Added `scripts/check-package-contents.mjs`.
+- Added `npm run pack:contents:check`.
+- Updated `npm run pack:dry` so the normal dry-pack path also verifies package contents.
+- Wired the package contents check into `npm test` and `npm run production:check`.
+- Updated README, release docs, production-readiness docs, roadmap, and changelog.
+
+## Public Interface Changes
+
+- No CLI, MCP, config schema, rule, scoring, GitHub Action, or release automation changes.
+- New maintainer script:
+  - `npm run pack:contents:check`
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run promo:card:check
+npm.cmd run promo:check
+npm.cmd run support:check
+npm.cmd run production:check
+npm.cmd run pack:contents:check
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js doctor
+node .\dist\cli.js summary --kind command "git reset --hard"
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.103 package contents support manifest smoke"
+```
+
+## Post-Publish Smoke
+
+```powershell
+npm.cmd view memento-mori-jester version --silent
+npx.cmd -y memento-mori-jester@latest doctor
+npx.cmd -y memento-mori-jester@latest summary --kind command "git reset --hard"
+npm.cmd run pack:contents:check
+```

package/docs/RELEASE_NOTES_v0.1.104.md

@@ -0,0 +1,47 @@
+# Memento Mori Jester v0.1.104
+
+## Summary
+
+This release adds checked installed-package support provenance so maintainers can verify and use the support examples from the npm package, not only from a repo checkout.
+
+## Changes
+
+- Added `examples/support/installed-package-support.md`.
+- Added `examples/support/installed-package-support.json`.
+- Linked the installed-package support note from the support examples index and support README.
+- Extended `npm run support:check` to validate the installed-package note, package-relative artifacts, `npm explore` verification command, and repo-only path exclusions.
+- Extended `npm run pack:contents:check` so dry-run package contents prove the installed-package note and referenced support artifacts are included.
+- Updated README, maintainer triage docs, production-readiness docs, roadmap, and changelog.
+
+## Public Interface Changes
+
+- No CLI, MCP, config schema, rule, scoring, GitHub Action, or release automation changes.
+- New package docs/examples only:
+  - `examples/support/installed-package-support.md`
+  - `examples/support/installed-package-support.json`
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run promo:card:check
+npm.cmd run promo:check
+npm.cmd run support:check
+npm.cmd run pack:contents:check
+npm.cmd run production:check
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js doctor
+node .\dist\cli.js summary --kind command "git reset --hard"
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.104 installed-package support provenance"
+```
+
+## Post-Publish Smoke
+
+```powershell
+npm.cmd view memento-mori-jester version --silent
+npx.cmd -y memento-mori-jester@latest doctor
+npx.cmd -y memento-mori-jester@latest summary --kind command "git reset --hard"
+npm.cmd run pack:contents:check
+```

package/examples/support/README.md

@@ -2,7 +2,7 @@
 
 This playbook shows how to handle sanitized adopter reports without turning every surprise into an immediate rule change. It pairs with [docs/MAINTAINER_TRIAGE.md](../../docs/MAINTAINER_TRIAGE.md), the [report gallery feedback template](../reports/feedback-template.md), and the GitHub issue templates.
 
-Start with the checked [support examples quickstart](support-examples-quickstart.md) during a live maintainer handoff, or the checked [support examples index](support-examples-index.md) when you need to choose the right artifact. Use the compact checked [support lifecycle map](support-lifecycle-map.md) when you need a quick scan of the path: report, triage, response, closeout, prioritization, backlog record, and backlog review. Use the checked [support lifecycle worksheet](support-lifecycle-worksheet.md) during an active review so every stage has concrete checks and record fields, and compare against the synthetic [filled worksheet example](support-lifecycle-filled-example.md) when you need to see one completed `docs-example` path. Use the full checked [support lifecycle overview](support-lifecycle.md) when you need the outcome table in one place. The lifecycle sources are [support-examples-quickstart.json](support-examples-quickstart.json), [support-examples-index.json](support-examples-index.json), [support-lifecycle-map.json](support-lifecycle-map.json), [support-lifecycle-worksheet.json](support-lifecycle-worksheet.json), [support-lifecycle-filled-example.json](support-lifecycle-filled-example.json), and [support-lifecycle.json](support-lifecycle.json). Use [outcome-prioritization.md](outcome-prioritization.md) after closeout to decide whether follow-up work should become docs, fixture backlog, or rule-review work. Use [backlog-records.md](backlog-records.md) to turn that decision into a public-safe backlog artifact, then use [backlog-review.md](backlog-review.md) to decide whether the item stays active or closes with no action.
+Start with the checked [support examples quickstart](support-examples-quickstart.md) during a live maintainer handoff, or the checked [support examples index](support-examples-index.md) when you need to choose the right artifact. Use [installed-package-support.md](installed-package-support.md) when proving those support examples from an installed npm package rather than a repo checkout. Use the compact checked [support lifecycle map](support-lifecycle-map.md) when you need a quick scan of the path: report, triage, response, closeout, prioritization, backlog record, and backlog review. Use the checked [support lifecycle worksheet](support-lifecycle-worksheet.md) during an active review so every stage has concrete checks and record fields, and compare against the synthetic [filled worksheet example](support-lifecycle-filled-example.md) when you need to see one completed `docs-example` path. Use the full checked [support lifecycle overview](support-lifecycle.md) when you need the outcome table in one place. The lifecycle sources are [installed-package-support.json](installed-package-support.json), [support-examples-quickstart.json](support-examples-quickstart.json), [support-examples-index.json](support-examples-index.json), [support-lifecycle-map.json](support-lifecycle-map.json), [support-lifecycle-worksheet.json](support-lifecycle-worksheet.json), [support-lifecycle-filled-example.json](support-lifecycle-filled-example.json), and [support-lifecycle.json](support-lifecycle.json). Use [outcome-prioritization.md](outcome-prioritization.md) after closeout to decide whether follow-up work should become docs, fixture backlog, or rule-review work. Use [backlog-records.md](backlog-records.md) to turn that decision into a public-safe backlog artifact, then use [backlog-review.md](backlog-review.md) to decide whether the item stays active or closes with no action.
 
 The checked source is [triage-playbook.json](triage-playbook.json). Use [response-snippets.md](response-snippets.md) for copy-paste replies after a report is classified. The snippet source is [response-snippets.json](response-snippets.json). Use [closeout-checklist.md](closeout-checklist.md) to record what happened after the response. The closeout source is [closeout-checklist.json](closeout-checklist.json). The backlog source is [backlog-records.json](backlog-records.json). The review source is [backlog-review.json](backlog-review.json).
 

package/examples/support/installed-package-support.json

@@ -0,0 +1,51 @@
+{
+  "title": "Installed Package Support Examples",
+  "packageName": "memento-mori-jester",
+  "verifyCommand": "npm explore memento-mori-jester -- npm run pack:contents:check",
+  "packageRelativeRoot": "examples/support",
+  "packageRelativeArtifacts": [
+    "examples/support/support-examples-index.md",
+    "examples/support/support-examples-quickstart.md",
+    "examples/support/support-lifecycle-map.md",
+    "examples/support/support-lifecycle-worksheet.md",
+    "examples/support/support-lifecycle-filled-example.md"
+  ],
+  "useWhen": "Use when a maintainer needs to verify or open the support examples from an installed npm package instead of a repository checkout.",
+  "steps": [
+    {
+      "id": "install-package",
+      "command": "npm install --save-dev memento-mori-jester",
+      "purpose": "Install the public package into a local maintainer or consumer project without requiring a source checkout."
+    },
+    {
+      "id": "verify-package-contents",
+      "command": "npm explore memento-mori-jester -- npm run pack:contents:check",
+      "purpose": "Run the package's own contents smoke from inside the installed package."
+    },
+    {
+      "id": "open-support-index",
+      "artifact": "examples/support/support-examples-index.md",
+      "purpose": "Choose between the quickstart, map, blank worksheet, and filled synthetic example using package-relative paths."
+    }
+  ],
+  "repoOnlyPathsNotRequired": [
+    "promo/",
+    "site/",
+    ".github/",
+    "private/",
+    "secrets/",
+    "internal/",
+    "node_modules/",
+    "coverage/",
+    "tmp/",
+    "temp/",
+    ".env",
+    ".npmrc"
+  ],
+  "requiredChecks": [
+    "npm run support:check",
+    "npm run pack:contents:check",
+    "npm run production:check"
+  ],
+  "privacyGuardrail": "Installed-package support examples must stay public-safe: use package-relative paths, avoid secrets and private details, and route credential exposure, package publishing compromise, MCP data exposure, command execution risk, or exploitable security details through SECURITY.md."
+}

package/examples/support/installed-package-support.md

@@ -0,0 +1,39 @@
+# Installed Package Support Examples
+
+This public-safe note shows maintainers how to use the checked support examples from an installed npm package instead of a repository checkout.
+
+The checked source is [installed-package-support.json](installed-package-support.json). Use it with the [support examples index](support-examples-index.md), [support examples quickstart](support-examples-quickstart.md), [support lifecycle map](support-lifecycle-map.md), [support lifecycle worksheet](support-lifecycle-worksheet.md), and [filled synthetic example](support-lifecycle-filled-example.md).
+
+## Verify From npm
+
+```powershell
+npm install --save-dev memento-mori-jester
+npm explore memento-mori-jester -- npm run pack:contents:check
+```
+
+## Open The Package-Relative Artifacts
+
+The support examples are package-relative paths under `examples/support/`:
+
+- `examples/support/support-examples-index.md`
+- `examples/support/support-examples-quickstart.md`
+- `examples/support/support-lifecycle-map.md`
+- `examples/support/support-lifecycle-worksheet.md`
+- `examples/support/support-lifecycle-filled-example.md`
+
+When using an installed package, stay inside the package directory through `npm explore memento-mori-jester -- <command>` or your editor's package viewer. The support examples do not require repo-only `promo/`, `site/`, `.github/`, private, secret, internal, cache, or credential-shaped paths.
+
+## Maintainer Path
+
+1. Run the package contents check from the installed package.
+2. Open the support examples index to choose the right artifact.
+3. Use the quickstart for a 60-second route from incoming report to map, worksheet, filled synthetic example, backlog record, and backlog review.
+4. Keep report details redacted and route secrets, private code, private paths, customer data, package publishing compromise, MCP exposure, command execution risk, or exploitable security details through `SECURITY.md`.
+
+## Checks
+
+```powershell
+npm run support:check
+npm run pack:contents:check
+npm run production:check
+```

package/examples/support/support-examples-index.json

@@ -17,6 +17,35 @@
     "publicSafe": true,
     "synthetic": true
   },
+  "installedPackageProvenance": {
+    "label": "Installed Package Support Examples",
+    "file": "examples/support/installed-package-support.md",
+    "source": "examples/support/installed-package-support.json",
+    "useWhen": "Use when a maintainer needs to verify or open the support examples from an installed npm package instead of a repository checkout.",
+    "verifyCommand": "npm explore memento-mori-jester -- npm run pack:contents:check",
+    "packageRelativeArtifacts": [
+      "examples/support/support-examples-index.md",
+      "examples/support/support-examples-quickstart.md",
+      "examples/support/support-lifecycle-map.md",
+      "examples/support/support-lifecycle-worksheet.md",
+      "examples/support/support-lifecycle-filled-example.md"
+    ],
+    "repoOnlyPathsNotRequired": [
+      "promo/",
+      "site/",
+      ".github/",
+      "private/",
+      "secrets/",
+      "internal/",
+      "node_modules/",
+      "coverage/",
+      "tmp/",
+      "temp/",
+      ".env",
+      ".npmrc"
+    ],
+    "publicSafe": true
+  },
   "artifacts": [
     {
       "id": "lifecycle-map",

package/examples/support/support-examples-index.md

@@ -2,12 +2,16 @@
 
 This public-safe index tells maintainers which checked support artifact to use during a report review. It keeps the compact map, blank worksheet, and filled synthetic example together so a support issue can move from first report to backlog review without guessing.
 
-The checked source is [support-examples-index.json](support-examples-index.json). For live handoffs, use the checked [support examples quickstart](support-examples-quickstart.md). This index points at the [support lifecycle map](support-lifecycle-map.md), [support lifecycle worksheet](support-lifecycle-worksheet.md), and [filled lifecycle worksheet example](support-lifecycle-filled-example.md).
+The checked source is [support-examples-index.json](support-examples-index.json). For live handoffs, use the checked [support examples quickstart](support-examples-quickstart.md). For installed-package provenance, use [installed-package-support.md](installed-package-support.md). This index points at the [support lifecycle map](support-lifecycle-map.md), [support lifecycle worksheet](support-lifecycle-worksheet.md), and [filled lifecycle worksheet example](support-lifecycle-filled-example.md).
 
 ## 60-Second Handoff
 
 Use [support-examples-quickstart.md](support-examples-quickstart.md) when an incoming report needs a fast maintainer route from public-safety check to lifecycle map, blank worksheet, filled synthetic example, backlog record, and backlog review.
 
+## Installed Package Provenance
+
+Use [installed-package-support.md](installed-package-support.md) when proving these examples from the npm package. It uses `npm explore memento-mori-jester -- npm run pack:contents:check`, package-relative `examples/support/` paths, and no repo-only `promo/`, `site/`, `.github/`, private, secret, internal, cache, or credential-shaped paths.
+
 ## Which Artifact To Use
 
 | Artifact | Use when | Required public-safe markers |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memento-mori-jester",
-  "version": "0.1.102",
+  "version": "0.1.104",
   "description": "A local court-jester sidecar for AI coding agents: review plans, commands, diffs, and final claims before they get too pleased with themselves.",
   "type": "module",
   "repository": {
@@ -40,7 +40,7 @@
     "build": "tsc -p tsconfig.json",
     "start": "node dist/server.js",
     "start:mcp": "node dist/server.js",
-    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run ci:adoption:check && npm run consumer:quickstart:check && npm run reports:check && npm run support:check && npm run promo:check && npm run site:check && npm run production:check",
+    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run ci:adoption:check && npm run consumer:quickstart:check && npm run reports:check && npm run support:check && npm run promo:check && npm run site:check && npm run pack:contents:check && npm run production:check",
     "doctor": "node dist/cli.js doctor",
     "demo:svg": "node scripts/render-demo-svg.mjs",
     "demo:svg:check": "node scripts/render-demo-svg.mjs --check",
@@ -57,7 +57,8 @@
     "promo:check": "node scripts/check-promo-freshness.mjs",
     "site:check": "node scripts/check-site.mjs",
     "production:check": "node scripts/check-production-readiness.mjs",
-    "pack:dry": "npm pack --dry-run",
+    "pack:contents:check": "node scripts/check-package-contents.mjs",
+    "pack:dry": "npm pack --dry-run && npm run pack:contents:check",
     "prepare": "npm run build",
     "prepublishOnly": "npm test && npm run pack:dry"
   },

package/scripts/check-package-contents.mjs

@@ -0,0 +1,265 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const root = join(scriptDir, "..");
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const npmExecPath = process.env.npm_execpath;
+const failures = [];
+const packageJson = readJson("package.json");
+
+const requiredPackageFiles = [
+  "dist/cli.js",
+  "dist/core.js",
+  "docs/RELEASE.md",
+  `docs/RELEASE_NOTES_v${packageJson.version}.md`,
+  "examples/support/installed-package-support.md",
+  "examples/support/installed-package-support.json",
+  "examples/support/support-examples-index.md",
+  "examples/support/support-examples-index.json",
+  "examples/support/support-examples-quickstart.md",
+  "examples/support/support-examples-quickstart.json",
+  "examples/support/support-lifecycle-map.md",
+  "examples/support/support-lifecycle-map.json",
+  "examples/support/support-lifecycle-worksheet.md",
+  "examples/support/support-lifecycle-worksheet.json",
+  "examples/support/support-lifecycle-filled-example.md",
+  "examples/support/support-lifecycle-filled-example.json",
+  "README.md",
+  "CHANGELOG.md",
+  "ROADMAP.md",
+  "SECURITY.md",
+  "LICENSE"
+];
+
+const requiredSupportFiles = [
+  "examples/support/installed-package-support.md",
+  "examples/support/installed-package-support.json",
+  "examples/support/support-examples-index.md",
+  "examples/support/support-examples-index.json",
+  "examples/support/support-examples-quickstart.md",
+  "examples/support/support-examples-quickstart.json",
+  "examples/support/support-lifecycle-map.md",
+  "examples/support/support-lifecycle-map.json",
+  "examples/support/support-lifecycle-worksheet.md",
+  "examples/support/support-lifecycle-worksheet.json",
+  "examples/support/support-lifecycle-filled-example.md",
+  "examples/support/support-lifecycle-filled-example.json"
+];
+
+const forbiddenPackagePathRules = [
+  { name: "repo-local promo assets", pattern: /^promo\// },
+  { name: "repo-local site assets", pattern: /^site\// },
+  { name: "GitHub workflow or issue-template files", pattern: /^\.github\// },
+  { name: "git metadata", pattern: /^\.git(?:\/|$)/ },
+  { name: "dependency or generated caches", pattern: /(^|\/)(?:node_modules|coverage|tmp|temp|\.next|dist-debug)(?:\/|$)/ },
+  { name: "private or secret-named directories", pattern: /(^|\/)(?:private|secrets?|internal)(?:\/|$)/i },
+  { name: "environment or credential files", pattern: /(^|\/)(?:\.env(?:\..*)?|\.npmrc|npm-debug\.log|yarn-error\.log|pnpm-debug\.log|.*\.(?:pem|p12|key))$/i }
+];
+
+const unsafeContentPatterns = [
+  { name: "private key block", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OpenAI-looking secret key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { name: "Anthropic-looking secret key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub-looking token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/ },
+  { name: "AWS access key id", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "Slack-looking token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
+  { name: "absolute Unix home path", pattern: /(?:^|[\s"'`])\/(?:Users|home)\/[A-Za-z0-9._-]+/ },
+  { name: "absolute Windows user path", pattern: /[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\/ }
+];
+
+const pack = dryRunPack();
+const files = new Set(pack.files.map((file) => normalizePath(file.path)));
+
+if (pack.name !== packageJson.name) {
+  failures.push(`Dry-run package name should be ${packageJson.name}. Saw ${pack.name}.`);
+}
+
+if (pack.version !== packageJson.version) {
+  failures.push(`Dry-run package version should be ${packageJson.version}. Saw ${pack.version}.`);
+}
+
+for (const file of requiredPackageFiles) {
+  if (!files.has(file)) {
+    failures.push(`Package dry run should include ${file}.`);
+  }
+}
+
+for (const file of pack.files) {
+  const path = normalizePath(file.path);
+  for (const rule of forbiddenPackagePathRules) {
+    if (rule.pattern.test(path)) {
+      failures.push(`Package dry run should exclude ${rule.name}: ${path}.`);
+    }
+  }
+}
+
+for (const path of requiredSupportFiles) {
+  requireFile(path);
+  if (!existsSync(join(root, path))) {
+    continue;
+  }
+
+  const content = read(path);
+  for (const unsafe of unsafeContentPatterns) {
+    if (unsafe.pattern.test(content)) {
+      failures.push(`${path} appears to contain ${unsafe.name}; package support examples must stay public-safe.`);
+    }
+  }
+}
+
+checkInstalledPackageSupport();
+
+if (failures.length > 0) {
+  console.error("Package contents check failed:");
+  for (const failure of failures) {
+    console.error(`- ${failure}`);
+  }
+  process.exit(1);
+}
+
+console.log("Package contents check passed.");
+console.log(`PASS package ${pack.name}@${pack.version}`);
+console.log(`PASS support examples included: ${requiredSupportFiles.length} files`);
+console.log("PASS promo, site, GitHub workflow, cache, private, and credential-shaped files excluded");
+
+function checkInstalledPackageSupport() {
+  const path = "examples/support/installed-package-support.json";
+  if (!existsSync(join(root, path))) {
+    return;
+  }
+
+  const note = readJson(path);
+  const expectedArtifacts = [
+    "examples/support/support-examples-index.md",
+    "examples/support/support-examples-quickstart.md",
+    "examples/support/support-lifecycle-map.md",
+    "examples/support/support-lifecycle-worksheet.md",
+    "examples/support/support-lifecycle-filled-example.md"
+  ];
+  const expectedRepoOnlyPaths = ["promo/", "site/", ".github/", "private/", "secrets/", "internal/"];
+
+  if (note.packageName !== packageJson.name) {
+    failures.push(`${path}.packageName should be ${packageJson.name}.`);
+  }
+
+  if (note.verifyCommand !== "npm explore memento-mori-jester -- npm run pack:contents:check") {
+    failures.push(`${path}.verifyCommand should run the package contents check through npm explore.`);
+  }
+
+  if (!Array.isArray(note.packageRelativeArtifacts) || note.packageRelativeArtifacts.join("|") !== expectedArtifacts.join("|")) {
+    failures.push(`${path}.packageRelativeArtifacts should list the checked package support artifacts in order.`);
+  } else {
+    for (const artifact of note.packageRelativeArtifacts) {
+      if (!files.has(artifact)) {
+        failures.push(`${path}.packageRelativeArtifacts references ${artifact}, but it is not in the package dry run.`);
+      }
+    }
+  }
+
+  if (!Array.isArray(note.repoOnlyPathsNotRequired)) {
+    failures.push(`${path}.repoOnlyPathsNotRequired should be an array.`);
+  } else {
+    for (const repoOnlyPath of expectedRepoOnlyPaths) {
+      if (!note.repoOnlyPathsNotRequired.includes(repoOnlyPath)) {
+        failures.push(`${path}.repoOnlyPathsNotRequired should include ${repoOnlyPath}.`);
+      }
+
+      for (const file of files) {
+        if (file.startsWith(repoOnlyPath)) {
+          failures.push(`${path}.repoOnlyPathsNotRequired lists ${repoOnlyPath}, but ${file} is present in the package dry run.`);
+        }
+      }
+    }
+  }
+}
+
+function dryRunPack() {
+  const output = runNpm(["pack", "--dry-run", "--json", "--ignore-scripts"]);
+  const parsed = parsePackJson(output);
+  if (!Array.isArray(parsed) || parsed.length !== 1 || typeof parsed[0] !== "object") {
+    fail("npm pack --dry-run --json should return one package entry.");
+  }
+
+  const [pack] = parsed;
+  if (!Array.isArray(pack.files)) {
+    fail("npm pack --dry-run --json output should include a files array.");
+  }
+
+  return pack;
+}
+
+function parsePackJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) {
+    fail("npm pack --dry-run --json returned no output.");
+  }
+
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    const start = trimmed.indexOf("[");
+    const end = trimmed.lastIndexOf("]");
+    if (start >= 0 && end > start) {
+      return JSON.parse(trimmed.slice(start, end + 1));
+    }
+    fail(`Could not parse npm pack JSON output:\n${trimmed}`);
+  }
+}
+
+function read(path) {
+  return readFileSync(join(root, path), "utf8");
+}
+
+function readJson(path) {
+  return JSON.parse(read(path));
+}
+
+function requireFile(path) {
+  if (!existsSync(join(root, path))) {
+    failures.push(`${path} is missing.`);
+  }
+}
+
+function normalizePath(path) {
+  return path.replaceAll("\\", "/");
+}
+
+function runNpm(commandArgs) {
+  if (npmExecPath) {
+    return run(process.execPath, [npmExecPath, ...commandArgs]);
+  }
+
+  return run(npmCommand, commandArgs);
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: 20 * 1024 * 1024,
+    env: {
+      ...process.env,
+      npm_config_audit: "false",
+      npm_config_fund: "false"
+    }
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (result.status !== 0) {
+    const detail = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    fail(`${command} ${commandArgs.join(" ")} failed${detail ? `:\n${detail}` : "."}`);
+  }
+
+  return result.stdout;
+}
+
+function fail(message) {
+  throw new Error(message);
+}

package/scripts/check-production-readiness.mjs

@@ -72,6 +72,7 @@ for (const path of [
   "scripts/doctor-framework-tuning.mjs",
   "scripts/check-ci-adoption.mjs",
   "scripts/check-consumer-quickstart.mjs",
+  "scripts/check-package-contents.mjs",
   "scripts/check-report-gallery.mjs",
   "scripts/check-support-triage.mjs",
   "scripts/check-fixtures.mjs",
@@ -100,6 +101,8 @@ for (const path of [
   "examples/support/backlog-records.json",
   "examples/support/closeout-checklist.md",
   "examples/support/closeout-checklist.json",
+  "examples/support/installed-package-support.md",
+  "examples/support/installed-package-support.json",
   "examples/support/outcome-prioritization.md",
   "examples/support/outcome-prioritization.json",
   "examples/support/response-snippets.md",
@@ -148,6 +151,7 @@ requireText("README.md", /feedback-template\.md/, "report gallery feedback templ
 requireText("README.md", /examples\/support/, "support triage playbook link");
 requireText("README.md", /support-examples-quickstart\.md/, "support examples quickstart link");
 requireText("README.md", /support-examples-index\.md/, "support examples index link");
+requireText("README.md", /installed-package-support\.md/, "installed package support link");
 requireText("README.md", /response-snippets\.md/, "support response snippets link");
 requireText("README.md", /closeout-checklist\.md/, "support closeout checklist link");
 requireText("README.md", /support-lifecycle-map\.md/, "support lifecycle map link");
@@ -157,6 +161,7 @@ requireText("README.md", /support-lifecycle\.md/, "support lifecycle overview li
 requireText("README.md", /outcome-prioritization\.md/, "support outcome prioritization link");
 requireText("README.md", /backlog-review\.md/, "support backlog review link");
 requireText("README.md", /backlog-records\.md/, "support backlog records link");
+requireText("README.md", /pack:contents:check/, "package contents check guidance");
 requireText("README.md", /report gallery feedback/i, "report gallery feedback guidance");
 requireText("README.md", /License: PolyForm Noncommercial/, "the noncommercial license badge");
 requireText("docs/PRODUCTION_READINESS.md", /npm package/i, "npm package readiness");
@@ -180,6 +185,7 @@ requireText("docs/PRODUCTION_READINESS.md", /support:check/, "support triage rea
 requireText("docs/PRODUCTION_READINESS.md", /examples\/support/, "support triage playbook readiness");
 requireText("docs/PRODUCTION_READINESS.md", /support examples quickstart/i, "support examples quickstart readiness");
 requireText("docs/PRODUCTION_READINESS.md", /support examples index/i, "support examples index readiness");
+requireText("docs/PRODUCTION_READINESS.md", /installed-package support/i, "installed package support readiness");
 requireText("docs/PRODUCTION_READINESS.md", /response snippets/i, "support response snippets readiness");
 requireText("docs/PRODUCTION_READINESS.md", /closeout checklist/i, "support closeout checklist readiness");
 requireText("docs/PRODUCTION_READINESS.md", /support lifecycle overview/i, "support lifecycle overview readiness");
@@ -189,6 +195,8 @@ requireText("docs/PRODUCTION_READINESS.md", /filled worksheet example/i, "filled
 requireText("docs/PRODUCTION_READINESS.md", /outcome prioritization guide/i, "support outcome prioritization readiness");
 requireText("docs/PRODUCTION_READINESS.md", /backlog review/i, "support backlog review readiness");
 requireText("docs/PRODUCTION_READINESS.md", /backlog records/i, "support backlog records readiness");
+requireText("docs/PRODUCTION_READINESS.md", /pack:contents:check/, "package contents check readiness");
+requireText("docs/PRODUCTION_READINESS.md", /support examples manifest/i, "support examples manifest package readiness");
 requireText("docs/PRODUCTION_READINESS.md", /quiet-pass/, "quiet-pass fixture readiness");
 requireText("docs/CLI.md", /jester doctor --json/, "doctor JSON CLI docs");
 requireText("docs/CLI.md", /quiet-pass fixture/, "quiet-pass fixture CLI docs");
@@ -215,6 +223,7 @@ requireText("docs/MAINTAINER_TRIAGE.md", /report_gallery_feedback\.yml/, "report
 requireText("docs/MAINTAINER_TRIAGE.md", /examples\/support/, "support triage playbook link");
 requireText("docs/MAINTAINER_TRIAGE.md", /support-examples-quickstart\.md/, "support examples quickstart link");
 requireText("docs/MAINTAINER_TRIAGE.md", /support-examples-index\.md/, "support examples index link");
+requireText("docs/MAINTAINER_TRIAGE.md", /installed-package-support\.md/, "installed package support link");
 requireText("docs/MAINTAINER_TRIAGE.md", /response-snippets\.md/, "support response snippets link");
 requireText("docs/MAINTAINER_TRIAGE.md", /closeout-checklist\.md/, "support closeout checklist link");
 requireText("docs/MAINTAINER_TRIAGE.md", /support-lifecycle-map\.md/, "support lifecycle map link");
@@ -258,6 +267,8 @@ requireText("examples/reports/feedback-template.md", /SECURITY\.md/, "feedback t
 requireText("examples/support/README.md", /triage-playbook\.json/, "support triage playbook JSON link");
 requireText("examples/support/README.md", /response-snippets\.md/, "support response snippets link");
 requireText("examples/support/README.md", /closeout-checklist\.md/, "support closeout checklist link");
+requireText("examples/support/README.md", /installed-package-support\.md/, "installed package support link");
+requireText("examples/support/README.md", /installed-package-support\.json/, "installed package support JSON link");
 requireText("examples/support/README.md", /support-examples-quickstart\.md/, "support examples quickstart link");
 requireText("examples/support/README.md", /support-examples-quickstart\.json/, "support examples quickstart JSON link");
 requireText("examples/support/README.md", /support-examples-index\.md/, "support examples index link");
@@ -291,6 +302,13 @@ requireText("examples/support/closeout-checklist.md", /candidate-opened/, "suppo
 requireText("examples/support/closeout-checklist.json", /docs-clarification-closeout/, "support docs closeout record");
 requireText("examples/support/closeout-checklist.json", /fixture-backlog-closeout/, "support fixture closeout record");
 requireText("examples/support/closeout-checklist.json", /rule-review-closeout/, "support rule-review closeout record");
+requireText("examples/support/installed-package-support.md", /Installed Package Support Examples/, "installed package support heading");
+requireText("examples/support/installed-package-support.md", /npm explore memento-mori-jester -- npm run pack:contents:check/, "installed package support verify command");
+requireText("examples/support/installed-package-support.md", /support-examples-index\.md/, "installed package support index path");
+requireText("examples/support/installed-package-support.md", /repo-only `promo\/`, `site\/`, `\.github\/`/, "installed package support repo-only exclusions");
+requireText("examples/support/installed-package-support.json", /Installed Package Support Examples/, "installed package support JSON title");
+requireText("examples/support/installed-package-support.json", /packageRelativeArtifacts/, "installed package support package-relative artifacts");
+requireText("examples/support/installed-package-support.json", /repoOnlyPathsNotRequired/, "installed package support repo-only exclusions JSON");
 requireText("examples/support/support-examples-quickstart.md", /Support Examples Quickstart/, "support examples quickstart heading");
 requireText("examples/support/support-examples-quickstart.md", /support-examples-quickstart\.json/, "support examples quickstart JSON link");
 requireText("examples/support/support-examples-quickstart.md", /60-Second Path/, "support examples quickstart path");
@@ -309,6 +327,8 @@ requireText("examples/support/support-examples-quickstart.json", /npm run produc
 requireText("examples/support/support-examples-index.md", /Support Examples Index/, "support examples index heading");
 requireText("examples/support/support-examples-index.md", /support-examples-index\.json/, "support examples index JSON link");
 requireText("examples/support/support-examples-index.md", /support-examples-quickstart\.md/, "support examples quickstart link");
+requireText("examples/support/support-examples-index.md", /installed-package-support\.md/, "installed package support index link");
+requireText("examples/support/support-examples-index.md", /Installed Package Provenance/, "installed package support provenance section");
 requireText("examples/support/support-examples-index.md", /support-lifecycle-map\.md/, "support examples index map link");
 requireText("examples/support/support-examples-index.md", /support-lifecycle-worksheet\.md/, "support examples index worksheet link");
 requireText("examples/support/support-examples-index.md", /support-lifecycle-filled-example\.md/, "support examples index filled example link");
@@ -318,6 +338,8 @@ requireText("examples/support/support-examples-index.md", /SECURITY\.md/, "suppo
 requireText("examples/support/support-examples-index.json", /Support Examples Index/, "support examples index JSON title");
 requireText("examples/support/support-examples-index.json", /support-examples-quickstart\.md/, "support examples index JSON quickstart link");
 requireText("examples/support/support-examples-index.json", /support-examples-quickstart\.json/, "support examples index JSON quickstart source");
+requireText("examples/support/support-examples-index.json", /installedPackageProvenance/, "installed package support provenance JSON");
+requireText("examples/support/support-examples-index.json", /installed-package-support\.md/, "installed package support JSON link");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-map\.md/, "support examples index JSON map link");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-worksheet\.md/, "support examples index JSON worksheet link");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-filled-example\.md/, "support examples index JSON filled example link");
@@ -434,6 +456,14 @@ requireText("scripts/check-ci-adoption.mjs", /framework:tuning:doctor/, "adoptio
 requireText("scripts/check-consumer-quickstart.mjs", /consumer-quickstart/, "consumer quickstart checker target");
 requireText("scripts/check-consumer-quickstart.mjs", /memento-mori-jester@latest/, "consumer quickstart registry verification option");
 requireText("scripts/check-consumer-quickstart.mjs", /framework:tuning:doctor/, "consumer quickstart tuning doctor guard");
+requireText("scripts/check-package-contents.mjs", /support-examples-index\.md/, "package contents support examples index guard");
+requireText("scripts/check-package-contents.mjs", /installed-package-support\.md/, "package contents installed package support guard");
+requireText("scripts/check-package-contents.mjs", /npm explore memento-mori-jester -- npm run pack:contents:check/, "package contents installed package verify command");
+requireText("scripts/check-package-contents.mjs", /support-examples-quickstart\.md/, "package contents support examples quickstart guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-map\.md/, "package contents support lifecycle map guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-worksheet\.md/, "package contents support lifecycle worksheet guard");
+requireText("scripts/check-package-contents.mjs", /support-lifecycle-filled-example\.md/, "package contents filled worksheet example guard");
+requireText("scripts/check-package-contents.mjs", /promo|site|private|credential/, "package contents forbidden file guard");
 requireText("scripts/check-report-gallery.mjs", /report-gallery\.json/, "report gallery checker target");
 requireText("scripts/check-report-gallery.mjs", /memento-mori-jester@latest/, "report gallery registry verification option");
 requireText("scripts/check-report-gallery.mjs", /destructive-command-summary/, "report gallery summary guard");
@@ -442,6 +472,7 @@ requireText("scripts/check-support-triage.mjs", /feedback-template\.md/, "suppor
 requireText("scripts/check-support-triage.mjs", /triage-playbook\.json/, "support triage playbook guard");
 requireText("scripts/check-support-triage.mjs", /response-snippets\.json/, "support response snippets guard");
 requireText("scripts/check-support-triage.mjs", /closeout-checklist\.json/, "support closeout checklist guard");
+requireText("scripts/check-support-triage.mjs", /installed-package-support\.json/, "installed package support guard");
 requireText("scripts/check-support-triage.mjs", /support-examples-quickstart\.json/, "support examples quickstart guard");
 requireText("scripts/check-support-triage.mjs", /support-examples-index\.json/, "support examples index guard");
 requireText("scripts/check-support-triage.mjs", /support-lifecycle\.json/, "support lifecycle overview guard");
@@ -460,6 +491,8 @@ requireText("package.json", /"ci:adoption:check": "node scripts\/check-ci-adopti
 requireText("package.json", /"consumer:quickstart:check": "node scripts\/check-consumer-quickstart\.mjs"/, "consumer quickstart check script");
 requireText("package.json", /"reports:check": "node scripts\/check-report-gallery\.mjs"/, "report gallery check script");
 requireText("package.json", /"support:check": "node scripts\/check-support-triage\.mjs"/, "support triage check script");
+requireText("package.json", /"pack:contents:check": "node scripts\/check-package-contents\.mjs"/, "package contents check script");
+requireText("package.json", /"pack:dry": "npm pack --dry-run && npm run pack:contents:check"/, "package dry run contents guard");
 requireText("package.json", /"promo:card": "node scripts\/render-social-card\.mjs"/, "social card render script");
 requireText("package.json", /"promo:card:check": "node scripts\/render-social-card\.mjs --check"/, "social card stale check script");
 requireText("package.json", /"promo:check": "node scripts\/check-promo-freshness\.mjs"/, "promo freshness check script");
@@ -474,6 +507,7 @@ requireText("package.json", /npm run reports:check/, "report gallery check in np
 requireText("package.json", /npm run support:check/, "support triage check in npm test");
 requireText("package.json", /npm run promo:check/, "promo freshness check in npm test");
 requireText("package.json", /npm run site:check/, "site check in npm test");
+requireText("package.json", /npm run pack:contents:check/, "package contents check in npm test");
 requireText("scripts/check-promo-freshness.mjs", /--require-package-version/, "optional strict package-version promo check");
 requireText("scripts/check-promo-freshness.mjs", /social-card\.svg/, "social-card freshness check");
 requireText("scripts/check-site.mjs", /site\/index\.html/, "site index check");

package/scripts/check-support-triage.mjs

@@ -31,6 +31,8 @@ const supportFiles = [
   "examples/support/backlog-records.json",
   "examples/support/closeout-checklist.md",
   "examples/support/closeout-checklist.json",
+  "examples/support/installed-package-support.md",
+  "examples/support/installed-package-support.json",
   "examples/support/outcome-prioritization.md",
   "examples/support/outcome-prioritization.json",
   "examples/support/README.md",
@@ -100,6 +102,8 @@ requireText("examples/reports/README.md", /examples\/support|Maintainer Triage P
 requireText("examples/support/README.md", /Maintainer Triage Playbook/, "maintainer playbook heading");
 requireText("examples/support/README.md", /backlog-review\.md/, "support backlog review link");
 requireText("examples/support/README.md", /backlog-records\.md/, "support backlog records link");
+requireText("examples/support/README.md", /installed-package-support\.md/, "installed package support link");
+requireText("examples/support/README.md", /installed-package-support\.json/, "installed package support JSON link");
 requireText("examples/support/README.md", /support-examples-quickstart\.md/, "support examples quickstart link");
 requireText("examples/support/README.md", /support-examples-quickstart\.json/, "support examples quickstart JSON link");
 requireText("examples/support/README.md", /support-examples-index\.md/, "support examples index link");
@@ -138,6 +142,20 @@ requireText("examples/support/closeout-checklist.md", /SECURITY\.md/, "closeout
 requireText("examples/support/closeout-checklist.json", /docs-clarification-closeout/, "docs closeout record");
 requireText("examples/support/closeout-checklist.json", /fixture-backlog-closeout/, "fixture closeout record");
 requireText("examples/support/closeout-checklist.json", /rule-review-closeout/, "rule-review closeout record");
+requireText("examples/support/installed-package-support.md", /Installed Package Support Examples/, "installed package support heading");
+requireText("examples/support/installed-package-support.md", /installed-package-support\.json/, "installed package support JSON link");
+requireText("examples/support/installed-package-support.md", /npm explore memento-mori-jester -- npm run pack:contents:check/, "installed package verify command");
+requireText("examples/support/installed-package-support.md", /examples\/support\/support-examples-index\.md/, "installed package support index path");
+requireText("examples/support/installed-package-support.md", /examples\/support\/support-examples-quickstart\.md/, "installed package support quickstart path");
+requireText("examples/support/installed-package-support.md", /examples\/support\/support-lifecycle-map\.md/, "installed package support map path");
+requireText("examples/support/installed-package-support.md", /examples\/support\/support-lifecycle-worksheet\.md/, "installed package support worksheet path");
+requireText("examples/support/installed-package-support.md", /examples\/support\/support-lifecycle-filled-example\.md/, "installed package filled example path");
+requireText("examples/support/installed-package-support.md", /promo\/|site\/|\.github\/|private|secret|credential-shaped/, "installed package repo-only exclusions");
+requireText("examples/support/installed-package-support.md", /SECURITY\.md/, "installed package security redirect");
+requireText("examples/support/installed-package-support.json", /Installed Package Support Examples/, "installed package support JSON title");
+requireText("examples/support/installed-package-support.json", /memento-mori-jester/, "installed package support package name");
+requireText("examples/support/installed-package-support.json", /pack:contents:check/, "installed package contents check");
+requireText("examples/support/installed-package-support.json", /support-examples-index\.md/, "installed package JSON support index path");
 requireText("examples/support/support-examples-quickstart.md", /Support Examples Quickstart/, "support examples quickstart heading");
 requireText("examples/support/support-examples-quickstart.md", /support-examples-quickstart\.json/, "support examples quickstart JSON link");
 requireText("examples/support/support-examples-quickstart.md", /60-Second Path/, "support examples quickstart path");
@@ -160,6 +178,8 @@ requireText("examples/support/support-examples-quickstart.json", /closed-no-acti
 requireText("examples/support/support-examples-index.md", /Support Examples Index/, "support examples index heading");
 requireText("examples/support/support-examples-index.md", /support-examples-index\.json/, "support examples index JSON link");
 requireText("examples/support/support-examples-index.md", /support-examples-quickstart\.md/, "support examples quickstart link");
+requireText("examples/support/support-examples-index.md", /installed-package-support\.md/, "installed package support link");
+requireText("examples/support/support-examples-index.md", /Installed Package Provenance/, "installed package provenance section");
 requireText("examples/support/support-examples-index.md", /60-Second Handoff/, "support examples index handoff section");
 requireText("examples/support/support-examples-index.md", /support-lifecycle-map\.md/, "support examples index map link");
 requireText("examples/support/support-examples-index.md", /support-lifecycle-worksheet\.md/, "support examples index worksheet link");
@@ -173,6 +193,8 @@ requireText("examples/support/support-examples-index.md", /npm run support:check
 requireText("examples/support/support-examples-index.json", /Support Examples Index/, "support examples index JSON title");
 requireText("examples/support/support-examples-index.json", /support-examples-quickstart\.md/, "support examples index JSON quickstart link");
 requireText("examples/support/support-examples-index.json", /support-examples-quickstart\.json/, "support examples index JSON quickstart source");
+requireText("examples/support/support-examples-index.json", /installed-package-support\.md/, "installed package support JSON link");
+requireText("examples/support/support-examples-index.json", /pack:contents:check/, "installed package support JSON verify command");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-map\.md/, "support examples index JSON map link");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-worksheet\.md/, "support examples index JSON worksheet link");
 requireText("examples/support/support-examples-index.json", /support-lifecycle-filled-example\.md/, "support examples index JSON filled example link");
@@ -360,6 +382,7 @@ requireText("package.json", /npm run support:check/, "support checker in npm tes
 checkTriagePlaybook();
 checkResponseSnippets();
 checkCloseoutChecklist();
+checkInstalledPackageSupport();
 checkSupportExamplesQuickstart();
 checkSupportExamplesIndex();
 checkSupportLifecycleWorksheet();
@@ -971,6 +994,27 @@ function checkSupportExamplesIndex() {
     return;
   }
 
+  const expectedPackageArtifacts = [
+    "examples/support/support-examples-index.md",
+    "examples/support/support-examples-quickstart.md",
+    "examples/support/support-lifecycle-map.md",
+    "examples/support/support-lifecycle-worksheet.md",
+    "examples/support/support-lifecycle-filled-example.md"
+  ];
+  const expectedRepoOnlyPaths = [
+    "promo/",
+    "site/",
+    ".github/",
+    "private/",
+    "secrets/",
+    "internal/",
+    "node_modules/",
+    "coverage/",
+    "tmp/",
+    "temp/",
+    ".env",
+    ".npmrc"
+  ];
   const expectedArtifacts = [
     {
       id: "lifecycle-map",
@@ -1045,6 +1089,40 @@ function checkSupportExamplesIndex() {
     }
   }
 
+  if (index.installedPackageProvenance?.file !== "examples/support/installed-package-support.md") {
+    failures.push(`${path}.installedPackageProvenance.file should point at examples/support/installed-package-support.md.`);
+  }
+
+  if (index.installedPackageProvenance?.source !== "examples/support/installed-package-support.json") {
+    failures.push(`${path}.installedPackageProvenance.source should point at examples/support/installed-package-support.json.`);
+  }
+
+  if (index.installedPackageProvenance?.verifyCommand !== "npm explore memento-mori-jester -- npm run pack:contents:check") {
+    failures.push(`${path}.installedPackageProvenance.verifyCommand should run the package contents check through npm explore.`);
+  }
+
+  if (index.installedPackageProvenance?.publicSafe !== true) {
+    failures.push(`${path}.installedPackageProvenance should be publicSafe.`);
+  }
+
+  if (typeof index.installedPackageProvenance?.useWhen !== "string" || index.installedPackageProvenance.useWhen.length < 60) {
+    failures.push(`${path}.installedPackageProvenance.useWhen should explain installed-package use.`);
+  }
+
+  if (!Array.isArray(index.installedPackageProvenance?.packageRelativeArtifacts) || index.installedPackageProvenance.packageRelativeArtifacts.join("|") !== expectedPackageArtifacts.join("|")) {
+    failures.push(`${path}.installedPackageProvenance.packageRelativeArtifacts should list the package support artifacts in order.`);
+  }
+
+  if (!Array.isArray(index.installedPackageProvenance?.repoOnlyPathsNotRequired)) {
+    failures.push(`${path}.installedPackageProvenance.repoOnlyPathsNotRequired should be an array.`);
+  } else {
+    for (const repoOnlyPath of expectedRepoOnlyPaths) {
+      if (!index.installedPackageProvenance.repoOnlyPathsNotRequired.includes(repoOnlyPath)) {
+        failures.push(`${path}.installedPackageProvenance.repoOnlyPathsNotRequired should include ${repoOnlyPath}.`);
+      }
+    }
+  }
+
   if (!Array.isArray(index.artifacts) || index.artifacts.length !== expectedArtifacts.length) {
     failures.push(`${path}.artifacts should contain exactly three indexed support artifacts.`);
   } else {
@@ -1136,6 +1214,128 @@ function checkSupportExamplesIndex() {
   }
 }
 
+function checkInstalledPackageSupport() {
+  const path = "examples/support/installed-package-support.json";
+  const note = readJson(path);
+  if (!note) {
+    return;
+  }
+
+  const expectedArtifacts = [
+    "examples/support/support-examples-index.md",
+    "examples/support/support-examples-quickstart.md",
+    "examples/support/support-lifecycle-map.md",
+    "examples/support/support-lifecycle-worksheet.md",
+    "examples/support/support-lifecycle-filled-example.md"
+  ];
+  const expectedRepoOnlyPaths = [
+    "promo/",
+    "site/",
+    ".github/",
+    "private/",
+    "secrets/",
+    "internal/",
+    "node_modules/",
+    "coverage/",
+    "tmp/",
+    "temp/",
+    ".env",
+    ".npmrc"
+  ];
+  const expectedSteps = [
+    {
+      id: "install-package",
+      command: "npm install --save-dev memento-mori-jester"
+    },
+    {
+      id: "verify-package-contents",
+      command: "npm explore memento-mori-jester -- npm run pack:contents:check"
+    },
+    {
+      id: "open-support-index",
+      artifact: "examples/support/support-examples-index.md"
+    }
+  ];
+
+  if (note.title !== "Installed Package Support Examples") {
+    failures.push(`${path}.title should be Installed Package Support Examples.`);
+  }
+
+  if (note.packageName !== "memento-mori-jester") {
+    failures.push(`${path}.packageName should be memento-mori-jester.`);
+  }
+
+  if (note.verifyCommand !== "npm explore memento-mori-jester -- npm run pack:contents:check") {
+    failures.push(`${path}.verifyCommand should run the package contents check through npm explore.`);
+  }
+
+  if (note.packageRelativeRoot !== "examples/support") {
+    failures.push(`${path}.packageRelativeRoot should be examples/support.`);
+  }
+
+  if (typeof note.useWhen !== "string" || note.useWhen.length < 75) {
+    failures.push(`${path}.useWhen should explain installed-package support usage.`);
+  }
+
+  if (!Array.isArray(note.packageRelativeArtifacts) || note.packageRelativeArtifacts.join("|") !== expectedArtifacts.join("|")) {
+    failures.push(`${path}.packageRelativeArtifacts should list the checked package support artifacts in order.`);
+  } else {
+    for (const artifact of note.packageRelativeArtifacts) {
+      if (/^(?:promo|site|\.github|private|secrets?|internal)\//i.test(artifact)) {
+        failures.push(`${path}.packageRelativeArtifacts should not reference repo-only path ${artifact}.`);
+      }
+    }
+  }
+
+  if (!Array.isArray(note.steps) || note.steps.length !== expectedSteps.length) {
+    failures.push(`${path}.steps should contain exactly three installed-package steps.`);
+  } else {
+    for (const [index, step] of note.steps.entries()) {
+      const expected = expectedSteps[index];
+      if (step?.id !== expected.id) {
+        failures.push(`${path}.steps[${index}].id should be ${expected.id}.`);
+      }
+
+      if (expected.command && step?.command !== expected.command) {
+        failures.push(`${path}.steps[${index}].command should be ${expected.command}.`);
+      }
+
+      if (expected.artifact && step?.artifact !== expected.artifact) {
+        failures.push(`${path}.steps[${index}].artifact should be ${expected.artifact}.`);
+      }
+
+      if (typeof step?.purpose !== "string" || step.purpose.length < 50) {
+        failures.push(`${path}.steps[${index}].purpose should explain the installed-package step.`);
+      }
+    }
+  }
+
+  if (!Array.isArray(note.repoOnlyPathsNotRequired)) {
+    failures.push(`${path}.repoOnlyPathsNotRequired should be an array.`);
+  } else {
+    for (const repoOnlyPath of expectedRepoOnlyPaths) {
+      if (!note.repoOnlyPathsNotRequired.includes(repoOnlyPath)) {
+        failures.push(`${path}.repoOnlyPathsNotRequired should include ${repoOnlyPath}.`);
+      }
+    }
+  }
+
+  const requiredChecks = ["npm run support:check", "npm run pack:contents:check", "npm run production:check"];
+  if (!Array.isArray(note.requiredChecks)) {
+    failures.push(`${path}.requiredChecks should be an array.`);
+  } else {
+    for (const check of requiredChecks) {
+      if (!note.requiredChecks.includes(check)) {
+        failures.push(`${path}.requiredChecks should include ${check}.`);
+      }
+    }
+  }
+
+  if (typeof note.privacyGuardrail !== "string" || !/package-relative|secrets|private|SECURITY\.md|MCP|exploitable/i.test(note.privacyGuardrail)) {
+    failures.push(`${path}.privacyGuardrail should include installed-package public-safe guidance.`);
+  }
+}
+
 function checkSupportExamplesQuickstart() {
   const path = "examples/support/support-examples-quickstart.json";
   const quickstart = readJson(path);