memento-mori-jester 0.1.84 → 0.1.86

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to Memento Mori Jester are tracked here.
 
 ## Unreleased
 
+## 0.1.86
+
+- Added `examples/consumer-quickstart`, a minimal installed-project fixture for proving the first `doctor`, `summary`, and framework tuning commands from a consumer repo.
+- Added `npm run consumer:quickstart:check`, which installs the package into a temporary project and runs the quickstart/adoption commands from that project.
+- Updated README, GitHub Actions docs, CI examples, release docs, production-readiness docs, roadmap, and release notes for the consumer quickstart smoke path.
+
+## 0.1.85
+
+- Added `examples/ci/adoption-smoke.yml`, a read-only GitHub Actions recipe for checking `doctor`, `summary`, and packaged framework tuning cookbook commands in real repos.
+- Added `npm run ci:adoption:check` to keep the adoption smoke workflow and docs aligned with current commands and safety expectations.
+- Updated README, GitHub Actions docs, CI examples, release docs, production-readiness docs, roadmap, and release notes for the new adoption path.
+
 ## 0.1.84
 
 - Added `npm run framework:tuning:doctor`, a consumer-style smoke check that generates temporary preset configs and runs every cookbook `jester tune <rule-id> --json` command through the built CLI.

package/README.md

@@ -68,6 +68,10 @@ npx -y memento-mori-jester@latest github-action --write
 
 The generated workflow uploads SARIF for code scanning and adds a readable Jester summary to the GitHub Actions run.
 
+For a first read-only CI smoke, copy [examples/ci/adoption-smoke.yml](examples/ci/adoption-smoke.yml). It runs `doctor`, `summary --kind command "git reset --hard"`, and the published package's `framework:tuning:doctor` without requiring code-scanning permissions.
+
+Maintainers can prove that fresh-project path with [examples/consumer-quickstart](examples/consumer-quickstart) and `npm run consumer:quickstart:check`, which installs the package into a temporary project and runs the same quickstart commands from there.
+
 Expected vibe:
 
 ```text
@@ -436,6 +440,8 @@ More setup examples:
 - [Preset Example Packs](examples/presets)
 - [Review Fixtures](examples/fixtures)
 - [Framework CI Examples](examples/ci)
+- [Adoption Smoke CI](examples/ci/adoption-smoke.yml)
+- [Consumer Quickstart Smoke](examples/consumer-quickstart)
 - [Security Policy](SECURITY.md)
 - [Maintainer Triage](docs/MAINTAINER_TRIAGE.md)
 - [Changelog](CHANGELOG.md)
@@ -453,6 +459,8 @@ Preset example packs:
 
 Framework CI examples:
 
+- [Adoption Smoke CI](examples/ci/adoption-smoke.yml)
+- [Consumer Quickstart Smoke](examples/consumer-quickstart)
 - [Next.js CI](examples/ci/nextjs.yml)
 - [Vite React CI](examples/ci/vite-react.yml)
 - [Express API CI](examples/ci/express-api.yml)
@@ -520,6 +528,7 @@ Release checklist:
 
 ```powershell
 npm.cmd test
+npm.cmd run consumer:quickstart:check
 npm.cmd run promo:check
 npm.cmd run production:check
 npm.cmd run pack:dry

package/ROADMAP.md

@@ -6,6 +6,8 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Recently Shipped
 
+- Consumer quickstart smoke in v0.1.86, proving the first installed-project commands from a minimal repo before release.
+- Adoption smoke CI example in v0.1.85, giving real repos a read-only workflow for `doctor`, `summary`, and packaged framework tuning checks.
 - Framework tuning doctor in v0.1.84, proving cookbook recipes execute through the built CLI with generated preset configs before release.
 - Framework tuning cookbook in v0.1.83, adding checked copy-paste recipes and a machine-readable JSON map for stack-shaped noisy-rule reports.
 - Framework tuning examples and quiet-pass fixture curation in v0.1.82, adding six safe real-world examples plus a guide for framework-shaped noisy-rule reports.

package/docs/GITHUB_ACTIONS.md

@@ -20,6 +20,23 @@ The generated workflow reviews pull request diffs, writes `jester.sarif`, upload
 
 This repository dogfoods that generated workflow in [.github/workflows/memento-mori.yml](../.github/workflows/memento-mori.yml).
 
+## Adoption Smoke Workflow
+
+Use [examples/ci/adoption-smoke.yml](../examples/ci/adoption-smoke.yml) when you want a first read-only CI check before enabling SARIF/code scanning.
+
+It runs:
+
+```powershell
+npx -y memento-mori-jester@latest doctor
+npx -y memento-mori-jester@latest summary --kind command "git reset --hard"
+npm run framework:tuning:check
+npm run framework:tuning:doctor
+```
+
+The workflow downloads the published npm tarball into a temporary directory before running the framework tuning checks, so it verifies package contents rather than relying on this repository checkout.
+
+Maintainers can run `npm run consumer:quickstart:check` to prove the same commands from a minimal installed project fixture in [examples/consumer-quickstart](../examples/consumer-quickstart). After a release, `npm run consumer:quickstart:check -- --package memento-mori-jester@latest` verifies the public registry package through that fixture.
+
 ## Composite Action
 
 This repo can be used directly as a GitHub Action:

package/docs/PRODUCTION_READINESS.md

@@ -26,6 +26,8 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - Action inputs cover `fail-on`, `subject`, `config`, `no-config`, `format`, `output-file`, and `summary`.
 - SARIF output and GitHub step summaries remain separate so users can enable readable summaries without new GitHub write permissions.
 - Example workflows in `examples/` and `examples/ci/` stay aligned with the action shape.
+- `examples/ci/adoption-smoke.yml` gives new repos a read-only smoke workflow for `doctor`, `summary`, and packaged framework tuning checks before code scanning is enabled.
+- `examples/consumer-quickstart` gives maintainers a minimal installed-project fixture for proving those same first commands from a clean consumer project.
 
 ## MCP And Agent Setup
 
@@ -60,6 +62,7 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - `npm run fixtures:report` shows fixture coverage by rule, rule family, preset slice, kind, verdict, quiet-pass rule boundaries, and feasible pass-case gaps so maintainers can pick the next fixture target; `npm run fixtures:report -- --markdown` produces a paste-ready maintainer snapshot.
 - `npm run framework:tuning:check` keeps the framework tuning guide, cookbook JSON, cookbook README, and fixture IDs aligned.
 - `npm run framework:tuning:doctor` runs the cookbook tune commands through the built CLI with temporary preset configs, so package consumers do not inherit stale recipes.
+- `npm run consumer:quickstart:check` installs the package into a temporary minimal project and runs `doctor`, `summary`, and packaged framework tuning checks from that consumer side.
 - `npm run promo:card` regenerates the deterministic social preview card, and `npm run promo:check` verifies current repo-local promo assets against the current fixture evidence before maintainers post or refresh the demo.
 - `npm run site:check` verifies the static landing page before maintainers post or host it.
 - npm publish has a manual workflow fallback, but the normal release path is tag-driven trusted publishing.
@@ -79,6 +82,8 @@ This checklist defines what "production grade" means for Memento Mori Jester rig
 - fixture coverage reports are wired into `npm test`.
 - framework tuning cookbook checks are wired into `npm test`.
 - framework tuning cookbook doctor checks are wired into `npm test`.
+- CI adoption example checks are wired into `npm test`.
+- consumer quickstart smoke checks are wired into `npm test`.
 - promo freshness checks are wired into `npm test`.
 - site checks are wired into `npm test`.
 

package/docs/RELEASE.md

@@ -14,6 +14,8 @@ npm.cmd run fixtures:report -- --json
 npm.cmd run fixtures:report -- --markdown
 npm.cmd run framework:tuning:check
 npm.cmd run framework:tuning:doctor
+npm.cmd run ci:adoption:check
+npm.cmd run consumer:quickstart:check
 npm.cmd run promo:card:check
 npm.cmd run promo:check
 npm.cmd run site:check
@@ -26,7 +28,7 @@ Move the current changelog bullets into a matching version section and add `docs
 ## 2. Tag And Push
 
 ```powershell
-git add package.json package-lock.json CHANGELOG.md docs/RELEASE_NOTES_v0.1.x.md docs/PRODUCTION_READINESS.md docs/MAINTAINER_TRIAGE.md docs/FRAMEWORK_TUNING.md examples/tuning scripts/check-framework-tuning.mjs scripts/doctor-framework-tuning.mjs SECURITY.md .github/ISSUE_TEMPLATE
+git add package.json package-lock.json CHANGELOG.md docs/RELEASE_NOTES_v0.1.x.md docs/PRODUCTION_READINESS.md docs/MAINTAINER_TRIAGE.md docs/FRAMEWORK_TUNING.md docs/GITHUB_ACTIONS.md examples/ci examples/consumer-quickstart examples/tuning scripts/check-ci-adoption.mjs scripts/check-consumer-quickstart.mjs scripts/check-framework-tuning.mjs scripts/doctor-framework-tuning.mjs SECURITY.md .github/ISSUE_TEMPLATE
 git commit -m "Release v0.1.x"
 git tag -a v0.1.x -m "Memento Mori Jester v0.1.x"
 git push origin main
@@ -82,6 +84,7 @@ npx.cmd -y memento-mori-jester@latest config init --preset ai --path jester-ai.c
 npx.cmd -y memento-mori-jester@latest config validate --config jester-ai.config.json
 npx.cmd -y memento-mori-jester@latest config init --preset security --path jester-security.config.json
 npx.cmd -y memento-mori-jester@latest config validate --config jester-security.config.json
+npm.cmd run consumer:quickstart:check -- --package memento-mori-jester@latest
 ```
 
 ## 4. MCP Copy-Paste

package/docs/RELEASE_NOTES_v0.1.85.md

@@ -0,0 +1,54 @@
+# Memento Mori Jester v0.1.85
+
+## Summary
+
+This release adds a narrow adoption smoke workflow for real repos. It gives teams a read-only GitHub Actions recipe that checks the package health, proves a summary review path, and verifies the published framework tuning cookbook scripts before they enable heavier code-scanning workflows.
+
+## What Changed
+
+- Added `examples/ci/adoption-smoke.yml`.
+- Added `scripts/check-ci-adoption.mjs`.
+- Added `npm run ci:adoption:check`.
+- Wired the adoption checker into `npm test` and production-readiness checks.
+- Updated README, GitHub Actions docs, CI example docs, release docs, production-readiness docs, roadmap, and changelog.
+
+## Public Interface
+
+- No CLI command changes.
+- No MCP tool changes.
+- No config schema changes.
+- No review rule, scoring, matching, or verdict behavior changes.
+- No GitHub Action input changes.
+- New maintainer/package script: `npm run ci:adoption:check`.
+- New checked example workflow: `examples/ci/adoption-smoke.yml`.
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run promo:card:check
+npm.cmd run promo:check
+npm.cmd run framework:tuning:check
+npm.cmd run framework:tuning:doctor
+npm.cmd run ci:adoption:check
+npm.cmd run fixtures:report
+npm.cmd run fixtures:report -- --json
+npm.cmd run fixtures:report -- --markdown
+npm.cmd run site:check
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js summary --kind command "git reset --hard"
+node .\dist\cli.js tune coverage --no-config
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.85 adoption smoke CI"
+```
+
+Expected:
+
+- `ci:adoption:check` passes for `examples/ci/adoption-smoke.yml`,
+- `framework:tuning:doctor` still runs 10 executable tune commands,
+- fixture report still shows `Fixtures: 222`,
+- no thin rule coverage,
+- no preset/kind gaps,
+- no rules without quiet-pass coverage,
+- GitHub Release and npm Publish complete from the `v0.1.85` tag.

package/docs/RELEASE_NOTES_v0.1.86.md

@@ -0,0 +1,64 @@
+# Memento Mori Jester v0.1.86
+
+## Summary
+
+This release adds a minimal consumer-project smoke path. The adoption CI example already proves copied workflow commands from GitHub Actions; this release proves the same first commands after installing the package into a clean temporary project.
+
+## What Changed
+
+- Added `examples/consumer-quickstart/package.json`.
+- Added `examples/consumer-quickstart/README.md`.
+- Added `scripts/check-consumer-quickstart.mjs`.
+- Added `npm run consumer:quickstart:check`.
+- Wired the consumer quickstart checker into `npm test` and production-readiness checks.
+- Updated README, GitHub Actions docs, CI example docs, release docs, production-readiness docs, roadmap, and changelog.
+
+## Public Interface
+
+- No CLI command changes.
+- No MCP tool changes.
+- No config schema changes.
+- No review rule, scoring, matching, or verdict behavior changes.
+- No GitHub Action input changes.
+- New maintainer/package script: `npm run consumer:quickstart:check`.
+- New checked example fixture: `examples/consumer-quickstart`.
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run promo:card:check
+npm.cmd run promo:check
+npm.cmd run framework:tuning:check
+npm.cmd run framework:tuning:doctor
+npm.cmd run ci:adoption:check
+npm.cmd run consumer:quickstart:check
+npm.cmd run fixtures:report
+npm.cmd run fixtures:report -- --json
+npm.cmd run fixtures:report -- --markdown
+npm.cmd run site:check
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js summary --kind command "git reset --hard"
+node .\dist\cli.js tune coverage --no-config
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.86 consumer quickstart smoke"
+```
+
+Expected:
+
+- `consumer:quickstart:check` installs the package into a temporary minimal project,
+- `jester:doctor` passes from that project,
+- `jester:summary` blocks `git reset --hard` from that project,
+- packaged `framework:tuning:check` and `framework:tuning:doctor` pass from the installed dependency,
+- fixture report still shows `Fixtures: 222`,
+- GitHub Release and npm Publish complete from the `v0.1.86` tag.
+
+After publish:
+
+```powershell
+npm.cmd view memento-mori-jester version --silent
+npx.cmd -y memento-mori-jester@latest doctor
+npx.cmd -y memento-mori-jester@latest summary --kind command "git reset --hard"
+npm.cmd run consumer:quickstart:check -- --package memento-mori-jester@latest
+```

package/examples/ci/README.md

@@ -13,8 +13,18 @@ npx -y memento-mori-jester@latest bootstrap --preset web
 
 Then copy the workflow that best matches your stack into `.github/workflows/memento-mori.yml`.
 
+If you want a first CI smoke before enabling code scanning, copy [Adoption Smoke](adoption-smoke.yml). It runs:
+
+- `npx -y memento-mori-jester@latest doctor`
+- `npx -y memento-mori-jester@latest summary --kind command "git reset --hard"`
+- `npm run framework:tuning:check` and `npm run framework:tuning:doctor` from the published package tarball
+
+Maintainers can prove those commands from a minimal installed project with [Consumer Quickstart Smoke](../consumer-quickstart) and `npm run consumer:quickstart:check`.
+
 ## Workflows
 
+- [Adoption Smoke](adoption-smoke.yml): read-only setup check for doctor, summary, and framework tuning cookbook commands.
+- [Consumer Quickstart Smoke](../consumer-quickstart): minimal installed-project fixture for the adoption commands.
 - [Next.js](nextjs.yml): app-router, middleware, redirects, public env, and browser-rendered UI.
 - [Vite React](vite-react.yml): browser storage, public config, redirects, and unsafe HTML surfaces.
 - [Express API](express-api.yml): CORS, auth bypasses, raw SQL, webhooks, and migrations.
@@ -25,5 +35,6 @@ Then copy the workflow that best matches your stack into `.github/workflows/meme
 ## Notes
 
 - Workflows upload SARIF and add a readable Actions job summary.
+- The adoption smoke workflow is read-only and does not upload SARIF.
 - Most stacks fail CI only on `BLOCK`.
 - The Terraform/Kubernetes example uses `fail-on: caution` because infra repos often want lower tolerance for risky changes.

package/examples/ci/adoption-smoke.yml

@@ -0,0 +1,42 @@
+name: Memento Mori Jester Adoption Smoke
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  adoption-smoke:
+    name: Adoption smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Jester doctor
+        run: npx -y memento-mori-jester@latest doctor
+
+      - name: Command summary smoke
+        run: npx -y memento-mori-jester@latest summary --kind command "git reset --hard"
+
+      - name: Framework tuning cookbook smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          workdir="$(mktemp -d)"
+          trap 'rm -rf "$workdir"' EXIT
+          npm pack memento-mori-jester@latest --pack-destination "$workdir" --silent
+          tar -xzf "$workdir"/memento-mori-jester-*.tgz -C "$workdir"
+          npm install --omit=dev --ignore-scripts --prefix "$workdir/package"
+          npm run framework:tuning:check --prefix "$workdir/package"
+          npm run framework:tuning:doctor --prefix "$workdir/package"

package/examples/consumer-quickstart/README.md

@@ -0,0 +1,30 @@
+# Consumer Quickstart Smoke
+
+This tiny project proves the first commands a real repo copies still work after installing Memento Mori Jester from npm.
+
+```powershell
+npm install --save-dev memento-mori-jester
+npm run jester:doctor
+npm run jester:summary
+npm run jester:framework-tuning:check
+npm run jester:framework-tuning:doctor
+```
+
+The package scripts map to the same public commands used by [Adoption Smoke CI](../ci/adoption-smoke.yml) at `examples/ci/adoption-smoke.yml`:
+
+- `jester doctor`
+- `jester summary --kind command "git reset --hard"`
+- `npm run framework:tuning:check --prefix node_modules/memento-mori-jester`
+- `npm run framework:tuning:doctor --prefix node_modules/memento-mori-jester`
+
+Maintainers can run the checked version from the repo root:
+
+```powershell
+npm run consumer:quickstart:check
+```
+
+After publishing, the same checker can verify the public registry package:
+
+```powershell
+npm run consumer:quickstart:check -- --package memento-mori-jester@latest
+```

package/examples/consumer-quickstart/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "memento-mori-jester-consumer-quickstart",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Minimal consumer project used to smoke-test Memento Mori Jester quickstart commands.",
+  "scripts": {
+    "jester:doctor": "jester doctor",
+    "jester:summary": "jester summary --kind command \"git reset --hard\"",
+    "jester:framework-tuning:check": "npm run framework:tuning:check --prefix node_modules/memento-mori-jester",
+    "jester:framework-tuning:doctor": "npm run framework:tuning:doctor --prefix node_modules/memento-mori-jester"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memento-mori-jester",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "description": "A local court-jester sidecar for AI coding agents: review plans, commands, diffs, and final claims before they get too pleased with themselves.",
   "type": "module",
   "repository": {
@@ -40,7 +40,7 @@
     "build": "tsc -p tsconfig.json",
     "start": "node dist/server.js",
     "start:mcp": "node dist/server.js",
-    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run promo:check && npm run site:check && npm run production:check",
+    "test": "npm run build && node scripts/run-tests.mjs && npm run fixtures:check && npm run fixtures:report && npm run framework:tuning:check && npm run framework:tuning:doctor && npm run ci:adoption:check && npm run consumer:quickstart:check && npm run promo:check && npm run site:check && npm run production:check",
     "doctor": "node dist/cli.js doctor",
     "demo:svg": "node scripts/render-demo-svg.mjs",
     "demo:svg:check": "node scripts/render-demo-svg.mjs --check",
@@ -48,6 +48,8 @@
     "fixtures:report": "node scripts/report-fixtures.mjs",
     "framework:tuning:check": "node scripts/check-framework-tuning.mjs",
     "framework:tuning:doctor": "node scripts/doctor-framework-tuning.mjs",
+    "ci:adoption:check": "node scripts/check-ci-adoption.mjs",
+    "consumer:quickstart:check": "node scripts/check-consumer-quickstart.mjs",
     "promo:card": "node scripts/render-social-card.mjs",
     "promo:card:check": "node scripts/render-social-card.mjs --check",
     "promo:check": "node scripts/check-promo-freshness.mjs",

package/scripts/check-ci-adoption.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const root = process.cwd();
+const failures = [];
+const workflowPath = "examples/ci/adoption-smoke.yml";
+const workflow = read(workflowPath);
+const examplesReadme = read("examples/ci/README.md");
+const githubActionsDocs = read("docs/GITHUB_ACTIONS.md");
+const readme = read("README.md");
+
+const unsafeContentPatterns = [
+  { name: "private key block", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OpenAI-looking secret key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { name: "Anthropic-looking secret key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub-looking token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/ },
+  { name: "AWS access key id", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "Slack-looking token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
+  { name: "absolute Unix home path", pattern: /(?:^|[\s"'`])\/(?:Users|home)\/[A-Za-z0-9._-]+/ },
+  { name: "absolute Windows user path", pattern: /[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\/ }
+];
+
+function read(path) {
+  return readFileSync(join(root, path), "utf8");
+}
+
+function requireText(path, content, pattern, description) {
+  if (!pattern.test(content)) {
+    failures.push(`${path} should include ${description}.`);
+  }
+}
+
+function forbidText(path, content, pattern, description) {
+  if (pattern.test(content)) {
+    failures.push(`${path} should not include ${description}.`);
+  }
+}
+
+for (const [path, content] of [
+  [workflowPath, workflow],
+  ["examples/ci/README.md", examplesReadme],
+  ["docs/GITHUB_ACTIONS.md", githubActionsDocs],
+  ["README.md", readme]
+]) {
+  for (const unsafe of unsafeContentPatterns) {
+    if (unsafe.pattern.test(content)) {
+      failures.push(`${path} appears to contain ${unsafe.name}; adoption examples should stay public and redacted.`);
+    }
+  }
+}
+
+requireText(workflowPath, workflow, /^name: Memento Mori Jester Adoption Smoke/m, "the adoption smoke workflow name");
+requireText(workflowPath, workflow, /^\s*pull_request:/m, "a pull_request trigger");
+requireText(workflowPath, workflow, /^\s*workflow_dispatch:/m, "a manual trigger");
+requireText(workflowPath, workflow, /^permissions:\s*\n\s*contents: read/m, "read-only contents permission");
+requireText(workflowPath, workflow, /actions\/checkout@v6/, "checkout@v6");
+requireText(workflowPath, workflow, /actions\/setup-node@v6/, "setup-node@v6");
+requireText(workflowPath, workflow, /node-version:\s*24/, "Node 24");
+requireText(workflowPath, workflow, /npx -y memento-mori-jester@latest doctor/, "the doctor command");
+requireText(workflowPath, workflow, /npx -y memento-mori-jester@latest summary --kind command "git reset --hard"/, "the command summary smoke");
+requireText(workflowPath, workflow, /npm pack memento-mori-jester@latest --pack-destination "\$workdir" --silent/, "the registry package smoke");
+requireText(workflowPath, workflow, /npm run framework:tuning:check --prefix "\$workdir\/package"/, "the framework tuning check command");
+requireText(workflowPath, workflow, /npm run framework:tuning:doctor --prefix "\$workdir\/package"/, "the framework tuning doctor command");
+requireText(workflowPath, workflow, /trap 'rm -rf "\$workdir"' EXIT/, "temporary package cleanup");
+forbidText(workflowPath, workflow, /pull_request_target/, "pull_request_target");
+forbidText(workflowPath, workflow, /security-events:\s*write|contents:\s*write|pull-requests:\s*write|id-token:\s*write/, "write permissions");
+forbidText(workflowPath, workflow, /npm publish|gh release|git push/, "release or publish commands");
+
+for (const [path, content] of [
+  ["examples/ci/README.md", examplesReadme],
+  ["docs/GITHUB_ACTIONS.md", githubActionsDocs],
+  ["README.md", readme]
+]) {
+  requireText(path, content, /adoption-smoke\.yml/, "the adoption smoke workflow link");
+  requireText(path, content, /doctor/, "doctor adoption guidance");
+  requireText(path, content, /summary --kind command "git reset --hard"/, "summary smoke guidance");
+  requireText(path, content, /framework:tuning:doctor/, "framework tuning doctor guidance");
+}
+
+if (failures.length > 0) {
+  console.error("CI adoption example check failed:");
+  for (const failure of failures) {
+    console.error(`- ${failure}`);
+  }
+  process.exit(1);
+}
+
+console.log("CI adoption example check passed for examples/ci/adoption-smoke.yml.");

package/scripts/check-consumer-quickstart.mjs

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const root = join(scriptDir, "..");
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const npmExecPath = process.env.npm_execpath;
+const fixtureDir = join(root, "examples", "consumer-quickstart");
+const fixturePackagePath = join(fixtureDir, "package.json");
+const fixtureReadmePath = join(fixtureDir, "README.md");
+const args = process.argv.slice(2);
+
+process.on("uncaughtException", (error) => {
+  console.error("Consumer quickstart check failed:");
+  console.error(`- ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(1);
+});
+
+let requestedPackageSpec = null;
+let keepTemp = false;
+
+for (let index = 0; index < args.length; index += 1) {
+  const arg = args[index];
+  if (arg === "--package" || arg === "--package-spec") {
+    requestedPackageSpec = args[index + 1];
+    index += 1;
+  } else if (arg === "--registry-latest") {
+    requestedPackageSpec = "memento-mori-jester@latest";
+  } else if (arg === "--keep-temp") {
+    keepTemp = true;
+  } else {
+    fail(`Unknown option: ${arg}`);
+  }
+}
+
+if (requestedPackageSpec === "") {
+  fail("--package requires a non-empty npm package spec.");
+}
+
+const unsafeContentPatterns = [
+  { name: "private key block", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OpenAI-looking secret key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { name: "Anthropic-looking secret key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub-looking token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/ },
+  { name: "AWS access key id", pattern: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "Slack-looking token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
+  { name: "absolute Unix home path", pattern: /(?:^|[\s"'`])\/(?:Users|home)\/[A-Za-z0-9._-]+/ },
+  { name: "absolute Windows user path", pattern: /[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\/ }
+];
+
+checkFixtureFiles();
+
+const tempRoot = mkdtempSync(join(tmpdir(), "jester-consumer-quickstart-"));
+let packageSpec = requestedPackageSpec;
+let packageLabel = requestedPackageSpec ?? "local packed package";
+
+try {
+  if (!packageSpec) {
+    packageSpec = packLocalPackage(tempRoot);
+  }
+
+  const consumerDir = join(tempRoot, "consumer-project");
+  cpSync(fixtureDir, consumerDir, { recursive: true });
+  installPackageSpec(consumerDir, packageSpec);
+
+  const doctor = runNpm(["run", "jester:doctor"], { cwd: consumerDir });
+  requireOutput(doctor, /PASS package-version/, "doctor package-version pass");
+  requireOutput(doctor, /The fool is fit for court\./, "doctor success footer");
+
+  const summary = runNpm(["run", "jester:summary"], { cwd: consumerDir });
+  requireOutput(summary, /Verdict: BLOCK/, "summary block verdict");
+  requireOutput(summary, /destructive-git-history/, "destructive git rule hit");
+
+  const tuningCheck = runNpm(["run", "jester:framework-tuning:check"], { cwd: consumerDir });
+  requireOutput(tuningCheck, /Framework tuning check passed for 5 recipes\./, "framework tuning cookbook check success");
+
+  const tuningDoctor = runNpm(["run", "jester:framework-tuning:doctor"], { cwd: consumerDir });
+  requireOutput(tuningDoctor, /Framework tuning doctor/, "framework tuning doctor heading");
+  requireOutput(tuningDoctor, /Checked 5 recipe\(s\), 10 executable tune command\(s\), and 34 fixture rule reference\(s\)\./, "framework tuning doctor totals");
+
+  console.log("Consumer quickstart check");
+  console.log(`PASS installed ${packageLabel}`);
+  console.log("PASS npm run jester:doctor");
+  console.log("PASS npm run jester:summary");
+  console.log("PASS npm run jester:framework-tuning:check");
+  console.log("PASS npm run jester:framework-tuning:doctor");
+} finally {
+  if (keepTemp) {
+    console.log(`Kept temp project at ${tempRoot}`);
+  } else {
+    rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+function checkFixtureFiles() {
+  if (!existsSync(fixturePackagePath)) {
+    fail("examples/consumer-quickstart/package.json is missing.");
+  }
+
+  if (!existsSync(fixtureReadmePath)) {
+    fail("examples/consumer-quickstart/README.md is missing.");
+  }
+
+  const fixturePackageRaw = readFileSync(fixturePackagePath, "utf8");
+  const fixtureReadme = readFileSync(fixtureReadmePath, "utf8");
+  const fixturePackage = JSON.parse(fixturePackageRaw);
+
+  for (const [path, content] of [
+    ["examples/consumer-quickstart/package.json", fixturePackageRaw],
+    ["examples/consumer-quickstart/README.md", fixtureReadme]
+  ]) {
+    for (const unsafe of unsafeContentPatterns) {
+      if (unsafe.pattern.test(content)) {
+        fail(`${path} appears to contain ${unsafe.name}; consumer examples should stay public and redacted.`);
+      }
+    }
+  }
+
+  const expectedScripts = {
+    "jester:doctor": "jester doctor",
+    "jester:summary": "jester summary --kind command \"git reset --hard\"",
+    "jester:framework-tuning:check": "npm run framework:tuning:check --prefix node_modules/memento-mori-jester",
+    "jester:framework-tuning:doctor": "npm run framework:tuning:doctor --prefix node_modules/memento-mori-jester"
+  };
+
+  if (fixturePackage.private !== true) {
+    fail("examples/consumer-quickstart/package.json should stay private.");
+  }
+
+  for (const [scriptName, scriptCommand] of Object.entries(expectedScripts)) {
+    if (fixturePackage.scripts?.[scriptName] !== scriptCommand) {
+      fail(`examples/consumer-quickstart/package.json script ${scriptName} should be "${scriptCommand}".`);
+    }
+  }
+
+  for (const expected of [
+    "npm install --save-dev memento-mori-jester",
+    "npm run jester:doctor",
+    "npm run jester:summary",
+    "npm run jester:framework-tuning:check",
+    "npm run jester:framework-tuning:doctor",
+    "examples/ci/adoption-smoke.yml",
+    "npm run consumer:quickstart:check"
+  ]) {
+    if (!fixtureReadme.includes(expected)) {
+      fail(`examples/consumer-quickstart/README.md should include ${expected}.`);
+    }
+  }
+}
+
+function packLocalPackage(destination) {
+  const cliPath = join(root, "dist", "cli.js");
+  if (!existsSync(cliPath)) {
+    fail(`${cliPath} is missing. Run npm run build before npm run consumer:quickstart:check.`);
+  }
+
+  const output = runNpm(["pack", "--ignore-scripts", "--pack-destination", destination, "--silent"], { cwd: root });
+  const filename = output.trim().split(/\r?\n/).filter(Boolean).at(-1);
+  if (!filename) {
+    fail("npm pack did not return a tarball filename.");
+  }
+
+  return isAbsolute(filename) ? filename : resolve(destination, filename);
+}
+
+function installPackageSpec(consumerDir, spec) {
+  const packagePath = join(consumerDir, "package.json");
+  const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+  packageJson.devDependencies = {
+    "memento-mori-jester": spec
+  };
+  writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`);
+
+  runNpm(["install", "--ignore-scripts", "--no-audit", "--no-fund"], { cwd: consumerDir });
+}
+
+function runNpm(commandArgs, options = {}) {
+  if (npmExecPath) {
+    return run(process.execPath, [npmExecPath, ...commandArgs], options);
+  }
+
+  return run(npmCommand, commandArgs, options);
+}
+
+function run(command, commandArgs, options = {}) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: options.cwd ?? root,
+    encoding: "utf8",
+    maxBuffer: 20 * 1024 * 1024,
+    env: {
+      ...process.env,
+      npm_config_audit: "false",
+      npm_config_fund: "false"
+    }
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (result.status !== 0) {
+    const detail = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    fail(`${command} ${commandArgs.join(" ")} failed${detail ? `:\n${detail}` : "."}`);
+  }
+
+  return result.stdout;
+}
+
+function requireOutput(output, pattern, description) {
+  if (!pattern.test(output)) {
+    fail(`Expected ${description}. Output was:\n${output}`);
+  }
+}
+
+function fail(message) {
+  throw new Error(message);
+}

package/scripts/check-production-readiness.mjs

@@ -70,6 +70,8 @@ for (const path of [
   "scripts/check-site.mjs",
   "scripts/check-framework-tuning.mjs",
   "scripts/doctor-framework-tuning.mjs",
+  "scripts/check-ci-adoption.mjs",
+  "scripts/check-consumer-quickstart.mjs",
   "scripts/check-fixtures.mjs",
   "scripts/report-fixtures.mjs",
   ".github/ISSUE_TEMPLATE/bug_report.yml",
@@ -82,6 +84,9 @@ for (const path of [
   "examples/github-action.yml",
   "examples/github-code-scanning.yml",
   "examples/ci/README.md",
+  "examples/ci/adoption-smoke.yml",
+  "examples/consumer-quickstart/README.md",
+  "examples/consumer-quickstart/package.json",
   "examples/presets/README.md",
   "examples/tuning/README.md",
   "examples/tuning/framework-tuning-cookbook.json",
@@ -106,6 +111,8 @@ requireText("README.md", /fixtures:report/, "fixture coverage report guidance");
 requireText("README.md", /fixtures:report -- --markdown/, "Markdown fixture report guidance");
 requireText("README.md", /FRAMEWORK_TUNING\.md/, "framework tuning guide link");
 requireText("README.md", /examples\/tuning/, "framework tuning cookbook link");
+requireText("README.md", /adoption-smoke\.yml/, "adoption smoke CI link");
+requireText("README.md", /consumer-quickstart/, "consumer quickstart smoke link");
 requireText("README.md", /License: PolyForm Noncommercial/, "the noncommercial license badge");
 requireText("docs/PRODUCTION_READINESS.md", /npm package/i, "npm package readiness");
 requireText("docs/PRODUCTION_READINESS.md", /GitHub Action/i, "GitHub Action readiness");
@@ -121,6 +128,8 @@ requireText("docs/PRODUCTION_READINESS.md", /fixtures:report/, "fixture coverage
 requireText("docs/PRODUCTION_READINESS.md", /fixtures:report -- --markdown/, "Markdown fixture report readiness");
 requireText("docs/PRODUCTION_READINESS.md", /framework:tuning:check/, "framework tuning cookbook readiness");
 requireText("docs/PRODUCTION_READINESS.md", /framework:tuning:doctor/, "framework tuning cookbook doctor readiness");
+requireText("docs/PRODUCTION_READINESS.md", /adoption-smoke\.yml/, "adoption smoke CI readiness");
+requireText("docs/PRODUCTION_READINESS.md", /consumer:quickstart:check/, "consumer quickstart smoke readiness");
 requireText("docs/PRODUCTION_READINESS.md", /quiet-pass/, "quiet-pass fixture readiness");
 requireText("docs/CLI.md", /jester doctor --json/, "doctor JSON CLI docs");
 requireText("docs/CLI.md", /quiet-pass fixture/, "quiet-pass fixture CLI docs");
@@ -133,6 +142,10 @@ requireText("docs/FRAMEWORK_TUNING.md", /Terraform/, "Terraform framework tuning
 requireText("docs/FRAMEWORK_TUNING.md", /jester tune <rule-id> --json/, "framework tuning command guidance");
 requireText("docs/FRAMEWORK_TUNING.md", /framework-tuning-cookbook\.json/, "framework tuning cookbook JSON link");
 requireText("docs/FRAMEWORK_TUNING.md", /framework:tuning:doctor/, "framework tuning doctor guidance");
+requireText("docs/GITHUB_ACTIONS.md", /adoption-smoke\.yml/, "adoption smoke GitHub Actions docs");
+requireText("docs/GITHUB_ACTIONS.md", /summary --kind command "git reset --hard"/, "adoption summary smoke docs");
+requireText("docs/GITHUB_ACTIONS.md", /framework:tuning:doctor/, "adoption framework tuning doctor docs");
+requireText("docs/GITHUB_ACTIONS.md", /consumer:quickstart:check/, "consumer quickstart GitHub Actions docs");
 requireText("docs/MAINTAINER_TRIAGE.md", /doctor --json/, "doctor JSON triage prompt");
 requireText("docs/MAINTAINER_TRIAGE.md", /tune <rule-id> --json/, "tune JSON triage prompt");
 requireText("docs/MAINTAINER_TRIAGE.md", /preset-review-cases\.json/, "fixture suite link");
@@ -143,6 +156,14 @@ requireText("examples/fixtures/README.md", /Adding A Fixture From A Report/, "fi
 requireText("examples/fixtures/README.md", /fixtures:check/, "fixture authoring check guidance");
 requireText("examples/fixtures/README.md", /fixtures:report/, "fixture coverage report guidance");
 requireText("examples/fixtures/README.md", /fixtures:report -- --markdown/, "Markdown fixture report guidance");
+requireText("examples/ci/README.md", /adoption-smoke\.yml/, "adoption smoke CI index link");
+requireText("examples/ci/README.md", /consumer-quickstart/, "consumer quickstart CI index link");
+requireText("examples/ci/adoption-smoke.yml", /npx -y memento-mori-jester@latest doctor/, "adoption smoke doctor command");
+requireText("examples/ci/adoption-smoke.yml", /summary --kind command "git reset --hard"/, "adoption smoke summary command");
+requireText("examples/ci/adoption-smoke.yml", /framework:tuning:doctor/, "adoption smoke tuning doctor command");
+requireText("examples/consumer-quickstart/README.md", /npm run consumer:quickstart:check/, "consumer quickstart check command");
+requireText("examples/consumer-quickstart/package.json", /jester:summary/, "consumer quickstart summary script");
+requireText("examples/consumer-quickstart/package.json", /framework:tuning:doctor/, "consumer quickstart tuning doctor script");
 requireText("examples/tuning/README.md", /framework-tuning-cookbook\.json/, "framework tuning cookbook JSON link");
 requireText("examples/tuning/README.md", /framework:tuning:doctor/, "framework tuning doctor guidance");
 requireText("examples/tuning/README.md", /jester tune <rule-id> --json|jester tune [a-z0-9-]+ --json/, "framework tuning command guidance");
@@ -164,10 +185,18 @@ requireText("scripts/doctor-framework-tuning.mjs", /dist.*cli\.js|cliPath/, "bui
 requireText("scripts/doctor-framework-tuning.mjs", /config.*init|config", "init"/, "generated preset config doctor");
 requireText("scripts/doctor-framework-tuning.mjs", /tune.*--json|tune", ruleId, "--json"/, "tune JSON doctor command");
 forbidText("scripts/doctor-framework-tuning.mjs", /src\/config\.ts|src\/types\.ts/, "source-only framework tuning doctor dependencies");
+requireText("scripts/check-ci-adoption.mjs", /adoption-smoke\.yml/, "adoption smoke checker target");
+requireText("scripts/check-ci-adoption.mjs", /pull_request_target/, "adoption smoke unsafe trigger guard");
+requireText("scripts/check-ci-adoption.mjs", /framework:tuning:doctor/, "adoption smoke tuning doctor guard");
+requireText("scripts/check-consumer-quickstart.mjs", /consumer-quickstart/, "consumer quickstart checker target");
+requireText("scripts/check-consumer-quickstart.mjs", /memento-mori-jester@latest/, "consumer quickstart registry verification option");
+requireText("scripts/check-consumer-quickstart.mjs", /framework:tuning:doctor/, "consumer quickstart tuning doctor guard");
 requireText("package.json", /"fixtures:check": "node scripts\/check-fixtures\.mjs"/, "fixture authoring check script");
 requireText("package.json", /"fixtures:report": "node scripts\/report-fixtures\.mjs"/, "fixture coverage report script");
 requireText("package.json", /"framework:tuning:check": "node scripts\/check-framework-tuning\.mjs"/, "framework tuning cookbook check script");
 requireText("package.json", /"framework:tuning:doctor": "node scripts\/doctor-framework-tuning\.mjs"/, "framework tuning cookbook doctor script");
+requireText("package.json", /"ci:adoption:check": "node scripts\/check-ci-adoption\.mjs"/, "CI adoption check script");
+requireText("package.json", /"consumer:quickstart:check": "node scripts\/check-consumer-quickstart\.mjs"/, "consumer quickstart check script");
 requireText("package.json", /"promo:card": "node scripts\/render-social-card\.mjs"/, "social card render script");
 requireText("package.json", /"promo:card:check": "node scripts\/render-social-card\.mjs --check"/, "social card stale check script");
 requireText("package.json", /"promo:check": "node scripts\/check-promo-freshness\.mjs"/, "promo freshness check script");
@@ -176,6 +205,8 @@ requireText("package.json", /npm run fixtures:check/, "fixture authoring check i
 requireText("package.json", /npm run fixtures:report/, "fixture coverage report in npm test");
 requireText("package.json", /npm run framework:tuning:check/, "framework tuning cookbook check in npm test");
 requireText("package.json", /npm run framework:tuning:doctor/, "framework tuning cookbook doctor in npm test");
+requireText("package.json", /npm run ci:adoption:check/, "CI adoption check in npm test");
+requireText("package.json", /npm run consumer:quickstart:check/, "consumer quickstart check in npm test");
 requireText("package.json", /npm run promo:check/, "promo freshness check in npm test");
 requireText("package.json", /npm run site:check/, "site check in npm test");
 requireText("scripts/check-promo-freshness.mjs", /--require-package-version/, "optional strict package-version promo check");