plugin-scanner 2.0.538__tar.gz → 2.0.540__tar.gz

{plugin_scanner-2.0.538 → plugin_scanner-2.0.540}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.538
+Version: 2.0.540
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

plugin_scanner-2.0.540/dashboard/src/about/about-analytics.ts

@@ -0,0 +1,20 @@
+/**
+ * About page analytics stub.
+ * No remote tracking in the local dashboard.
+ * All events use stable IDs only — never raw URLs, paths, or sensitive data.
+ */
+
+import type { AboutSectionId, AboutLinkId, AboutCtaId } from "./about-types";
+
+export type AboutEvent =
+  | { type: "about_page_viewed" }
+  | { type: "about_section_viewed"; sectionId: AboutSectionId }
+  | { type: "about_external_link_clicked"; linkId: AboutLinkId }
+  | { type: "about_cta_clicked"; ctaId: AboutCtaId };
+
+export function trackAboutEvent(event: AboutEvent): void {
+  if (import.meta.env.DEV) {
+    // eslint-disable-next-line no-console
+    console.debug("[about]", event);
+  }
+}

plugin_scanner-2.0.540/dashboard/src/about/about-content.test.ts

@@ -0,0 +1,195 @@
+import {
+  ABOUT_HERO_TITLE,
+  ABOUT_HERO_BODY,
+  ABOUT_HERO_KICKER,
+  ABOUT_LOCAL_SECTION_TITLE,
+  ABOUT_LOCAL_SECTION_BODY,
+  ABOUT_MISSION_SECTION_TITLE,
+  ABOUT_MISSION_SECTION_BODY,
+  ABOUT_OPEN_SOURCE_NOTE,
+  ABOUT_PARTNER_SECTION_TITLE,
+  ABOUT_PARTNER_SECTION_BODY,
+  ABOUT_PARTNER_CTA,
+  ABOUT_PARTNER_CTA_HREF,
+  ABOUT_AFFILIATE_SECTION_TITLE,
+  ABOUT_AFFILIATE_SECTION_BODY,
+  ABOUT_AFFILIATE_CTA,
+  ABOUT_AFFILIATE_CTA_HREF,
+  ABOUT_AFFILIATE_DISCLOSURE,
+  ABOUT_TRUST_CONTRACT_CLAIMS,
+  ABOUT_DATA_BOUNDARY_ROWS,
+  ABOUT_STANDARDS_NODES,
+  ABOUT_PATH_CARDS,
+  ABOUT_PARTNER_LEVELS,
+  ABOUT_AFFILIATE_TERMS,
+  ALLOWED_LINKS,
+} from "./about-content";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function assertNoBannedPhrases(text: string, sourceLabel: string): void {
+  const banned = [
+    "score a recurring commission",
+    "tamper-evident",
+    "guaranteed",
+    "unbreakable",
+    "always secure",
+    "cloud required",
+  ];
+  for (const phrase of banned) {
+    assert(
+      !text.toLowerCase().includes(phrase),
+      `${sourceLabel} avoids banned phrase: ${phrase}`
+    );
+  }
+}
+
+function collectAllCopy(): string {
+  const parts = [
+    ABOUT_HERO_TITLE,
+    ABOUT_HERO_BODY,
+    ABOUT_HERO_KICKER,
+    ABOUT_LOCAL_SECTION_TITLE,
+    ABOUT_LOCAL_SECTION_BODY,
+    ABOUT_MISSION_SECTION_TITLE,
+    ABOUT_MISSION_SECTION_BODY,
+    ABOUT_OPEN_SOURCE_NOTE,
+    ABOUT_PARTNER_SECTION_TITLE,
+    ABOUT_PARTNER_SECTION_BODY,
+    ABOUT_PARTNER_CTA,
+    ABOUT_AFFILIATE_SECTION_TITLE,
+    ABOUT_AFFILIATE_SECTION_BODY,
+    ABOUT_AFFILIATE_CTA,
+    ABOUT_AFFILIATE_DISCLOSURE,
+    ...ABOUT_TRUST_CONTRACT_CLAIMS.flatMap((c) => [c.title, c.body]),
+    ...ABOUT_DATA_BOUNDARY_ROWS.flatMap((r) => [r.label, r.localDefault, r.optionalSync, r.neverFromAbout]),
+    ...ABOUT_STANDARDS_NODES.flatMap((n) => [n.label, n.body]),
+    ...ABOUT_PATH_CARDS.flatMap((c) => [c.title, c.description, c.ctaLabel]),
+    ...ABOUT_PARTNER_LEVELS.flatMap((l) => [l.name, l.description]),
+    ABOUT_AFFILIATE_TERMS.commissionRate,
+    ABOUT_AFFILIATE_TERMS.commissionDuration,
+    ABOUT_AFFILIATE_TERMS.cookieWindow,
+    ABOUT_AFFILIATE_TERMS.qualificationNote,
+  ];
+  return parts.join(" ");
+}
+
+// Hero content
+assert(ABOUT_HERO_TITLE.length > 0, "hero title is non-empty");
+assert(ABOUT_HERO_BODY.length > 0, "hero body is non-empty");
+assert(ABOUT_HERO_KICKER.length > 0, "hero kicker is non-empty");
+assert(!ABOUT_HERO_BODY.includes("earn"), "hero body avoids earn language");
+
+// Local-first section
+assert(ABOUT_LOCAL_SECTION_TITLE.length > 0, "local section title is non-empty");
+assert(ABOUT_LOCAL_SECTION_BODY.length > 0, "local section body is non-empty");
+
+// Mission section
+assert(ABOUT_MISSION_SECTION_TITLE.length > 0, "mission title is non-empty");
+assert(ABOUT_MISSION_SECTION_BODY.length > 0, "mission body is non-empty");
+assert(!ABOUT_MISSION_SECTION_BODY.includes("earn"), "mission body avoids earn language");
+
+// Open source note
+assert(ABOUT_OPEN_SOURCE_NOTE.length > 0, "open source note is non-empty");
+
+// Partner section
+assert(ABOUT_PARTNER_SECTION_TITLE.length > 0, "partner title is non-empty");
+assert(ABOUT_PARTNER_SECTION_BODY.length > 0, "partner body is non-empty");
+assert(ABOUT_PARTNER_CTA.length > 0, "partner CTA label is non-empty");
+assert(
+  ABOUT_PARTNER_CTA_HREF.startsWith("https://") || ABOUT_PARTNER_CTA_HREF.startsWith("mailto:"),
+  "partner CTA uses HTTPS or mailto"
+);
+assert(!ABOUT_PARTNER_CTA_HREF.includes("guard-token"), "partner CTA has no guard-token");
+
+// Affiliate section
+assert(ABOUT_AFFILIATE_SECTION_TITLE.length > 0, "affiliate title is non-empty");
+assert(ABOUT_AFFILIATE_SECTION_BODY.length > 0, "affiliate body is non-empty");
+assert(ABOUT_AFFILIATE_CTA.length > 0, "affiliate CTA label is non-empty");
+assert(ABOUT_AFFILIATE_CTA_HREF.startsWith("https://"), "affiliate CTA uses HTTPS");
+assert(!ABOUT_AFFILIATE_CTA_HREF.includes("guard-token"), "affiliate CTA has no guard-token");
+assert(ABOUT_AFFILIATE_DISCLOSURE.length > 0, "affiliate disclosure is non-empty");
+
+// Trust contract claims
+assert(ABOUT_TRUST_CONTRACT_CLAIMS.length === 4, "trust contract claims has exactly 4 items");
+for (const claim of ABOUT_TRUST_CONTRACT_CLAIMS) {
+  assert(claim.title.length > 0, "trust claim title is non-empty");
+  assert(claim.body.length > 0, "trust claim body is non-empty");
+  assert(claim.proofLabel.length > 0, "trust claim proofLabel is non-empty");
+}
+
+// Data boundary rows
+assert(ABOUT_DATA_BOUNDARY_ROWS.length === 4, "data boundary rows has exactly 4 items");
+for (const row of ABOUT_DATA_BOUNDARY_ROWS) {
+  assert(row.label.length > 0, "data boundary label is non-empty");
+  assert(row.localDefault.length > 0, "data boundary localDefault is non-empty");
+  assert(row.optionalSync.length > 0, "data boundary optionalSync is non-empty");
+  assert(row.neverFromAbout.length > 0, "data boundary neverFromAbout is non-empty");
+}
+
+// Standards nodes
+assert(ABOUT_STANDARDS_NODES.length === 6, "standards nodes has exactly 6 items");
+for (const node of ABOUT_STANDARDS_NODES) {
+  assert(node.label.length > 0, "standards node label is non-empty");
+  assert(node.body.length > 0, "standards node body is non-empty");
+}
+
+// Path cards
+assert(ABOUT_PATH_CARDS.length === 5, "path cards has exactly 5 items");
+const primaryPaths = ABOUT_PATH_CARDS.filter((c) => c.priority === "primary");
+const secondaryPaths = ABOUT_PATH_CARDS.filter((c) => c.priority === "secondary");
+const tertiaryPaths = ABOUT_PATH_CARDS.filter((c) => c.priority === "tertiary");
+assert(primaryPaths.length === 1, "has exactly 1 primary path");
+assert(primaryPaths[0].id === "protect_locally", "primary path is protect_locally");
+assert(secondaryPaths.length === 2, "has exactly 2 secondary paths");
+assert(tertiaryPaths.length === 2, "has exactly 2 tertiary paths");
+assert(tertiaryPaths.some((c) => c.id === "affiliate_starter_kit"), "affiliate is tertiary");
+assert(tertiaryPaths.some((c) => c.id === "standards_partner"), "partner is tertiary");
+
+for (const card of ABOUT_PATH_CARDS) {
+  assert(card.title.length > 0, "path card title is non-empty");
+  assert(card.description.length > 0, "path card description is non-empty");
+  assert(card.ctaLabel.length > 0, "path card CTA label is non-empty");
+  assert(card.ctaHref.startsWith("https://"), "path card CTA uses HTTPS");
+  assert(!card.ctaHref.includes("guard-token"), "path card CTA has no guard-token");
+}
+
+// Partner levels
+assert(ABOUT_PARTNER_LEVELS.length === 3, "partner levels has exactly 3 items");
+for (const level of ABOUT_PARTNER_LEVELS) {
+  assert(level.name.length > 0, "partner level name is non-empty");
+  assert(level.description.length > 0, "partner level description is non-empty");
+}
+
+// Affiliate terms
+assert(ABOUT_AFFILIATE_TERMS.commissionRate.length > 0, "commission rate is non-empty");
+assert(ABOUT_AFFILIATE_TERMS.commissionDuration.length > 0, "commission duration is non-empty");
+assert(ABOUT_AFFILIATE_TERMS.cookieWindow.length > 0, "cookie window is non-empty");
+assert(ABOUT_AFFILIATE_TERMS.qualificationNote.length > 0, "qualification note is non-empty");
+
+// Allowed links
+assert(Object.keys(ALLOWED_LINKS).length >= 10, "has at least 10 allowed link definitions");
+for (const [id, cfg] of Object.entries(ALLOWED_LINKS)) {
+  assert(cfg.host.length > 0, `${id} has a host`);
+  assert(cfg.pathPrefix.length > 0, `${id} has a pathPrefix`);
+  assert(cfg.pathPrefix.startsWith("/"), `${id} pathPrefix starts with /`);
+}
+
+// Banned phrases across all copy
+assertNoBannedPhrases(collectAllCopy(), "all about copy");
+
+// Affiliate copy is honest - test checks for these exact words
+assert(
+  ABOUT_AFFILIATE_SECTION_BODY.toLowerCase().includes("approved affiliates"),
+  "affiliate body mentions approval requirement"
+);
+assert(
+  ABOUT_AFFILIATE_SECTION_BODY.toLowerCase().includes("qualified paid"),
+  "affiliate body mentions qualified paid referrals"
+);
+
+console.log("about-content.test.ts: all assertions passed");

plugin_scanner-2.0.540/dashboard/src/about/about-content.ts

@@ -0,0 +1,290 @@
+import type {
+  TrustContractClaim,
+  DataBoundaryRow,
+  StandardsNode,
+  AboutPathCard,
+  PartnerLevel,
+  AffiliateTerms,
+  AboutLinkId,
+} from "./about-types";
+
+export const ABOUT_HERO_KICKER = "Open standards. Local protection.";
+export const ABOUT_HERO_TITLE = "About HOL Guard";
+export const ABOUT_HERO_BODY =
+  "A local-first safety layer for AI harnesses, built by HOL as part of open trust infrastructure for the agent internet.";
+
+export const ABOUT_LOCAL_SECTION_TITLE = "What stays local";
+export const ABOUT_LOCAL_SECTION_BODY =
+  "Your approvals, receipts, and runtime snapshots stay on this device. Guard Cloud sync is optional and off by default. You control what leaves your machine.";
+
+export const ABOUT_MISSION_SECTION_TITLE = "Why HOL exists";
+export const ABOUT_MISSION_SECTION_BODY =
+  "HOL is building open trust infrastructure and standards for AI-agent ecosystems. We believe agents deserve registries they can verify, identities they can prove, receipts they can audit, and communication they can trust — without locking into any single vendor.";
+
+export const ABOUT_OPEN_SOURCE_NOTE =
+  "Open-source core. View the repository license for the authoritative terms.";
+
+export const ABOUT_PARTNER_SECTION_TITLE = "Standards partner program";
+export const ABOUT_PARTNER_SECTION_BODY =
+  "Join teams building on HOL open standards. Partners get early access to protocol drafts, co-marketing, and direct engineering support.";
+export const ABOUT_PARTNER_CTA = "Explore partner programs";
+export const ABOUT_PARTNER_CTA_HREF = "https://hol.org/guard/partners";
+
+export const ABOUT_AFFILIATE_SECTION_TITLE = "Affiliate starter kit";
+export const ABOUT_AFFILIATE_SECTION_BODY =
+  "Approved affiliates can share Guard with their community and receive recurring commission on qualified paid referrals.";
+export const ABOUT_AFFILIATE_CTA = "Learn about affiliates";
+export const ABOUT_AFFILIATE_CTA_HREF = "https://hol.org/guard/affiliates";
+
+export const ABOUT_AFFILIATE_DISCLOSURE =
+  "Affiliate earnings are paid on qualified paid customers after approval. Terms apply.";
+
+export const ABOUT_TRUST_CONTRACT_CLAIMS: TrustContractClaim[] = [
+  {
+    id: "local_decisions",
+    title: "Local decisions stay local",
+    body: "Approvals and saved policy decisions are stored on this machine unless you enable sync.",
+    proofLabel: "Local-first",
+    tone: "blue",
+  },
+  {
+    id: "exportable_receipts",
+    title: "Receipts are inspectable",
+    body: "Guard stores local receipts you can inspect, export, and compare over time.",
+    proofLabel: "Auditable",
+    tone: "green",
+  },
+  {
+    id: "optional_sync",
+    title: "Cloud sync is optional",
+    body: "Guard Cloud adds team policy and shared history, but local protection works without it.",
+    proofLabel: "Opt-in",
+    tone: "purple",
+  },
+  {
+    id: "open_standards",
+    title: "Built around open standards",
+    body: "HOL works on portable trust infrastructure for agent registries, identity, receipts, and coordination.",
+    proofLabel: "Portable",
+    tone: "slate",
+  },
+];
+
+export const ABOUT_DATA_BOUNDARY_ROWS: DataBoundaryRow[] = [
+  {
+    id: "approvals",
+    label: "Approvals and saved decisions",
+    localDefault: "Stored on this machine",
+    optionalSync: "Policy summaries when enabled",
+    neverFromAbout: "Raw prompts, local paths, secrets",
+  },
+  {
+    id: "receipts",
+    label: "Receipts",
+    localDefault: "Inspectable and exportable locally",
+    optionalSync: "Receipt history when enabled",
+    neverFromAbout: "Guard token or install ID",
+  },
+  {
+    id: "runtime_state",
+    label: "Runtime state",
+    localDefault: "Used to show local status",
+    optionalSync: "Aggregate fleet status when enabled",
+    neverFromAbout: "Workspace names or filesystem paths",
+  },
+  {
+    id: "external_links",
+    label: "About page links",
+    localDefault: "No remote calls on first render",
+    optionalSync: "None",
+    neverFromAbout: "Referral IDs or user identifiers",
+  },
+];
+
+export const ABOUT_STANDARDS_NODES: StandardsNode[] = [
+  {
+    id: "registries",
+    label: "Registries",
+    body: "Packages and agent capabilities should be discoverable and verifiable.",
+  },
+  {
+    id: "identity",
+    label: "Identity",
+    body: "Agents and tools need portable identity signals.",
+  },
+  {
+    id: "receipts",
+    label: "Receipts",
+    body: "Important actions should leave evidence users can audit.",
+  },
+  {
+    id: "privacy",
+    label: "Privacy",
+    body: "Local context should not leak just because a tool needs trust.",
+  },
+  {
+    id: "payments",
+    label: "Payments",
+    body: "Agent economies need trusted settlement rails.",
+  },
+  {
+    id: "communication",
+    label: "Communication",
+    body: "Agents need safe ways to coordinate across systems.",
+  },
+];
+
+export const ABOUT_PATH_CARDS: AboutPathCard[] = [
+  {
+    id: "protect_locally",
+    title: "Protect locally",
+    description:
+      "Install HOL Guard and start intercepting risky harness actions on this machine.",
+    ctaLabel: "Get started",
+    ctaHref: "https://hol.org/guard/install",
+    ctaId: "path_protect_locally",
+    priority: "primary",
+    tone: "blue",
+  },
+  {
+    id: "sync_team",
+    title: "Sync with your team",
+    description:
+      "Connect to Guard Cloud for shared policy bundles and cross-device fleet visibility.",
+    ctaLabel: "Guard Cloud",
+    ctaHref: "https://hol.org/guard",
+    ctaId: "path_sync_team",
+    priority: "secondary",
+    tone: "green",
+  },
+  {
+    id: "validate_ci",
+    title: "Validate packages in CI",
+    description:
+      "Add the plugin-scanner to your CI pipeline to catch risky dependencies before deploy.",
+    ctaLabel: "CI docs",
+    ctaHref: "https://hol.org/guard/docs/plugin-scanner/report-formats-and-ci",
+    ctaId: "path_validate_ci",
+    priority: "secondary",
+    tone: "purple",
+  },
+  {
+    id: "standards_partner",
+    title: "Standards partner program",
+    description:
+      "Contribute to open trust standards for agent identity, registries, and receipts.",
+    ctaLabel: "Explore partners",
+    ctaHref: "https://hol.org/guard/partners",
+    ctaId: "path_standards_partner",
+    priority: "tertiary",
+    tone: "slate",
+  },
+  {
+    id: "affiliate_starter_kit",
+    title: "Affiliate starter kit",
+    description:
+      "Approved affiliates can share Guard with their community and receive recurring commission on qualified paid referrals.",
+    ctaLabel: "Learn about affiliates",
+    ctaHref: "https://hol.org/guard/affiliates",
+    ctaId: "path_affiliate_starter_kit",
+    priority: "tertiary",
+    tone: "slate",
+    disclosureRequired: true,
+  },
+];
+
+export const ABOUT_PARTNER_LEVELS: PartnerLevel[] = [
+  {
+    name: "Integrator",
+    description: "Build Guard into your product or CI pipeline.",
+  },
+  {
+    name: "Standards contributor",
+    description: "Propose and review open trust protocol drafts.",
+  },
+  {
+    name: "Advocate",
+    description: "Publish guides, run workshops, and represent Guard in your community.",
+  },
+];
+
+export const ABOUT_AFFILIATE_TERMS: AffiliateTerms = {
+  commissionRate: "25%",
+  commissionDuration: "12 months",
+  cookieWindow: "120 days",
+  qualificationNote: "Qualified paid customers after approval",
+};
+
+export const ALLOWED_LINKS: Record<AboutLinkId, { host: string; pathPrefix: string }> = {
+  guard_docs: { host: "hol.org", pathPrefix: "/guard/docs" },
+  hol_home: { host: "hol.org", pathPrefix: "/" },
+  hol_guard: { host: "hol.org", pathPrefix: "/guard" },
+  hol_guard_install: { host: "hol.org", pathPrefix: "/guard/install" },
+  hol_guard_cloud: { host: "hol.org", pathPrefix: "/guard" },
+  plugin_scanner_ci_docs: { host: "hol.org", pathPrefix: "/guard/docs/plugin-scanner" },
+  standards_sdk_github: { host: "github.com", pathPrefix: "/hashgraph-online/standards-sdk" },
+  hol_partners: { host: "hol.org", pathPrefix: "/guard/partners" },
+  hol_affiliates: { host: "hol.org", pathPrefix: "/guard/affiliates" },
+  hol_guard_source: { host: "github.com", pathPrefix: "/hashgraph-online/hol-guard" },
+};
+
+// Legacy content preserved for backward compatibility during transition
+export const ABOUT_HERO_SUBTITLE = "A local safety layer for the agent internet.";
+export const ABOUT_HERO_BODY_LEGACY =
+  "HOL Guard protects local AI harness activity before risky work executes. HOL is building open trust infrastructure for the agent ecosystem — registries, identity, receipts, privacy, payments, and communication that agents can rely on.";
+
+export const ABOUT_TRUST_CARDS: import("./about-types").TrustCard[] = [
+  {
+    title: "Approvals stay here",
+    description:
+      "Every allow, block, and policy decision is stored locally. No cloud required.",
+  },
+  {
+    title: "Receipts are yours",
+    description:
+      "Guard generates tamper-evident receipts on this device. You own the audit trail.",
+  },
+  {
+    title: "Snapshots stay local",
+    description:
+      "Runtime state, inventory, and settings remain on this machine unless you choose to sync.",
+  },
+  {
+    title: "Optional cloud sync",
+    description:
+      "Guard Cloud is available for teams who want shared policy bundles and fleet visibility. It is off by default.",
+  },
+];
+
+export const ABOUT_PATH_CARDS_LEGACY: import("./about-types").PathCard[] = [
+  {
+    title: "Protect locally",
+    description: "Install HOL Guard and start intercepting risky harness actions on this machine.",
+    ctaLabel: "Get started",
+    ctaHref: "https://hol.org/guard/install",
+  },
+  {
+    title: "Sync with your team",
+    description: "Connect to Guard Cloud for shared policy bundles and cross-device fleet visibility.",
+    ctaLabel: "Guard Cloud",
+    ctaHref: "https://hol.org/guard",
+  },
+  {
+    title: "Validate packages in CI",
+    description: "Add the plugin-scanner to your CI pipeline to catch risky dependencies before deploy.",
+    ctaLabel: "CI docs",
+    ctaHref: "https://hol.org/guard/docs/plugin-scanner/report-formats-and-ci",
+  },
+  {
+    title: "Build standards",
+    description: "Contribute to open trust standards for agent identity, registries, and receipts.",
+    ctaLabel: "Standards repo",
+    ctaHref: "https://github.com/hashgraph-online/standards-sdk",
+  },
+  {
+    title: "Teach or promote Guard",
+    description: "Create content, run workshops, or share Guard with your community.",
+    ctaLabel: "Affiliate program",
+    ctaHref: "https://hol.org/guard/affiliates",
+  },
+];

plugin_scanner-2.0.540/dashboard/src/about/about-design.test.ts

@@ -0,0 +1,64 @@
+import {
+  ABOUT_PATH_CARDS,
+  ABOUT_TRUST_CONTRACT_CLAIMS,
+  ABOUT_DATA_BOUNDARY_ROWS,
+  ABOUT_STANDARDS_NODES,
+} from "./about-content";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+// Hierarchy: affiliate is tertiary, not primary or secondary
+const affiliateCard = ABOUT_PATH_CARDS.find((c) => c.id === "affiliate_starter_kit");
+assert(affiliateCard !== undefined, "affiliate card exists");
+assert(affiliateCard!.priority === "tertiary", "affiliate priority is tertiary");
+
+// Hero does not link to affiliate
+assert(
+  !ABOUT_PATH_CARDS.some((c) => c.priority === "primary" && c.id === "affiliate_starter_kit"),
+  "affiliate is not primary"
+);
+
+// Trust contract has 4 claims
+assert(ABOUT_TRUST_CONTRACT_CLAIMS.length === 4, "trust contract has 4 claims");
+
+// Data boundary has 4 rows
+assert(ABOUT_DATA_BOUNDARY_ROWS.length === 4, "data boundary has 4 rows");
+
+// Standards map has 6 nodes
+assert(ABOUT_STANDARDS_NODES.length === 6, "standards map has 6 nodes");
+
+// No local path or sensitive token patterns in content strings
+const allStrings = [
+  ...ABOUT_PATH_CARDS.flatMap((c) => [c.title, c.description, c.ctaLabel]),
+  ...ABOUT_TRUST_CONTRACT_CLAIMS.flatMap((c) => [c.title, c.body]),
+  ...ABOUT_DATA_BOUNDARY_ROWS.flatMap((r) => [r.label, r.localDefault, r.optionalSync, r.neverFromAbout]),
+  ...ABOUT_STANDARDS_NODES.flatMap((n) => [n.label, n.body]),
+].join(" ");
+
+const forbiddenPatterns = [
+  "/Users/",
+  "/home/",
+  "/var/folders/",
+  "guard-token",
+  "guardDaemon",
+  "workspace=",
+  "device=",
+  "install=",
+  "user=",
+  "127.0.0.1",
+  "localhost",
+  ".local",
+];
+
+for (const pattern of forbiddenPatterns) {
+  assert(
+    !allStrings.includes(pattern),
+    `content does not contain forbidden pattern: ${pattern}`
+  );
+}
+
+console.log("about-design.test.ts: all assertions passed");