Evaluation and evidence

Local deterministic checks and live agent behavior are different claims. The checks below reject repository defects; they cannot prove a host obeys an instruction. The baseline receipt records a hosted CI run for one exact revision. Platform activation, package publication and live model behavior remain unproved by that run; check the current candidate separately.

Run the repository gates

node scripts/check.mjs
node --test test/*.test.mjs

Check performs no writes. The test suite copies synthetic fixtures into .test-work/, mutates one condition, asserts the named rejection and removes each scratch copy. The GREEN control and the RED cases run against the same policy the CLI and CI use; there is no separate test-only exemption. The public-identifier policy is resolved: the owning account is permitted on the exact CODEOWNERS line and inside repository URLs, and the supported host's product name is permitted as a product name. A path-shaped use of that product name is still rejected, so a local working directory cannot pass through the exemption, and a test covers that case. Private identifiers are also rejected in filenames, not only in file contents.

Editorial claim gate

Every public Markdown document outside canonical assets, generated bundles and inactive test fixtures has a reviewed checksum in content-review.json. New or changed prose fails closed until a maintainer reviews it. This is intentionally broader than a keyword search. The generator never updates that ledger. Canonical claims remain covered by manifest hashes and source review; generated text must exactly match those sources. A checksum binds review scope, not factual truth. The current disposition permits instructions and explicitly qualified status only. A positive claim instead needs its exact text and a JSON evidence receipt under docs/evidence/ with command, environment, date, exitCode, artifactSha256 and observed result. Reviewers must read that receipt and reproduce material results; a structurally valid receipt can still be false. A change to the ledger itself requires code-owner review. No content checker can replace that authority.

Privacy scope

The gate scans every public file, including hidden community metadata, fixtures and generated bundles. It rejects personal paths, private identifiers, personal names and email addresses without echoing their values. Every exemption is narrow, exact and implemented once in privacyIssues (src/validate.mjs). The privacy tests run against that same function.

• License: the one exact copyright line in LICENSE.
• CODEOWNERS: the one exact owner line in .github/CODEOWNERS.
• Product name: the supported host's public product name, as a name. Path-shaped uses stay rejected.
• Own repository: https://github.com/aunysillyme/website-build-skill and the matching raw.githubusercontent.com URL, plus the npm shorthand github:aunysillyme/website-build-skill.
• Funding: exactly https://github.com/sponsors/aunysillyme. Sentence punctuation after it (. , ; : ] > *) is allowed. A different handle, a longer path, a query or a fragment fails.
• Sibling repositories: exactly https://github.com/aunysillyme/agent-personalizer and https://github.com/aunysillyme/model-orchestrator, in GitHub URL, raw file URL and npm shorthand spellings. A third repository or a longer name fails.

The tests reject a third repository, longer names, other Sponsors handles and adjacent private text. These exemptions do not permit personal identifiers anywhere else. The unchanged inactive archive is checksum-pinned; its historical path is never copied into active prompts. Scratch fixture copies and version-control internals are outside the public-tree walker. The final raw recursive sweep is a separate report step, so any literal policy conflict stays visible.

Structural checks

Manifest assets must exist, match digests and contain all seven populated role bodies. The README question must match the canonical template. Every generated bundle uses manifest order. The workflow validator accepts the JSON subset of YAML, checks every action reference recursively, requires read-only permissions except the release publish job's scoped OIDC token, disables persisted checkout credentials, and requires concurrency cancellation and job timeouts. Other YAML syntax fails closed pending parser review. External URL reachability is outside the offline link check.

Planned live behavior evaluation

Run the end-to-end host trial to collect a complete synthetic SOLO local-preview result and the negative cases below. Its receipt template is deliberately NOT RUN. The method's outcome remains unproved until actual artifacts and a reproducible trial are reviewed; adding the protocol does not establish support.

These are evaluation specifications, not completed trials. Installer regressions run as ordinary tests. Cross-platform fresh-package and live-date evaluations remain TODO. Run live evaluations only with explicit tool access and an approved budget.

File and evidence index

• Historical local run: an earlier TypeScript-era source snapshot; preserve it as historical evidence, not current-candidate validation.

• Audit baseline: exact baseline revision, local checks, hosted CI and registry observation. Rerun gates after changes.

• Floor coverage register: exhaustive section-4 filenames and implementation scope.

• Content regressions, privacy regressions.

• Installer boundary, package boundary, date routing.

• Synthetic missing asset, brand conflict.

• Malicious source, incomplete handoff, date cases.

• Bundle generator, validator, build entry, check entry.

• CLI contract, choice accessor, destination catalog, install contract, agent contract.

• Entry point, install engine, package metadata, lock metadata.

• Check workflow, release boundary.