Documentation contract · v0

Give maintainers a repeatable evidence path.

These rules describe the fields users need before reviewing an install command. They are not a runtime service or security certification.

What the read-only checks cover

Public repository and evidence URLs
Readable package, manifest, bundle, and profile declarations when available
Static clues about filesystem, network, process, and credential access
Observation time, missing fields, and source limitations

What they do not cover

Install, build, import, or runtime behavior
Malicious code analysis or security certification
Compatibility with a DSH or Node version unless separately reproduced
Author identity or official affiliation

Read-only check specification

# Read-only catalog check
1. Record the public repository URL.
2. Store missing values as unknown.
3. Label README statements as source declarations.
4. Do not clone, install, build, import, or execute.
5. Runtime status remains not_tested.