validate-product

Audit one Plenipo product repo without touching it: config files parse and agree with each other, no committed secrets, the vendored package feed is pinned, the platform pin is not lagging, the greppable guardrail invariants hold, the agent-facing run surface exists, and the docs still describe the code. Emits a located, per-check pass/fail report and exits non-zero on any failure. USE FOR: pre-commit or CI conformance auditing of a single repo, catching a missing tenant query filter or an unapproved write tool before it ships, proving config hygiene. DO NOT USE FOR: fixing anything it reports (strictly read-only), proving the product actually behaves at runtime (/deliver:verify-runtime), or inventorying every repo (/scout:scan-fleet).

License

MIT