chore(swarm): Stage A — make the falsifiability thesis actually true

Dogfood swarm Stage A (bug/security/quality) across 4 amend cycles.
Audit found that the repo's central claim — "deterministic marketing
infrastructure with falsifiable claims and hash-verified evidence" —
was largely unenforced. Stage A makes it true.

Validator hardening (marketing/scripts/):
- validate.mjs now hash-verifies every evidence file (was paper-only)
- gen-lock.mjs is byte-stable (dropped non-deterministic generatedAt)
- forbiddenPhrases, message constraints, path-traversal — all enforced
- ajv runs strict (was strict:false silently accepting schema typos)
- error envelopes replace raw Node stack traces
- _paths.mjs single source of truth for repo path resolution

Schema strictness (marketing/schema/):
- minLength:1 on freeform strings
- uniqueItems on reference arrays
- pressContact format-per-method validation
- sourceCommit oneOf [40-char SHA, "unknown-pending-public-release" sentinel]
- $defs/nonEmptyString registered

Data honesty (marketing/data/, manifests/):
- All zip-meta-map claims downgraded to aspirational pending upstream public release
- Dead evidence URLs removed (3 of 4 entries pointed to non-existent repo)
- "pip install zip-meta-map" replaced — package was 404 on PyPI
- targeting.seedRepos fixed (Aider-AI/aider, was aider-chat/aider 404)
- press.quotes emptied (was first-party self-quotes attributed to "team")
- All 5 messages rewritten in conditional/future tense with pre-launch markers

Test coverage (test/):
- 5 → 46 tests (+41) across 5 suites
- gen-lock.test.mjs: determinism roundtrip + lockfile drift detection
- validate.test.mjs: 10 negative-path tests (forbidden phrases, max chars,
  hash mismatch, dangling refs, duplicate IDs)
- hash-file.test.mjs: known-vector + POSIX path normalization
- _paths.test.mjs: 20 path-traversal guard tests
- version.test.mjs: hardened (canonical semver, MAJOR-matches-CHANGELOG)
- npm test wired (was missing; CI never ran tests)

CI hardening (.github/):
- Tests step added, ordered before lockfile drift check
- actions/setup-node SHA-pinned (was @v4 floating tag)
- permissions: contents: read (was inheriting broad GITHUB_TOKEN)
- paths filter expanded (.editorconfig, .gitattributes, .prettierignore, .github/**)
- Dependabot for npm + github-actions
- CodeQL workflow (javascript)
- CODEOWNERS
- timeout-minutes: 10 (was default 360)

Doc accuracy (README, CHANGELOG, SCORECARD, SHIP_GATE, SECURITY):
- README script names match package.json (was format:check, actual fmt:check)
- SHIP_GATE rows annotated with verification dates and [x]* legend
- SCORECARD revised to honest 42/50 (was unearned 50/50)
- SECURITY uses GHSA URL (was no-reply email that doesn't deliver)
- CHANGELOG [Unreleased] in Keep-a-Changelog format

5 swarm waves, 6 owned domains, exclusive file ownership enforced.
Final state: validate ✓ lock:check ✓ 46/46 tests ✓ fmt:check ✓
0 ajv strict-mode warnings (was 3).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mcp-tool-shop

.gitattributes

@@ -6,3 +6,15 @@
 *.jpg binary
 *.gif binary
 *.mp4 binary
+*.webp binary
+*.ico binary
+*.pdf binary
+*.zip binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.otf binary
+*.eot binary
+
+# Generated files
+marketing/manifests/marketing.lock.json linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @mcp-tool-shop

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps"
+    labels:
+      - "dependencies"
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps"
+    labels:
+      - "dependencies"

.github/workflows/ci.yml

@@ -5,33 +5,50 @@ on:
     branches: [main]
     paths:
       - "marketing/**"
+      - "test/**"
       - "package.json"
       - "package-lock.json"
       - ".prettierrc"
-      - ".github/workflows/**"
+      - ".prettierignore"
+      - ".editorconfig"
+      - ".gitattributes"
+      - ".github/**"
   pull_request:
     branches: [main]
     paths:
       - "marketing/**"
+      - "test/**"
       - "package.json"
       - "package-lock.json"
       - ".prettierrc"
-      - ".github/workflows/**"
+      - ".prettierignore"
+      - ".editorconfig"
+      - ".gitattributes"
+      - ".github/**"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        node-version: ["22"]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: ${{ matrix.node-version }}
           cache: npm
 
       - name: Install dependencies
@@ -43,5 +60,8 @@ jobs:
       - name: Schema + invariant validation
         run: npm run validate
 
+      - name: Tests
+        run: npm test
+
       - name: Lockfile drift check
         run: npm run lock:check

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (javascript)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5
+        with:
+          languages: javascript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3.35.5

.gitignore

@@ -4,3 +4,13 @@ dist/
 Thumbs.db
 *.swp
 *.swo
+.env
+.env.*
+!.env.example
+.idea/
+.vscode/
+*.iml
+npm-debug.log*
+.npm/
+coverage/
+desktop.ini

.prettierignore

@@ -1,2 +1,7 @@
 node_modules/
 marketing/manifests/marketing.lock.json
+coverage/
+dist/
+package-lock.json
+*.min.js
+*.min.css

.prettierrc

@@ -3,5 +3,6 @@
   "singleQuote": false,
   "trailingComma": "all",
   "printWidth": 100,
-  "tabWidth": 2
+  "tabWidth": 2,
+  "overrides": [{ "files": "*.md", "options": { "proseWrap": "preserve" } }]
 }

CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+Dogfood swarm wave 2 (2026-05-15) landed cross-cutting hardening.
+
+### Added
+
+- 41 new test cases under `test/` (5 → 46 total): `test/gen-lock.test.mjs` (determinism + lockfile drift, 7 tests), `test/validate.test.mjs` (schema + invariant negative paths, 10 tests), `test/hash-file.test.mjs` (hashing utility, 4 tests), `test/_paths.test.mjs` (path-traversal guards, 20 tests).
+- CI: Dependabot config (`.github/dependabot.yml`) for automated dependency updates.
+- CI: CodeQL workflow (`.github/workflows/codeql.yml`) for code scanning on every push and PR.
+- CI: minimal-permissions block on GitHub Actions workflows.
+- Repo ownership: `.github/CODEOWNERS`.
+- Scripts: `marketing/scripts/_paths.mjs` shared-paths module (single source of truth for repo path resolution across scripts).
+- Docs: top-level README Testing section.
+
+### Changed
+
+- Marketing-data contract: dead URLs and unverified PyPI claims downgraded to aspirational.
+- Validator hardening: `validate.mjs` enforces hash-verified evidence; `gen-lock.mjs` is fully deterministic; AJV runs in strict mode.
+- Error envelopes: scripts wrap failures in friendly try/catch envelopes (full Structured Error Shape with `code`/`hint`/`retryable` is **planned for v1.1**).
+- Docs accuracy: README script names match `package.json`.
+- SCORECARD methodology: now reports honest revised scores (42/50) alongside the original self-score (50/50) — see SCORECARD.md "Why scores were revised down."
+- SHIP_GATE: gate rows annotated with explicit verification dates (`(YYYY-MM-DD)`).
+
+### Fixed
+
+- SECURITY.md disclosure address switched to GitHub's private vulnerability advisory (GHSA URL).
+
+### Deferred
+
+- `verify` umbrella script (composing `validate` + `lock:check` + `test`) — **planned for v1.1**. Today the equivalent is the explicit `npm run validate && npm run lock:check && npm test` chain that CI runs.
+- Full Structured Error Shape (`code` / `message` / `hint` / `cause?` / `retryable?`) — **planned for v1.1**. Wave 2 shipped basic try/catch envelopes only.
+
 ## [1.0.0] - 2026-02-27
 
 ### Added

README.md

@@ -49,6 +49,7 @@ marketing/
     evidence.manifest.json   # Evidence registry with sha256 + provenance
     marketing.lock.json      # Lockfile pinning all files by hash
   scripts/          # validate, hash, gen-lock
+test/               # node:test suites — version, gen-lock, validate, hash-file, _paths (46 tests)
 ```
 
 ### Authored vs generated
@@ -111,13 +112,16 @@ All JSON uses sorted keys, stable array ordering, and trailing newlines. This pr
 npm install
 
 # Format check (Prettier)
-npm run format:check
+npm run fmt:check
 
 # Schema + invariant validation
 npm run validate
 
 # Lockfile drift check (CI mode)
 npm run lock:check
+
+# Tests (version + structure invariants)
+npm test
 ```
 
 **Typical development loop:**
@@ -126,7 +130,8 @@ npm run lock:check
 2. Add evidence entries to `marketing/manifests/evidence.manifest.json` (and artifacts under `marketing/evidence/` if applicable)
 3. Regenerate the lockfile: `node marketing/scripts/gen-lock.mjs`
 4. Validate: `npm run validate`
-5. Format: `npm run format:check` (fix with `npm run format`)
+5. Format: `npm run fmt:check` (fix with `npm run fmt`)
+6. Run tests: `npm test`
 
 ---
 
@@ -162,9 +167,26 @@ The quality bar is simple and non-negotiable:
 
 ---
 
-## Security
+## Testing
 
-No secrets, private URLs, API keys, or customer identifiers belong in this repo. Evidence means public artifacts — screenshots, CI links, test results — not internal logs or credentials. If something can't be shown publicly, it's not evidence.
+```bash
+npm test
+```
+
+Runs 46 tests across five suites under `test/` via the Node built-in test runner (no external test framework):
+
+- **`test/version.test.mjs`** — 5 version-consistency tests
+  - `package.json` version is canonical semver (X.Y.Z\[-pre]\[+build])
+  - `package.json` MAJOR matches the latest `## [X.Y.Z]` heading in `CHANGELOG.md`
+  - `CHANGELOG.md` contains a section heading for the current version (not just a link reference)
+  - `LICENSE` begins with "MIT License"
+  - `marketing/` exists and contains `schema/`, `data/`, `manifests/` subdirectories
+- **`test/gen-lock.test.mjs`** — 7 determinism + lockfile tests (lockfile drift detection, byte-stable serialization, ref-traversal hardening)
+- **`test/validate.test.mjs`** — 10 schema + invariant tests (negative-path coverage for proven-without-evidence, orphan files, hash mismatch, forbidden phrases, message length, etc.)
+- **`test/hash-file.test.mjs`** — 4 hashing-utility tests (known-vector, empty file, POSIX path normalization, usage error)
+- **`test/_paths.test.mjs`** — 20 path-traversal-guard tests (`assertSafeRef` and `assertSafePath` rejection + acceptance paths)
+
+CI runs `npm test` on every push and pull request.
 
 ---
 
@@ -174,7 +196,11 @@ MarketIR changes are versioned via `schemaVersion` in the schema and data files.
 
 ---
 
-## Security & Data Scope
+## Security
+
+No secrets, private URLs, API keys, or customer identifiers belong in this repo. Evidence means public artifacts — screenshots, CI links, test results — not internal logs or credentials. If something can't be shown publicly, it's not evidence.
+
+### Data scope
 
 | Aspect               | Detail                                                                      |
 | -------------------- | --------------------------------------------------------------------------- |
@@ -186,18 +212,26 @@ MarketIR changes are versioned via `schemaVersion` in the schema and data files.
 
 See [SECURITY.md](SECURITY.md) for vulnerability reporting.
 
+---
+
 ## Scorecard
 
 | Category            | Score     |
 | ------------------- | --------- |
-| A. Security         | 10        |
-| B. Error Handling   | 10        |
-| C. Operator Docs    | 10        |
-| D. Shipping Hygiene | 10        |
-| E. Identity (soft)  | 10        |
-| **Overall**         | **50/50** |
-
-> Full audit: [SHIP_GATE.md](SHIP_GATE.md) · [SCORECARD.md](SCORECARD.md)
+| A. Security         | 9         |
+| B. Error Handling   | 7         |
+| C. Operator Docs    | 9         |
+| D. Shipping Hygiene | 9         |
+| E. Identity (soft)  | 8         |
+| **Overall**         | **42/50** |
+
+> **Score: 42/50** (revised down from 50/50 after honest re-audit; see [SCORECARD.md](SCORECARD.md#why-scores-were-revised-down) for methodology).
+>
+> Last reviewed: 2026-05-15. Full audit: [SHIP_GATE.md](SHIP_GATE.md) · [SCORECARD.md](SCORECARD.md)
+>
+> **Audit cadence:** re-score on every minor release, or quarterly — whichever comes first.
+
+---
 
 ## License