repo-auditlisted

# repo-audit A publish gate for repositories. It runs in two layers: - **Layer 1 (deterministic)** — Python checks with no model in the loop: secret patterns and entropy, committed `.env` files, git-history author identity, denylisted terms in commits/refs/content, test execution, declared-vs-real language, README image/link rot, staleness, GitHub description/topics quality, deferred-work markers. Every finding carries an explicit `remediation` string. Layer 1 is the only layer that can produce a `FAIL` and therefore the only layer that can flip the gate to `BLOCK`. - **Layer 2 (LLM-assisted)** — a small set of markdown prompts (README quality, setup completeness, changelog significance, language coherence, and a portfolio-only narrative check) that you, the agent, run yourself against the files `targets_for_layer2` names. Layer 2 can only add `INFO` or `WARN` findings — the engine hard-caps anything you emit as `FAIL` down to `WARN`. ## Single-repo flow 1. Run `scripts/audit.py <repo-path> [--profile portfolio|public|local] [--offline] [--json-out PATH]`. 2. Read the path printed as `JSON_PATH=<path>` — the **last line of stdout** — and load that JSON file (schema v2, see `docs/json_contract.md`). 3. For each entry in `targets_for_layer2`, open its `prompt_file` and apply it to the listed `files`. Produce zero or more findings in the exact shape the prompt's `## Output` section documents. 4. Append everything you produced to `findings_layer