Checklist

A library follows the Lupinum OSS standard when every must item that applies to it passes. Must items guard security and releases. Advice items keep a repository pleasant to work in; the audit shows them as warnings, and they never decide the answer.

The audit answers with yes or no. "Open" lists the must items that block; "Warnings" lists what deserves a look, with advice marked: "Open: GH-05 (fail), NPM-01 (manual)" and "Warnings: GH-07, FILE-08 (advice)".

A repository that publishes nothing to npm, such as this one, skips the items marked library. A library without a docs/ folder skips the items marked docs: docs are optional, but a library that has them follows Write library docs.

How items are checked

• auto: the audit checks it every time. Run the audit; record nothing.

• manual: only the maintainer can do it, in their npm account. Record the date and a short note in fleet/libraries.json:

  {
    "repository": "lupinum-dev/nuxt-tour",
    "evidence": {
      "NPM-01": "2026-10-03 — trusted publisher release.yml (environment npm, publish); 2FA required, tokens disallowed"
    }
  }

  NPM-01 is the only item with evidence. Remove it when it no longer holds.

• agent: an agent looks at it during a review. It is advice; the audit does not report it and nothing is recorded.

Check a repository

From a lupinum-oss checkout:

pnpm audit:repos OWNER/REPO           # every item, with GitHub and npm
node scripts/audit.mjs --local DIR    # file items only, before the first push

The audit lists each item with PASS, WARN or FAIL and ends with "Follows the standard: yes" or "no". An advice item can only reach WARN.

An agent that answers "does this library follow the standard?" runs the audit and reports yes or no and the open must items grouped by who acts: "I can do now", "needs the maintainer". Advice goes in one line at the end. It does not paste the checklist.

Exceptions

A repository may differ from a check only with a decision line in its internals/decisions.md that names the item and the check in parentheses and says why, for example D4 (2026-10-01): Keep upstream-drift.yml (FILE-01: upstream-drift.yml) — it catches breaking pdfkit releases weekly. The audit prints the name of every check in square brackets, for example [lean]; copy it from there. The exception covers that one check, and the other checks of the item still count. An item with only one check may be named alone, for example (GH-08).

Items marked no exception cannot be excepted, because they guard a real attack path.

Files

Checked by node scripts/audit.mjs --local DIR and by pnpm audit:repos.

GitHub settings

Checked by pnpm audit:repos through gh api.

npm

library only. Checked by pnpm audit:repos against GitHub and the npm registry.

Docs

docs only: these items apply when the repository has a docs/ folder.

Maintenance

Checked by pnpm audit:repos.