Tighten public-safe context validation

Author: silvermanjared-web

.github/workflows/validate.yml

@@ -25,3 +25,6 @@ jobs:
 
       - name: Run manifest status checks
         run: npm run validate:manifest
+
+      - name: Run repository guardrail
+        run: python3 scripts/validate_repo.py

README.md

@@ -43,6 +43,8 @@ flowchart LR
 
 The repo includes package metadata and a validation script. The validation flow checks that the working context bundle exists, JSON files are parseable, the asset manifest has rows, every manifest row points to a committed file, and text files do not contain unresolved scaffold language.
 
+Run validation with `npm run check` and `npm run validate:manifest` when Node and npm are available. If npm is unavailable but Node is available, run the underlying scripts directly: `node scripts/check-context-bundle.js` and `node scripts/check-manifest-status.js`.
+
 ## Working files
 
 | Path | Purpose |
@@ -105,4 +107,4 @@ Usage and rights: see [USAGE.md](USAGE.md).
 
 This repo shows the intake side of a design-system workflow: how to make brand, design, code, asset, and prompt context structured enough for consistent extraction and review.
 
-It is not just storage. It is a working context layer with source files, validation, and an example output.
+It is not just storage. It is a working context layer with source files, validation, and an example output.

SECURITY.md

@@ -4,11 +4,11 @@
 
 This repository is a public brand-design-system and AI-context bundle. It is not a production software package, deployed application, API, authentication system, or runtime service.
 
-Security updates apply to the current `master` branch only.
+Security updates apply to the current `main` branch only.
 
 | Version / Branch | Supported |
 |---|---|
-| `master` | :white_check_mark: |
+| `main` | :white_check_mark: |
 | Archived branches, forks, or local copies | :x: |
 
 ## Scope

examples/example-output.md

@@ -143,7 +143,6 @@ Recommended use:
 | Asset | Status | Action |
 |---|---|---|
 | Primary logo reference | Manifested sample reference | Replace with approved production asset before use |
-| Reversed logo reference | Manifested sample reference | Replace with approved production asset before use |
 | Inter font reference | Reference only | Confirm font rights before bundling |
 | Icon set reference | Manifested sample reference | Replace with approved production icon set before use |
 | Hero image reference | Manifested sample reference | Replace with approved image before use |
@@ -158,6 +157,7 @@ Source file:
 |---|---|---|
 | Figma file is documented but not included | Medium | Add a real file link in a private implementation repo |
 | Logo files are manifested as sample references | Medium | Add approved assets before production work |
+| Additional logo variants are not in the manifest | Low | Add approved variants to the manifest before referencing them |
 | Button states are incomplete | Medium | Add focus, disabled, and loading guidance |
 | Form component is not represented in sample HTML | Low | Add a sample form block if form extraction is required |
 
@@ -172,4 +172,4 @@ Source file:
 
 ## Recommended next action
 
-Move the high-confidence token candidates and the Hero, Button, Card, and Review Panel component candidates into `brand-design-system-starter` as a draft extraction, then review manually before implementation.
+Move the high-confidence token candidates and the Hero, Button, Card, and Review Panel component candidates into `brand-design-system-starter` as a draft extraction, then review manually before implementation.

scripts/check-context-bundle.js

@@ -39,6 +39,13 @@ const allowedPathStatuses = new Set(['committed', 'documented-only']);
 const ignoreDirs = new Set(['.git', 'node_modules']);
 const textExtensions = new Set(['.md', '.json', '.js', '.css', '.html', '.csv', '.txt', '.svg']);
 const blockedWords = ['TO' + 'DO', 'T' + 'BD', 'placeholder' + ' only'];
+const privateUrlPatterns = [
+  /https?:\/\/(?:www\.)?figma\.com/i,
+  /https?:\/\/docs\.google\.com/i,
+  /https?:\/\/drive\.google\.com/i,
+  /https?:\/\/(?:www\.)?notion\.so/i
+];
+const disallowedAssetReference = 'Reversed logo ' + 'reference';
 let failed = false;
 
 function walk(dir) {
@@ -141,6 +148,14 @@ for (const file of allFiles) {
       fail(`Unresolved scaffold text found in: ${file}`);
     }
   }
+  for (const pattern of privateUrlPatterns) {
+    if (pattern.test(body)) {
+      fail(`Private design/document URL found in public bundle: ${file}`);
+    }
+  }
+  if (body.includes(disallowedAssetReference.toLowerCase())) {
+    fail(`Example output references an asset variant not listed in the manifest: ${file}`);
+  }
 }
 
 const manifestPath = 'fonts-logos-assets/manifest.csv';