9 changed files with 45 additions and 465 deletions
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@ -1,6 +1,6 @@
 {
  "name": "repo-standard",
-  "version": "0.11.2",
+  "version": "0.11.0",
  "description": "Per-repo gate for the open/ presentation standard: README first screen, install block, files required by the repo's class, and dead repo references.",
  "author": {
    "name": "Kjell Tore Guttormsen"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -6,59 +6,6 @@ versioning is [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 ## [0.11.2] — 2026-08-14
 ### Changed
 - **Register: `ms-ai-architect` removed from `locales`.** Four sweeps in a row
  (04–07) held a correct `README-LANGUAGE` `WARN` against an entry that was
  itself wrong: the repo's published README disavows a Norway-only audience in
  its own words ("useful for any enterprise context", line 17, verified against
  the forge), and its 24 Norway markers are traits — what the code does — not
  audience. The register was the wrong side; the prose stands. Decided on
  org-ops' measured case (their D35).
 - **Register: `ktg-plugin-marketplace v7.7.2` accepted as lightweight
  history.** Previously deliberately absent because the newest tag has the one
  safe remedy. The catalog's measured counter: v7.7.2 is a monorepo-era
  llm-security tag (2026-05-19, pre-split), not a catalog release, and zero
  install paths consume it — force-moving a published ref for no consumer costs
  more than the finding. The catalog committed to annotating every future tag,
  which the check itself enforces.
 - **README: the two prose counts that had gone stale are now count-free.**
  "170 tests" (actual: 245) and "twelve checks" survived two releases
  unchanged — the ungated copy of a number is the defect, so the copies are
  removed rather than corrected. `npm test` prints the test count; the check
  table (20 rows) is the canonical check list.
 ### Fixed
 - **`FILE-MISSING` named the class even when a TRAIT required the file.**
  `security` → `SECURITY.md` read as "missing required file for class
  `standalone`", sending the operator looking for a requirement the class
  never listed. `requirementsFor` now carries the source (`class` vs. `trait`)
  alongside each required file, and the message names whichever actually
  required it. 245 tests, from 243.
 ## [0.11.1] — 2026-08-13
 ### Fixed
 - **`TAGS-SIGNED`, the affirmative verdict, was near-unreachable.** It was gated
  on `findings.length === 0`, so the presence of a `TAG-SIGNED-PREPOLICY` `OK`
  suppressed it — and every repo in the org has pre-policy tags. Caught by
  dogfooding the v0.11.0 release: this repo signed the first tag the check ever
  judged, and the gate did not say so.
  The status was green either way, which is what made it worth fixing rather
  than shrugging at: a reader could not tell *this repo signed its new tag* from
  *this repo has cut no tag since the policy*. Two different facts wearing one
  silence — the same defect as an exemption nobody can see, which this engine
  already refuses to ship one check over. The gate now keys the affirmative on
  the JUDGED findings only, and the two cases carry different sentences.
  Measured after: 18 repos emit both `TAGS-SIGNED` and `TAG-SIGNED-PREPOLICY`,
  3 `TAG-SIGNED-NONE`, still 0 ERROR and 0 WARN. 243 tests, from 241.
 ## [0.11.0] — 2026-08-13
 ### Added
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -225,21 +225,6 @@ would recreate, in data, exactly the drift this plugin exists to remove.
  stands. What the gate must never do is make "we decided this" and "nobody
  looked" the same output. The wanted side effect is exposure, not silence —
  `ai-psychosis` is deliberately unregistered so it stands alone.
 - **A fixed-language contract has a blind spot the `titles` pattern already
  knows how to close.** `## Non-goals` is one literal English string, matched
  case-insensitively but not translated, so it cannot be satisfied by a repo
  whose readers were declared `nb` in `locales` — the only way to go green was
  planting an English heading inside an otherwise-Norwegian document. Measured
  on `ki-produktivitetsmodell` (order, 2026-08-18, census 09 on that repo):
  `nb` locale, `## Virkeområde og forbehold` already doing the job Non-goals
  exists for (a stranger sees what the repo does not try to be), `HEADING-
  MISSING` `ERROR` regardless. `heading_aliases` in the register is the same
  shape `titles` already is for the H1 — the decision is taken in the repo, the
  bookkeeping happens here — and satisfying a requirement through it is its own
  `OK` (`HEADING-ALIAS`), never folded silently into the aggregate. Keyed PER
  REPO, not per locale: a locale-wide translation table would force every
  nb-repo into the same Norwegian phrasing for the same section, exactly the
  constraint `titles` already rejects for H1s one requirement over.
 - **An exemption is a finding, not a deletion.** `readme_desc_match: false`
  turns off README-DESC equality for a class, and the check still emits an `OK`
  naming why. An exception nobody can see reads exactly like a check that
@ -359,7 +344,7 @@ would recreate, in data, exactly the drift this plugin exists to remove.
 ## Commands
 ```bash
-npm test                                                  # 245 tests
+npm test                                                  # 241 tests
 node scripts/repo-standard-check.mjs --dir "$PWD"         # gate one repo
 node scripts/repo-standard-check.mjs --offline            # no network call
 node scripts/repo-standard-check.mjs --json               # machine output
--- a/README.md
+++ b/README.md
@ -10,7 +10,7 @@ checks that surface in one repository and reports what it finds.
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
-![Version](https://img.shields.io/badge/version-0.11.2-blue)
+![Version](https://img.shields.io/badge/version-0.11.0-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Skills](https://img.shields.io/badge/skills-1-orange)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@ -21,15 +21,6 @@ has no Actions runner — so the test claim is one you run yourself, in one
 command, from a clean clone: `npm test`. A badge asserting it would be a claim
 dressed as evidence.
 ## Table of Contents
 - [Install](#install)
 - [Requirements](#requirements)
 - [What it does](#what-it-does)
 - [Non-goals](#non-goals)
 - [Tests](#tests)
 - [Changelog](#changelog)
 ## Install
 Use the `https://` form. The forge UI's clone button hands out an `ssh://` URL,
@ -78,7 +69,7 @@ The repository's **class** decides what each check means:
 | Install block | the form for this class is missing, incomplete, shown over `ssh://`, or points at the wrong marketplace |
 | Install truth | the plugin is not pinned in the catalog, so the documented command cannot succeed for anyone |
 | Install pins | a `@v…` or `--branch v…` in an install command names a tag the forge does not have, so the command a stranger copies 404s |
-| Required headings | `## Install`, `## Non-goals`, `## Changelog` — per class. Present at the wrong depth is its own finding. A registered per-repo heading alias (`register/repos.json`'s `heading_aliases`) satisfies it too, for a repo whose readers were declared to speak another language |
+| Required headings | `## Install`, `## Non-goals`, `## Changelog` — per class. Present at the wrong depth is its own finding |
 | Required files | a file this class (or trait) needs is absent |
 | Repo references | an `open/<name>` in URL position resolves to nothing |
 | Relative links | a link points at a file that is not tracked |
@ -107,7 +98,7 @@ severity — it is the absence of a verdict, printed apart from the judged
 findings.
 A repository's own `status` is the worst of the findings that were *judged*, and
-`SKIP` only when nothing was. A skip cannot outrank the checks that did run.
+`SKIP` only when nothing was. A skip cannot outrank twelve checks that did run.
 Coverage rides beside it on its own axis, and since 0.8.0 that axis has two
 values, because a skip is one of two unrelated facts:
@ -189,26 +180,6 @@ An H1 that matches neither the repo name nor a registered title is still a
 warning, and the message names both — that is drift in one of the two, not a
 title.
 ### Registered heading aliases — the same asymmetry, one requirement over
 `## Non-goals` (and every other required heading) is one fixed English string,
 matched case-insensitively but never translated. A repository whose readers
 were declared `nb` in the register's `locales` cannot satisfy it honestly —
 the only way to go green was planting an English heading inside an otherwise
 Norwegian document, which is worse than the warning it silences.
 A `heading_aliases` entry in the register is the fix, shaped exactly like
 `titles`: the decision — this section, in this repo's own language, does the
 job the English heading names — is made in the repo, and the bookkeeping
 happens here. Set one, and a README carrying the aliased heading instead of
 the literal one is an `OK` (`HEADING-ALIAS`) that names the alias, never a
 silent pass. Leave it out, and `HEADING-MISSING` stands exactly as before.
 It is keyed **per repository**, not per locale. A locale-wide translation
 table would force every `nb` repository into the same Norwegian phrasing for
 the same section — precisely the constraint `titles` already rejects for H1s,
 where a human title is a valid choice, not a slot filled from a fixed list.
 ### When equality is the wrong demand
 `README-DESC` requires the README's opening line to be the forge description
@ -326,9 +297,7 @@ distinct from "an older engine that never tried".
 npm test
 ```
-The suite pins the pure classifiers; `npm test` prints the current count, which
+170 tests over the pure classifiers. The reference fixtures are measured false
 is the only copy of that number this README keeps — a prose count here went
 stale twice. The reference fixtures are measured false
 positives, each with its expected verdict — the six that produced the
 three-outcome reference rule, plus the noise sources found by running the gate
 against a real repository: regexes inside code spans that are markdown links to
--- a/SECURITY.md
+++ b/SECURITY.md
@ -1,34 +0,0 @@
 # Security policy
 ## Reporting a vulnerability
 Report privately to <security@fromaitochitta.com> — do not open a
 public issue.
 Canonical repository: https://git.fromaitochitta.com/open/repo-standard
 Please include the affected version or commit, a minimal reproduction,
 and the impact you see. We acknowledge every report within 5 working
 days, agree a fix and disclosure timeline with the reporter, and aim to
 disclose within 90 days of the initial report.
 ## Response process
 1. Acknowledge within 5 working days.
 2. Triage and confirm severity within 10 working days.
 3. Develop and test a fix.
 4. Publish an advisory and credit the reporter unless they prefer
   to remain anonymous.
 ## Supported versions
 | Version | Supported |
 | ------- | --------- |
 | 0.11.x  | :white_check_mark: |
 | < 0.11  | :x:       |
 This project has not reached 1.0 yet; only the latest 0.x release line
 receives security fixes. See `CHANGELOG.md` for release history.
 ## Advisories
 No advisories have been published yet.
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "repo-standard",
-  "version": "0.11.2",
+  "version": "0.11.0",
  "private": true,
  "type": "module",
  "engines": {
--- a/register/repos.json
+++ b/register/repos.json
@ -32,7 +32,6 @@
    "playground-design-system": "shared-asset",
    "portfolio-optimiser-commons": "shared-asset",
    "llm-security-commons": "shared-asset",
    "ki-produktivitetsmodell": "shared-asset",
    ".profile": "org-profile",
    "portfolio-optimiser": "standalone",
    "portfolio-optimiser-claude": "standalone",
@ -135,27 +134,14 @@
    "",
    "`ai-psychosis` (`# Interaction Awareness`) is DELIBERATELY ABSENT: it is the",
    "one where a reader cannot connect the title to the repo. Leaving it standing",
-    "alone is the wanted effect of registering the others.",
+    "alone is the wanted effect of registering the others."
    "",
    "`.profile` UPDATED 2026-08-18 (org-ops coord, census 09): the org landing",
    "page was rebuilt the same day (commit 9898a6e, 'rebuild org landing page,",
    "add LICENSE and SECURITY.md', per that repo's own STATE.md — order from",
    "`.claude`, AAA+ round 5). The H1 became `# From AI to Chitta — open`; the",
    "old value here was the H1 it replaced, not drift. Verified against the",
    "clone, not the coord message — the em-dash is U+2014, not a hyphen.",
    "",
    "`ki-produktivitetsmodell` ADDED 2026-08-18 (order from that repo, on its own",
    "operator decision recorded in its STATE.md the same day): `# Tre nivå av",
    "organisatorisk produktivitet med KI` is the document's real title, the repo",
    "name is a slug. Verified against the clone before writing it down."
  ],
  "titles": {
-    ".profile": "From AI to Chitta — open",
+    ".profile": "fromaitochitta / open",
    "llm-ingestion-pipeline-security": "llm-ingestion-guard",
    "linkedin-studio": "LinkedIn Studio Plugin for Claude Code",
    "llm-security": "LLM Security Plugin for Claude Code",
-    "ms-ai-architect": "AI Architect Plugin for Claude Code",
+    "ms-ai-architect": "AI Architect Plugin for Claude Code"
    "ki-produktivitetsmodell": "Tre nivå av organisatorisk produktivitet med KI"
  },
  "$comment_traits": [
@ -189,56 +175,15 @@
    "Norwegian readership is `nb`, and is then WRONG in English, not right.",
    "",
    "PROPOSED BY THE OPERATOR, NOT MEASURED — like `traits`, this list is a",
-    "judgement and no remote can report it. Both original entries were named by",
+    "judgement and no remote can report it. Both entries below were named by",
    "the operator on 2026-08-04 as Norway-only in their audience.",
    "",
    "`ms-ai-architect` was REMOVED 2026-08-14 (org-ops coord, their D35): its",
    "published README disavows the exclusivity this axis requires — line 17,",
    "'while remaining useful for any enterprise context' — verified against the",
    "forge before removal. Its 24 Norway markers are TRAITS (what the code",
    "does: Digdir, NSM, DPIA), which is the axis confusion this comment warns",
    "about two paragraphs up. The register was the wrong side, not the prose.",
    "`okr` stands: its README IS Norwegian, rewritten to close census 05.",
    "",
    "`ki-produktivitetsmodell` ADDED 2026-08-18 (operator decision, on the",
    "session's recommendation after registering the repo as `shared-asset`):",
    "its README is written entirely in Norwegian, explicitly for 'toppledere i",
    "norsk offentlig sektor' — the same Norway-only-audience test that set",
    "`okr`, not a code trait.",
    "",
    "Detection is a stopword-frequency comparison over prose with code stripped.",
    "It answers WHICH language dominates, never whether the prose is any good."
  ],
  "locales": {
-    "okr": "nb",
+    "ms-ai-architect": "nb",
-    "ki-produktivitetsmodell": "nb"
+    "okr": "nb"
  },
  "$comment_heading_aliases": [
    "The Non-goals contract is one fixed English string, matched literally — it",
    "cannot be satisfied by a repo whose readers were declared `nb` in `locales`",
    "above, and the only way to go green was to plant an English heading inside",
    "an otherwise-Norwegian document. Same job `titles` does for a README H1, one",
    "requirement over: the decision is taken in the repo, the bookkeeping happens",
    "here — a registered alias satisfies the requirement and is its own OK",
    "(`HEADING-ALIAS`), never a silent pass.",
    "",
    "Keyed PER REPO, not per locale: a locale-wide translation table would force",
    "every nb-repo into the same Norwegian phrasing for the same section, which",
    "is exactly the constraint `titles` already rejects for H1s (a human title is",
    "a valid choice, not a slot to fill from a fixed list).",
    "",
    "ADDED 2026-08-18 (order from ki-produktivitetsmodell, census 09 on that",
    "repo): its README is `nb` (see `locales` above) and carries",
    "`## Virkeområde og forbehold`, which does the job the Non-goals contract",
    "exists for — a stranger sees what the repo does not try to be. The operator",
    "decided the README stays as written; this entry is the mechanism, not an",
    "exception for one repo. Verified against the clone before writing it down."
  ],
  "heading_aliases": {
    "ki-produktivitetsmodell": {
      "## Non-goals": "## Virkeområde og forbehold"
    }
  },
  "$comment_tags_lightweight_accepted": [
@ -256,36 +201,15 @@
    "the very gap REMOTE-SYNC exists to name, so these are claims about three",
    "OTHER repos and were sent to them by coord so a wrong name can be disputed.",
    "",
-    "`ktg-plugin-marketplace v7.7.2` was DELIBERATELY ABSENT until 2026-08-14:",
+    "13 entries, not the 14 lightweight tags that exist. `ktg-plugin-marketplace",
-    "as the newest tag it had the one safe remedy (`git tag -a -f`), and",
+    "v7.7.2` is DELIBERATELY ABSENT: it is that repo's newest tag, the one",
-    "pre-accepting it would have let cutting v7.8.0 skip the cheap fix",
+    "lightweight tag with a safe remedy (`git tag -a -f`), and it is an ERROR",
-    "unrecorded. ACCEPTED 2026-08-14 on the catalog's measured counter (their",
+    "today. Pre-accepting it would mean that cutting v7.8.0 instead of fixing it",
-    "coord, catalog HEAD d0d5d70): v7.7.2 is a monorepo-era llm-security tag",
+    "makes the finding vanish silently — the cheap fix skipped and unrecorded.",
-    "(2026-05-19, pre-split), not a catalog release; their README install block",
+    "If it ages into history un-remedied, a fresh WARN is the correct signal."
    "pins no ref and all 12 marketplace.json refs are plugin-repo tags, so zero",
    "install paths consume it — 'newest tag' here sorts last without being the",
    "newest RELEASE, which is the premise the safe-remedy rule rests on.",
    "Force-pushing a published ref for zero consumers costs more than the",
    "finding. The catalog committed to annotating every future tag; the check",
    "itself enforces that, since a new lightweight newest tag is not on this",
    "list and fires ERROR.",
    "",
    "This entry was DEAD WEIGHT from 2026-08-14 to 2026-08-18: `accepted` was",
    "only ever consulted for tags OLDER than newest, so v7.7.2 kept firing",
    "TAG-ANNOTATED ERROR the whole time — the exact 'we decided this' vs.",
    "'nobody looked' collapse this axis exists to prevent, one level down.",
    "Caught and reported by the catalog itself (coord, 2026-08-17), fixed in",
    "`checkTagIntegrity` (repo-standard, 2026-08-18): the accepted set is now",
    "checked against the newest tag too, emitting a distinct",
    "`TAG-ANNOTATED-ACCEPTED-NEWEST` OK rather than silently doing nothing.",
    "",
    "The two slash-named `config-audit/v*` tags on that forge are OUT OF SCOPE",
    "by construction, not omitted by a fetch gap: the engine reads",
    "`refs/tags/v*` — the repo's own version line — and a namespaced",
    "monorepo-era tag is not part of it."
  ],
  "tags_lightweight_accepted": {
-    "ktg-plugin-marketplace": ["v3.4.1", "v5.0.0", "v5.0.1", "v5.0.2", "v5.0.3", "v7.7.0", "v7.7.1", "v7.7.2"],
+    "ktg-plugin-marketplace": ["v3.4.1", "v5.0.0", "v5.0.1", "v5.0.2", "v5.0.3", "v7.7.0", "v7.7.1"],
    "llm-ingestion-okf": ["v0.2.0", "v0.3.0", "v0.3.1", "v0.3.2", "v0.4.0"],
    "llm-ingestion-pipeline-security": ["v0.3.0"]
  },
--- a/scripts/repo-standard-check.mjs
+++ b/scripts/repo-standard-check.mjs
@ -538,19 +538,12 @@ export function checkInstallPins({ readme, forgeTagsByRepo }, register) {
 // outsider who finds a hole, and being solo does not remove them.
 function requirementsFor(klass, traits, register) {
  const cls = register.classes?.[klass] ?? {};
-  const classSource = `class \`${klass}\``;
+  const files = [...(cls.required_files ?? [])];
  const files = (cls.required_files ?? []).map((file) => ({ file, source: classSource }));
  const headings = [...(cls.required_headings ?? [])];
  const seenFiles = new Set(files.map((f) => f.file));
  for (const t of traits ?? []) {
    const tr = register.trait_requirements?.[t];
    if (!tr) continue;
-    const traitSource = `trait \`${t}\``;
+    for (const f of tr.required_files ?? []) if (!files.includes(f)) files.push(f);
    for (const f of tr.required_files ?? []) {
      if (seenFiles.has(f)) continue;
      seenFiles.add(f);
      files.push({ file: f, source: traitSource });
    }
    for (const h of tr.required_headings ?? []) if (!headings.includes(h)) headings.push(h);
  }
  return { files, headings };
@ -560,9 +553,9 @@ export function checkRequiredFiles({ present, klass, traits }, register) {
  const { files: required } = requirementsFor(klass, traits, register);
  const have = new Set(present ?? []);
  const findings = [];
-  for (const { file, source } of required) {
+  for (const f of required) {
-    if (!have.has(file)) {
+    if (!have.has(f)) {
-      findings.push({ level: 'ERROR', code: 'FILE-MISSING', bucket: 'missing', msg: `missing required file for ${source}: ${file}` });
+      findings.push({ level: 'ERROR', code: 'FILE-MISSING', bucket: 'missing', msg: `missing required file for class \`${klass}\`: ${f}` });
    }
  }
  if (findings.length === 0 && required.length > 0) {
@ -575,32 +568,16 @@ export function checkRequiredFiles({ present, klass, traits }, register) {
 // on a predictable heading is what agents pattern-match on, and `## Non-goals`
 // is the cheapest trust-builder there is: it proves someone thought about the
 // boundary, and it stops misuse before it starts.
-export function checkHeadings({ readme, klass, traits, name }, register) {
+export function checkHeadings({ readme, klass, traits }, register) {
  const { headings: required } = requirementsFor(klass, traits, register);
  const text = String(readme ?? '');
  const present = new Set(
    text.split('\n').map((l) => l.trim()).filter((l) => l.startsWith('#')),
  );
  const aliases = register.heading_aliases?.[name] ?? {};
  const findings = [];
  for (const h of required) {
    if ([...present].some((p) => p.toLowerCase() === h.toLowerCase())) continue;
    // Same job `titles` does for a README H1, one requirement over: the
    // decision (this repo's readers were declared `nb`, so the contract's
    // English wording is the wrong test) is taken in the repo, the bookkeeping
    // happens here. Keyed per repo, not per locale — two nb-repos need not
    // phrase the same section the same way.
    const alias = aliases[h];
    if (alias && [...present].some((p) => p.toLowerCase() === alias.toLowerCase())) {
      findings.push({
        level: 'OK',
        code: 'HEADING-ALIAS',
        msg: `\`${alias}\` satisfies \`${h}\` — the registered heading alias for \`${name}\``,
      });
      continue;
    }
    // Same title, wrong depth: say that, rather than "missing". The contract
    // wants a predictable top-level heading because that is what an agent
    // pattern-matches on — but the section does exist, and the fix is a
@ -724,19 +701,7 @@ export function checkTagIntegrity({ tagObjects, name }, register) {
  const findings = [];
  const newest = tags[tags.length - 1];
  const accepted = new Set(register?.tags_lightweight_accepted?.[name] ?? []);
  if (!newest.annotated) {
    if (accepted.has(newest.name)) {
      // Named acceptance, not a standing exemption: only THIS exact tag is
      // excused, so a later real release still fires ERROR the moment it
      // becomes newest and isn't itself on the list (proven by the sibling
      // test below).
      findings.push({
        level: 'OK',
        code: 'TAG-ANNOTATED-ACCEPTED-NEWEST',
        msg: `newest tag \`${newest.name}\` is lightweight, but the register accepts it by name as an exception to the newest-tag rule — a safe remedy exists (\`git tag -a -f\`) but costs more than the finding for this specific tag. Any OTHER tag that becomes newest is still judged.`,
      });
    } else {
    findings.push({
      level: 'ERROR',
      code: 'TAG-ANNOTATED',
@ -744,7 +709,7 @@ export function checkTagIntegrity({ tagObjects, name }, register) {
      msg: `newest tag \`${newest.name}\` is lightweight — it can be moved to another commit with no record that it ever pointed elsewhere, and the catalog pins releases by tag. Re-cut it annotated: \`git tag -a -f ${newest.name} ${newest.name}^{}\`.`,
    });
  }
-  }
+  const accepted = new Set(register?.tags_lightweight_accepted?.[name] ?? []);
  const olderLightweight = tags.slice(0, -1).filter((t) => !t.annotated);
  const older = olderLightweight.filter((t) => !accepted.has(t.name));
  const excused = olderLightweight.filter((t) => accepted.has(t.name));
@ -870,20 +835,15 @@ export function checkTagSigned({ tagObjects }, register) {
      level: 'SKIP',
      skip: 'byDesign',
      code: 'TAG-SIGNED-LIGHTWEIGHT',
-      msg: `${lightweight.length} tag(s) cut under the policy are lightweight (${lightweight.map((t) => t.name).join(', ')}) — a lightweight tag has no tag object to carry a signature, so signing is not a remedy it has. TAG-ANNOTATED owns the verdict on these — an ERROR, or an OK if the register names one as an accepted exception; this check declines rather than report one defect twice.`,
+      msg: `${lightweight.length} tag(s) cut under the policy are lightweight (${lightweight.map((t) => t.name).join(', ')}) — a lightweight tag has no tag object to carry a signature, so signing is not a remedy it has. TAG-ANNOTATED owns that finding; this check declines rather than report one defect twice.`,
    });
  }
-  // The affirmative verdict is gated on the JUDGED findings only, never on
+  if (findings.length === 0 && inScope.length > 0) {
-  // `findings.length`. Gating on the whole list suppressed it the moment a
+    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` });
-  // pre-policy OK was present — which is every repo in the org, so this OK was
+  }
-  // near-unreachable in practice, and a reader could not tell "signed its new
+  if (findings.length === 0) {
-  // tag" from "has cut no tag since the policy". Two different facts, both green.
+    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
  const judged = findings.some((f) => f.level === 'ERROR' || f.level === 'WARN');
  if (!judged) {
    findings.push(inScope.length > 0
      ? { level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` }
      : { level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
  }
  return findings;
 }
@ -1384,20 +1344,6 @@ function isFixturePath(path) {
 // A home directory is what makes a `file:` URL a leak rather than a scheme the
 // gate declines to resolve. Anchored on the two roots a real machine path
 // starts with; a bare `file:///abs/path.html` placeholder is not one.
 //
 // WIDENING TO OTHER ROOTS WAS CONSIDERED AND REJECTED FOR NOW — an order
 // (`.claude`, 2026-08-18) asked whether `C:\`, `/private/`, `/var/`, `/tmp/`
 // and similar roots deserved the same anchor, having measured only the
 // `/Users/ktg` case. Measured here across every `.md` file in the 21 of 22
 // registered repos with a local clone (`llm-security-commons` absent):
 // exactly two REAL leaks exist in the entire corpus, both `/Users/...` in
 // `ki-produktivitetsmodell` (already caught — the positive control that
 // proves this grep can find one). Every other `file://` hit is a generic
 // placeholder (`/abs/path`, `<abs...>`, `${...}`) that anchoring on Users|home
 // already declines to flag. Zero occurrences of any other real root, in this
 // corpus, on this date — a RELEASE-ASSETS-shaped rejection: not a low rate to
 // veto later, an absent subject. Widen this the day a real one appears, not
 // before; re-measure rather than trust this count if this comment goes stale.
 const FILE_URL_LEAK = /^file:\/\/\/?(Users|home)\//i;
 // Relative file links only. Anchor resolution depends on per-renderer heading
@ -1572,7 +1518,7 @@ export function classifyRepo(
    ...checkInstallBlock({ readme, name, klass }, register),
    ...checkInstallTruth({ name, klass, catalogNames }),
    ...checkInstallPins({ readme, forgeTagsByRepo }, register),
-    ...checkHeadings({ readme, klass, traits, name }, register),
+    ...checkHeadings({ readme, klass, traits }, register),
    ...checkRequiredFiles({ present, klass, traits }, register),
    ...checkLinks({ files }, register),
    ...checkInternalLinks({ files, present }),
--- a/scripts/repo-standard-check.test.mjs
+++ b/scripts/repo-standard-check.test.mjs
@ -7,10 +7,7 @@
 // They are the reason this gate has three outcomes instead of a boolean.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync, mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
  countCodepoints,
  normalizeRepoRef,
@ -50,7 +47,6 @@ import {
  checkVerifyCommand,
  countTestFiles,
  codeLines,
  inspectRepo,
 } from './repo-standard-check.mjs';
 const REGISTER = {
@ -770,27 +766,6 @@ test('org-profile requires no headings at all', () => {
  assert.equal(f.filter((x) => x.level === 'ERROR').length, 0);
 });
 // The Non-goals contract is written in English and matched literally, which
 // cannot be satisfied by a repo whose readers were declared `nb` — the fix is
 // per-repo, not per-locale, because two nb-repos need not phrase the same
 // section the same way. Same shape as `titles`: the decision is taken in the
 // repo, the bookkeeping happens in the register.
 test('a registered heading alias satisfies a required heading for a different-language reader', () => {
  const aliasRegister = {
    ...REGISTER,
    heading_aliases: { 'ki-produktivitetsmodell': { '## Non-goals': '## Virkeområde og forbehold' } },
  };
  const readme = '# x\n## Virkeområde og forbehold\n';
  const f = checkHeadings({ readme, klass: 'shared-asset', name: 'ki-produktivitetsmodell' }, aliasRegister);
  assert.equal(f.some((x) => x.level === 'ERROR'), false);
  assert.equal(f.some((x) => x.code === 'HEADING-ALIAS'), true);
  // The alias is keyed per-repo: a different repo with the same Norwegian
  // heading still misses the literal `## Non-goals`.
  const other = checkHeadings({ readme, klass: 'shared-asset', name: 'some-other-repo' }, aliasRegister);
  assert.equal(other.some((x) => x.code === 'HEADING-MISSING'), true);
 });
 // ------------------------------------------------------------- file: URL links
 // A `file:///Users/ktg/...` link is dead for every reader but its author, and
@ -836,57 +811,6 @@ test('other schemes stay somebody else\'s to resolve', () => {
  assert.equal(checkInternalLinks({ files, present: ['README.md'] }).some((x) => x.code === 'LINK-FILE-URL'), false);
 });
 // ------------------------------------------------- I/O shell: file loading
 //
 // Every test above feeds `files` to checkInternalLinks directly — deliberate,
 // per the file header: the I/O shell is exercised live, not unit-tested. One
 // exception, here: an order (`.claude`, 2026-08-18) diagnosed the file://
 // rule as dead because it believed inspectRepo only ever loads README.md —
 // wrong (git blame: every tracked .md file, since 2026-07-27, 816ba97) — but
 // its point about the TEST SUITE stood: feeding `files` by hand is exactly
 // the shortcut that would let every test above stay green while a real
 // narrowing of inspectRepo's `.filter((p) => p.endsWith('.md'))` silently
 // killed the rule in production. These two go through the real loading path.
 function tempGitRepo(files) {
  const dir = mkdtempSync(join(tmpdir(), 'repo-standard-io-'));
  execFileSync('git', ['init', '-q'], { cwd: dir });
  for (const [name, content] of Object.entries(files)) {
    const path = join(dir, name);
    mkdirSync(join(path, '..'), { recursive: true });
    writeFileSync(path, content);
  }
  execFileSync('git', ['add', '-A'], { cwd: dir });
  return dir;
 }
 test('inspectRepo scans a file: leak in a non-README markdown file through the ordinary loading path', () => {
  const dir = tempGitRepo({
    'README.md': '# test\n',
    'docs/plan.md': '[notes](file:///Users/ktg/repos/x/notes.md)\n',
  });
  try {
    const result = inspectRepo(dir, 'llm-ingestion-pipeline-security', REGISTER, null, null, true);
    const hit = result.findings.find((f) => f.code === 'LINK-FILE-URL');
    assert.ok(hit, 'LINK-FILE-URL did not fire for a leak outside README.md');
    assert.match(hit.msg, /docs\/plan\.md:1/);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
 });
 test('inspectRepo raises nothing when no file: leak exists anywhere', () => {
  const dir = tempGitRepo({
    'README.md': '# test\n',
    'docs/plan.md': 'no links here\n',
  });
  try {
    const result = inspectRepo(dir, 'llm-ingestion-pipeline-security', REGISTER, null, null, true);
    assert.equal(result.findings.some((f) => f.code === 'LINK-FILE-URL'), false);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
 });
 // -------------------------------------------------------------- tag integrity
 // A lightweight tag is a branch-like ref: it can be moved to a different commit
@ -979,54 +903,15 @@ test('an unaccepted lightweight tag still fires, and the WARN counts only the un
 });
 // The newest tag is what a consumer resolves today and what an operator can
-// re-cut at no cost, so acceptance is never inherited from a repo merely
+// re-cut at no cost. It is the one lightweight tag with a safe remedy, so it
-// having OTHER accepted entries — only an exact name match on THIS tag excuses
+// is the one that cannot be accepted away.
-// it (the exception directly below).
+test('the NEWEST lightweight tag is still an ERROR even when the register accepts its name', () => {
-test('an unaccepted newest lightweight tag is still an ERROR, even when the register has other entries for this repo', () => {
+  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
-  const reg = { tags_lightweight_accepted: { alpha: ['v9.9.9'] } };
+  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }] }, reg);
  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }], name: 'alpha' }, reg);
  const hit = f.find((x) => x.code === 'TAG-ANNOTATED');
  assert.equal(hit.level, 'ERROR');
 });
 // A tag that sorts "newest" by version string without being the newest
 // RELEASE — a monorepo-era tag predating a split, consumed by nothing — has a
 // real safe remedy (`git tag -a -f`, same commit) that still costs more than
 // the finding when nothing resolves it. The register names the tag by EXACT
 // NAME, never "this repo's newest is always excused" — caught the moment
 // `ktg-plugin-marketplace v7.7.2` was found dead weight: the register had
 // accepted it since 2026-08-14 (repos.json `tags_lightweight_accepted`) but
 // `accepted` was only ever consulted for tags OLDER than newest, so the
 // recorded decision could never take effect. Reported by the catalog
 // (coord, 2026-08-17): measured against the real register and real tag data,
 // exactly two findings — ERROR TAG-ANNOTATED on the (then-)inert acceptance,
 // OK TAG-ANNOTATED-ACCEPTED for the 7 older accepted tags.
 test('the newest lightweight tag IS excused when the register names it exactly, with a distinct OK code', () => {
  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }], name: 'alpha' }, reg);
  assert.equal(f.some((x) => x.code === 'TAG-ANNOTATED'), false);
  const ok = f.find((x) => x.code === 'TAG-ANNOTATED-ACCEPTED-NEWEST');
  assert.equal(ok.level, 'OK');
  assert.match(ok.msg, /v2\.0\.0/);
 });
 // Acceptance names ONE tag, not a standing exemption for "whatever is newest".
 // A real new tag cut after the accepted one is still judged the moment it
 // becomes newest and isn't itself on the list — exactly what the register's
 // own comment promises: "a new lightweight newest tag is not on this list and
 // fires ERROR".
 test('a NEW lightweight tag cut after an accepted newest is still judged', () => {
  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
  const f = checkTagIntegrity({ tagObjects: [
    { name: 'v1.0.0', annotated: true },
    { name: 'v2.0.0', annotated: false },
    { name: 'v3.0.0', annotated: false },
  ], name: 'alpha' }, reg);
  const hit = f.find((x) => x.code === 'TAG-ANNOTATED');
  assert.equal(hit.level, 'ERROR');
  assert.match(hit.msg, /v3\.0\.0/);
 });
 test('acceptance is per repo — a name accepted for one repo does not excuse another', () => {
  const tagObjects = [{ name: 'v0.1.0', annotated: false }, { name: 'v1.0.0', annotated: true }];
  const f = checkTagIntegrity({ tagObjects, name: 'beta' }, ACCEPT_REG);
@ -1119,35 +1004,6 @@ test('tags predating the policy are never judged — and say so as an OK, not si
  assert.match(ok.msg, /2026-08-13/);
 });
 // Caught by dogfooding the v0.11.0 release: the affirmative verdict was
 // suppressed whenever ANY pre-policy tag existed — which is every repo in the
 // org, so `TAGS-SIGNED` would have been near-unreachable in practice. The
 // reader could then not tell "this repo signed its new tag" from "this repo has
 // cut no tag since the policy". Both are OK-status, and they are not the same
 // fact. The exemption OK must not silence the judged one.
 test('the affirmative OK survives alongside the pre-policy OK — they are two different facts', () => {
  const f = checkTagSigned({ tagObjects: [
    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
    { name: 'v1.0.0', annotated: true, signed: true, date: '2026-08-14' },
  ] }, SIGN_REG);
  assert.equal(f.some((x) => x.level === 'ERROR' || x.level === 'WARN'), false);
  assert.equal(f.some((x) => x.code === 'TAG-SIGNED-PREPOLICY'), true);
  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
  assert.equal(ok.level, 'OK');
  assert.match(ok.msg, /\b1 tag/);
 });
 // The other half of the same distinction: nothing cut since the policy is a
 // DIFFERENT sentence from "what was cut is signed", and it must not borrow the
 // affirmative one's wording.
 test('a repo with only pre-policy tags says nothing has been cut yet, not that anything passed', () => {
  const f = checkTagSigned({ tagObjects: [
    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
  ] }, SIGN_REG);
  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
  assert.match(ok.msg, /no tag has been cut/);
 });
 test('a tag cut exactly ON the policy date is in scope — the policy starts that day', () => {
  const f = checkTagSigned({ tagObjects: [
    { name: 'v1.0.0', annotated: true, signed: false, date: '2026-08-13' },
@ -1595,19 +1451,6 @@ test('a repo without the security trait owes no SECURITY.md', () => {
  assert.equal(f.some((x) => x.msg.includes('SECURITY.md')), false);
 });
 test('a trait-required file is missing, FILE-MISSING names the trait, not the class', () => {
  const f = checkRequiredFiles({ present: ['README.md', 'LICENSE'], klass: 'standalone', traits: ['security'] }, REGISTER);
  const finding = f.find((x) => x.code === 'FILE-MISSING' && x.msg.includes('SECURITY.md'));
  assert.equal(finding.msg.includes('trait `security`'), true);
  assert.equal(finding.msg.includes('class `standalone`'), false);
 });
 test('a class-required file is missing, FILE-MISSING still names the class', () => {
  const f = checkRequiredFiles({ present: [], klass: 'standalone' }, REGISTER);
  const finding = f.find((x) => x.code === 'FILE-MISSING' && x.msg.includes('LICENSE'));
  assert.equal(finding.msg.includes('class `standalone`'), true);
 });
 test('the security trait requires limitations to be stated', () => {
  const f = checkHeadings({ readme: '# x\n## Install\n## Non-goals\n', klass: 'standalone', traits: ['security'] }, REGISTER);
  assert.equal(f.some((x) => x.code === 'HEADING-MISSING' && x.msg.includes('Known limitations')), true);