Open Source Checker

The publish gate. This runs once, on a repository that has lived its whole life private, at the moment someone proposes making it public. Everything in a private repo was written on the assumption nobody outside would read it — comments, hostnames, client names, and every commit ever made. This audit finds what that assumption left behind.

Four passes, then a verdict. The recurring commit-time guard is a different skill — see Related.

Contract

Inputs:

• Repository root, with full history fetched (git fetch --all --tags)
• Intended public license, if already chosen
• Names to treat as private: company domains, client names, internal hostnames