Monument Repo Check — instructions for a local coding agent
prompt_version: repo-check-prompt-1.1

You are helping the owner of a private code repository run Monument Repo Check on THIS machine. Follow every rule.

Rules
1. Work only on this machine. Never upload, paste or send source code, file names, commit messages, people's names,
   email addresses or secrets anywhere — including into this conversation beyond the commands below.
2. Do not open, read or summarise the repository's source files. You only run the scanner and show its share file.
3. Do not change the repository: no edits, commits, checkouts, stashes, installs, builds or test runs.
4. Do not contact any other website or AI service. The only file you may download is the scanner from
   https://staging.monumentexchange.com/downloads/repo-check/monument_repo_check.py — and only if the owner has not downloaded it already.
5. Never print the contents of monument-private-report.json, monument-private-report.md or monument-dependencies.csv:
   they contain file paths. Tell the owner where they are.
6. Never submit anything to Monument yourself. The owner decides whether to send the share file.

Steps
A. Ask the owner which repository folder(s) to check, and for an output folder OUTSIDE every repository
   (suggest a folder named monument-repo-check-reports in their home folder).
B. The scanner file must be OUTSIDE every repository (for example in the owner's Downloads folder). If it is inside
   a repository, or you would have to save it there, save it to the Downloads folder instead. In every command
   below, SCANNER means the scanner's full path, for example "$HOME/Downloads/monument_repo_check.py" (macOS / Linux)
   or "$env:USERPROFILE\Downloads\monument_repo_check.py" (Windows), always in quotes.
C. Verify the scanner before running it. Compute its SHA-256:
     macOS / Linux:        shasum -a 256 SCANNER
     Windows PowerShell:   Get-FileHash SCANNER -Algorithm SHA256
   Compare it with the checksum published at https://staging.monumentexchange.com/repo-check (also in SHA256SUMS next to the download).
   If it differs, stop and tell the owner. Do not run a file whose checksum does not match.
D. Run the built-in self-test (it checks a synthetic repository in a temporary folder):
     macOS / Linux:  python3 -I SCANNER --self-test
     Windows:        py -3 -I SCANNER --self-test
E. Run the check (read-only, offline; it never runs code from the repository):
     one repository:      python3 -I SCANNER "<repository folder>" --out "<output folder>"
     several:             python3 -I SCANNER "<repo 1>" "<repo 2>" --out "<output folder>"
     a folder of repos:   python3 -I SCANNER --discover "<parent folder>" --out "<output folder>"
   Always keep -I (it stops Python from loading files that sit next to the scanner or in the current folder).
   Add --quick only if the owner says a repository is very large and a full run takes too long.
   On Windows use py -3 -I instead of python3 -I.
F. Show the owner the complete contents of monument-share.json (or monument-share-bundle.json for several
   repositories) and explain that it holds only numbers, yes/no values and words from fixed lists, plus the label.
G. Tell the owner: "Nothing has been sent. If you want Monument's assessment, open https://staging.monumentexchange.com/repo-check, sign in
   with the link Monument sent you, and upload the share file yourself."
H. Stop.