Monument Repo Check — local, read-only repository assessment
=============================================================

One file of standard-library Python: monument_repo_check.py. Read it before you run it.
Requirements: Python 3.8 or newer, and git. Works on macOS, Linux and Windows. For a partial clone, git 2.44 or newer.

Keep the file OUTSIDE every repository (for example in your Downloads folder; it refuses to run from inside the
repository it checks) and run it with python3 -I, so Python loads nothing from the folders around it.
The commands below are run from the folder that holds the file (cd ~/Downloads).

1. Verify the file (compare with the checksum on the Repo Check page and in SHA256SUMS):
     macOS:              shasum -a 256 monument_repo_check.py
     Linux:              sha256sum monument_repo_check.py
     Windows PowerShell: Get-FileHash monument_repo_check.py -Algorithm SHA256
   The release is checksum-published, not yet code-signed.

2. Self-test (checks a synthetic repository in a temporary folder):
     python3 -I monument_repo_check.py --self-test     (Windows: py -3 -I monument_repo_check.py --self-test)

3. Check a repository (the output folder must be outside the repository):
     python3 -I monument_repo_check.py /path/to/repo --out ~/monument-repo-check-reports
   Several:       python3 -I monument_repo_check.py repoA repoB --out ~/monument-repo-check-reports
   A folder:      python3 -I monument_repo_check.py --discover ~/code --out ~/monument-repo-check-reports
   Very large:    add --quick (samples history, skips the history secret scan)
   Another ref:   add --ref main (read from git objects; nothing is checked out)

4. Read monument-share.json (or monument-share-bundle.json). It holds counts, yes/no values and words from fixed lists,
   plus the label you chose. Keep the private files; they contain file paths and locations of possible secrets.

What it never does: connect to the network, call an AI service, run code from your repository (tests, builds, hooks,
filters, diff drivers), modify your repository or write inside it, or print secret values. A built-in leak guard refuses
to write the share file if anything outside the fixed vocabulary would be in it.

Automated scanning is an aid, not proof: a clean result never shows that a repository is free of secrets or personal
data, and nothing in the report establishes ownership or licensing rights. Monument treats every report as unverified
until it is independently verified.

Repository reference: a keyed hash of the root commit(s) under a random key kept on your machine
(~/.monument-repo-check/local-key). Re-scans from the same machine link as versions of one repository; nobody without
the key — Monument included — can compute it from a copy of your code. Use --no-local-key to opt out.
Note that the exact counts in the share file (commits per year, lines per language) could be recomputed by someone
who already holds a copy of the repository, so they can link two reports of it even without the reference.