Use visibility-first framing before you ask for an install
Lead with hidden agent or provider spend escaping review. Let Governance Audit turn that visibility into one repo-specific recommendation.
NORNR
Paste repo. See the path. Get the first patch.
NORNR / Governance audit
Repo audit wedgePaste one repo and get the first calm review boundary plus the exact patch path.
The point is not to produce another scanner score. The point is to show where consequential agent intent already escapes review, where mandate and counterparty posture are too weak to defend, then hand back one buyer-safe first move, one exact file to touch and one install path that can ship now.
Preferred public path
This should be the first NORNR page a technical buyer touches after visibility-first discovery.
Shadow discovery first, audit second, install third, widen into the right lane fourth, then carry the same lane into evidence once the buyer is warm.
Show the exposed path in their repo
Start cold with one public GitHub URL and one report that names the missing NORNR layer precisely.
Use Budget Shield as the first install-first proof
Once the repo risk is legible, put NORNR in the pull request so the team sees the control story before merge.
Choose wrappers, browser governance or MCP based on where the risk lives
Provider spend should usually go to wrappers first. Browser-visible vendor actions should usually go to browser governance first. Local tool authority should usually go to MCP and Cursor rules first.
Carry the same lane into monthly memo and artifact proof
When the buyer is warm, the same governed lane should survive into audit memo, bundle and verifier-readable manifest.
Output shape
The audit should produce one exact first move, not another generic report.
If it cannot name the lane, the missing review boundary, the first file to touch and the next install path, it is still too generic to sell NORNR.
Show the consequential code paths first
List the code locations where provider spend, tool authority, vendor actions, billing changes, transfers or irreversible shell effects already exist.
Name the missing layer coldly
Each finding should state what NORNR would enforce there: intent, mandate, policy decision, counterparty scope, packet survival or finance-safe audit export.
Recommend one patch path that can actually be built this week
The point of the audit is to make the first NORNR lane obvious enough that a buyer or engineer can move immediately, not book a meeting to decode it.
GitHub URL in
Paste one public GitHub repo and get the first patch machine out.
This is the wedge version: one repo URL in, one named NORNR path out, one first patch forward.
Paste a public GitHub repo to produce the first path, first patch and first install recommendation.
No audit running.
No first patch yet
Run the audit to get one exact file, one exact first edit, one PR-ready body and one narrow install path.
The first consequential path will appear here after the audit.
Run the audit to get the exact first file and edit.
The audit will name the first calm edit once the path is clear.
The audit will suggest who should own and review the first patch.
The audit will generate a PR body once the path is clear.
The audit will recommend one calm boundary once the path is ranked.
The audit will name the next patch after the first calm boundary is live.
No report yet
The returned audit will name the repo, the first consequential path and the missing NORNR review boundary.
The first useful audit should end with one buyer-safe sentence and one exact NORNR lane.
The first useful audit should collapse raw findings into 2-3 named NORNR lanes.
The first report should show exposed paths, not a generic score.
Run an audit to get one exact install recommendation.
The page will generate a copyable outreach snippet after the first report.
Run an audit and save an immutable packet to compare future passes against.
The packet will tailor the same audit for founders, engineering leads, security/ops and builders.
Move straight from repo risk into one pull-request guardrail.
Run an audit first. The page will then generate a ready workflow, a local config and one patch path you can ship now.
yaml
name: NORNR Budget Shield
on:
pull_request:
types: [opened, synchronize, reopened]
permissions:
contents: read
issues: write
pull-requests: write
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: NORNR/nornr-budget-shield@v1
with:
severity: review-first
json
{
"severity": "review-first",
"exclude": ["tests/", "docs/"],
"rules": []
}Turn the repo result into one lane review.
The exact next move after one useful audit should be narrow: install one calm boundary, keep one defended record, then apply with the same lane instead of booking a vague demo.
markdown
# NORNR Governance Audit
Paste a public GitHub repo URL above to generate the first report.External proof pack
Use real repos, real PR comments and real before/after install surfaces.
This is the proof library that makes Governance Audit easier to send. Show one repo, one comment and one exact install path instead of asking people to imagine the PR guardrail.
NORNR Budget Shield demo repo
Before: no PR-level control story. After: one review-first comment on a real pull request.
NORNR MCP control demo pull request
Before: MCP, provider and payment surfaces entered the repo silently. After: one NORNR PR audit comment names the mixed consequential paths clearly.
Standalone action with release and Marketplace surface
Before: internal monorepo action. After: public install surface with versioned releases, screenshot proof and one-line setup.
Use the actual comment, not a mocked card
The screenshot in the public action repo shows the exact review-first comment teams will see before merge.
Browser-visible consequence should still route into the same NORNR control model
Use the browser governance package when the risky moment is checkout, vendor confirmation, subscription change or an admin click that should never settle as ambient automation.
CLI
Start with one local repo, one path set or one GitHub URL.
The page and CLI run the same audit motor, so outbound scans and internal analysis do not drift.
bash
npm run audit:governance -- --root . --output reports/governance-audit.md
bash
npm run audit:governance -- apps/api packages/sdk-py --max-findings 12
bash
npm run audit:governance -- --format json --output reports/governance-audit.json
bash
npm run audit:governance -- --format html --output reports/governance-audit.html
bash
npm run audit:governance -- --github https://github.com/owner/repo --max-findings 8