Your first local report

Download the standalone runner for Node.js 24. Local checks and report exports need no LaunchProof account, repository access, or package installation.

Explore with a synthetic demo

Run an intentionally flawed local fixture, inspect the failures, then compare a corrected rerun. No target setup or account.

Get the runner

Check your own application

Start with anonymous access to one private project. Add tenant isolation and paid access only when their fixtures are ready.

Check compatibility first

Will this work with your app?

The current adapter calls CompanyNerve project functions on Convex. Next.js, WorkOS, or Stripe alone does not establish compatibility.

Which describes your application?

This selection is guidance only. It does not inspect or verify your application.

Download and verify the runner

LaunchProof 0.1.1

A standalone JavaScript module with its dependencies bundled. Requires Node.js 24. Includes the initial AUTH, TENANT, and PAID check pack.

Download runner v0.1.1 Download SHA-256 manifest Download licenses and notices

Save all three files in a new local folder. Open the checksum manifest and notices, then calculate the runner file's SHA-256 hash with the command for your system. In the manifest's files array, find the entry named launchproof-0.1.1.mjs. Compare your complete hash with its sha256 value, ignoring letter case. If they differ, do not run that file.

Windows PowerShell

Get-FileHash ./launchproof-0.1.1.mjs -Algorithm SHA256

macOS

shasum -a 256 ./launchproof-0.1.1.mjs

Linux

sha256sum ./launchproof-0.1.1.mjs

This manifest contains unsigned SHA-256 hashes. No digital signature is provided. A matching checksum confirms that the file matches this manifest; it does not authenticate the publisher. After inspecting the download, check your Node.js version and read the runner's help:

node --version
node launchproof-0.1.1.mjs --help

The version command should show v24. followed by its minor and patch version. Run the remaining commands from the folder containing the downloaded module.

Try the synthetic local demo

After verifying the runner, run this command in your local terminal. It uses its own temporary loopback fixture. It does not need your application URL, target credentials, or a LaunchProof account.

node launchproof-0.1.1.mjs demo --out launchproof.demo.json

Open launchproof.demo.json in your editor. Its before report shows anonymous access failing, its after report shows the corrected rerun, and comparison explains the change. These are synthetic observations about the owned fixture, never proof about your application.

The demo envelope is for local learning. It is not an uploadable customer report. Use a fresh output filename if you run it again.

Preview the illustrated finding walkthrough if you want to explore before downloading.

Prepare one check for your application

Use a CompanyNerve staging application you own or have permission to test. A public website URL alone is not enough. Prepare these fixtures in the target application through its normal authorized setup. For the smallest scope, select only LP-AUTH-001:

One disposable workspace and an actor allowed to read its private project. No paid fixture is needed for this check.
One private project owned by that workspace. Give the project a unique synthetic marker in its name or description and set the matching protectedMarker in the manifest.
A legitimate short-lived target Convex user JWT for the fixture actor. A website session cookie, WorkOS API key, Convex deployment key, or LaunchProof upload token cannot replace a target user JWT.

The guided setup asks for fixture metadata and environment variable names in your terminal. It does not ask you to paste JWT values.

node launchproof-0.1.1.mjs init --guided --checks LP-AUTH-001 --out launchproof.config.json --credentials-out launchproof.credentials.json

Review the generated manifest's target Convex deployment origin, application ID, workspace and project IDs, and fixture aliases. The adapter calls declared CompanyNerve project functions. launchproof.credentials.json is an explicit local alias-to-environment-variable map. Keep the mapping and fixture secrets local. Never commit them or paste them into LaunchProof.

For local-only reports, choose a stable application ID such as my-staging-app. To upload later, use the ID from a LaunchProof reporting application and generate a report with that ID. Local execution does not require a hosted account.

Use the credential map generated by init. Set its named environment variables to the disposable actors' target JWTs in your local shell or CI secret store. The map contains variable names, never the JWT values. Check the fixture metadata and scope expiry before running doctor.

Read the supported check requirements

Add the other current checks when ready

LP-TENANT-001 also needs a second workspace and its authenticated actor. Guided setup also asks for that actor's own project and synthetic marker. The owner baseline must succeed before the wrong workspace is tested.

LP-PAID-001 needs disposable paid and free fixtures and the declared paid project report operation. It checks access to that operation, not checkout, webhook delivery, or subscription lifecycle. Use your own sandbox fixtures; do not make a real purchase to prepare this check.

Unselected checks are outside the declared scope. An unsupported check or failed baseline is unverified, never a pass.

Inspect and approve the plan

node launchproof-0.1.1.mjs doctor --manifest launchproof.config.json --credentials launchproof.credentials.json
node launchproof-0.1.1.mjs plan --manifest launchproof.config.json --credentials launchproof.credentials.json --out launchproof.plan.json
node launchproof-0.1.1.mjs approve --plan launchproof.plan.json --approved-by "Owner" --confirm sha256:REPLACE_WITH_EXACT_PLAN_DIGEST --out launchproof.approval.json

Inspect every target and operation before approving. Replace the digest placeholder with the exact digest printed by the plan command. Approval binds to that plan and has an expiry. Output files are created without overwriting existing files. Choose a fresh output filename for every plan, approval, and rerun.

doctor validates local configuration, expiry, and credential availability without making target requests. It does not verify live sessions, billing state, ownership, or deployment identity. The run command establishes permitted baselines before it tests denied access.

Execute locally and inspect the report

node launchproof-0.1.1.mjs run --plan launchproof.plan.json --approval launchproof.approval.json --credentials launchproof.credentials.json --allow-network --out launchproof.report.json
node launchproof-0.1.1.mjs report --input launchproof.report.json --format markdown --out launchproof.report.md

Add --ci for customer CI execution. A permitted baseline runs before a negative assertion. Missing setup stays unverified. Review the JSON, redaction, findings, and limitations on your machine.

Upload only if you want hosted history

This step is optional. Your local JSON and Markdown reports are already usable. For hosted history, sign in and create a reporting application. Its ID must match the report's application ID. Upload a JSON file or paste a redacted report on the application page.

For CI, an owner can issue a short-lived reports:upload token from the application's token page. Store it as LP_UPLOAD_TOKEN in your CI secret store.

node launchproof-0.1.1.mjs upload --input launchproof.report.json --origin https://launch.companynerve.com --token-env LP_UPLOAD_TOKEN

This previews the upload. After inspecting it, repeat the command with --confirm sha256:REPLACE_WITH_PREVIEW_DIGEST --allow-network to send it. Reports must match the released schema and catalog, contain required checks, and fit within 1 MiB.

Open your workspace

Fix, rerun, and compare

Export JSON or Markdown for your coding agent. Review notes stay separate from observations. After a fix, run the same approved scope into a new report file while the approval is still valid, then compare locally:

node launchproof-0.1.1.mjs run --plan launchproof.plan.json --approval launchproof.approval.json --credentials launchproof.credentials.json --allow-network --out launchproof.rerun.json
node launchproof-0.1.1.mjs compare --before launchproof.report.json --after launchproof.rerun.json

A skipped, unsupported, missing, or incompatible check does not resolve a failure. Keep environment, deployment identity, versions, and plan differences in view. If scope or approval has expired, prepare and inspect a fresh plan and approval before rerunning.