Your first local report

1. Download and verify the runner

Save all three files in a new local folder. Open the checksum manifest and notices, then calculate the runner file's SHA-256 hash with the command for your system. In the manifest's files array, find the entry named launchproof-0.1.0.mjs. Compare your complete hash with its sha256 value, ignoring letter case. If they differ, do not run that file.

Get-FileHash ./launchproof-0.1.0.mjs -Algorithm SHA256

shasum -a 256 ./launchproof-0.1.0.mjs

sha256sum ./launchproof-0.1.0.mjs

This manifest contains unsigned SHA-256 hashes. No digital signature is provided. A matching checksum confirms that the file matches this manifest; it does not authenticate the publisher. After inspecting the download, check your Node.js version and read the runner's help:

node --version
node launchproof-0.1.0.mjs --help

The version command should show v24. followed by its minor and patch version. Run the remaining commands from the folder containing the downloaded module.

2. Prepare authorized fixtures

Use a CompanyNerve staging application you own or have permission to test. A public website URL alone is not enough. Prepare these fixtures in the target application through its normal authorized setup:

• Two disposable workspaces: one with a known Pro owner or admin, the other with a Free owner or admin.
• A private project owned by each workspace. Give each project a unique synthetic marker in its name or description and set the matching protectedMarker in the manifest.
• A legitimate short-lived target Convex user JWT for each fixture actor. A website session cookie, WorkOS API key, Convex deployment key, or LaunchProof upload token cannot replace a target user JWT.

Create a local manifest with the verified runner:

node launchproof-0.1.0.mjs init --out launchproof.config.json

Edit the manifest with your target Convex deployment origin, application ID, workspace and project IDs, and fixture aliases. The initial adapter calls the declared CompanyNerve project read and paid report functions. Create launchproof.credentials.json as an explicit local alias-to-environment-variable map. Keep the mapping and fixture secrets local. Never commit them or paste them into LaunchProof.

For local-only reports, choose a stable application ID such as my-staging-app. To upload later, use the ID from a LaunchProof reporting application and generate a report with that ID. Local execution does not require a hosted account.

Use the credential-map example printed by init. Set its named environment variables to the disposable actors' target JWTs in your local shell or CI secret store. The map contains variable names, never the JWT values. Replace the manifest's fixture placeholders and check its scope expiry before running doctor.

3. Inspect and approve the plan

node launchproof-0.1.0.mjs doctor --manifest launchproof.config.json --credentials launchproof.credentials.json
node launchproof-0.1.0.mjs plan --manifest launchproof.config.json --credentials launchproof.credentials.json --out launchproof.plan.json
node launchproof-0.1.0.mjs approve --plan launchproof.plan.json --approved-by "Owner" --confirm sha256:REPLACE_WITH_EXACT_PLAN_DIGEST --out launchproof.approval.json

Inspect every target and operation before approving. Replace the digest placeholder with the exact digest printed by the plan command. Approval binds to that plan and has an expiry. Output files are created without overwriting existing files. Choose a fresh output filename for every plan, approval, and rerun.

doctor validates local configuration, expiry, and credential availability without making target requests. It does not verify live sessions, billing state, ownership, or deployment identity. The run command establishes permitted baselines before it tests denied access.

4. Execute locally and inspect the report

node launchproof-0.1.0.mjs run --plan launchproof.plan.json --approval launchproof.approval.json --credentials launchproof.credentials.json --allow-network --out launchproof.report.json
node launchproof-0.1.0.mjs report --input launchproof.report.json --format markdown --out launchproof.report.md

Add --ci for customer CI execution. A permitted baseline runs before a negative assertion. Missing setup stays unverified. Review the JSON, redaction, findings, and limitations on your machine.

5. Upload only if you want hosted history

This step is optional. Your local JSON and Markdown reports are already usable. For hosted history, sign in and create a reporting application. Its ID must match the report's application ID. Upload a JSON file or paste a redacted report on the application page.

For CI, an owner can issue a short-lived reports:upload token from the application's token page. Store it as LP_UPLOAD_TOKEN in your CI secret store.

node launchproof-0.1.0.mjs upload --input launchproof.report.json --origin https://launch.companynerve.com --token-env LP_UPLOAD_TOKEN

This previews the upload. After inspecting it, repeat the command with --confirm sha256:REPLACE_WITH_PREVIEW_DIGEST --allow-network to send it. Reports must match the released schema and catalog, contain required checks, and fit within 1 MiB.

6. Fix, rerun, and compare

Export JSON or Markdown for your coding agent. Review notes stay separate from observations. After a fix, run the same approved scope into a new report file while the approval is still valid, then compare locally:

node launchproof-0.1.0.mjs run --plan launchproof.plan.json --approval launchproof.approval.json --credentials launchproof.credentials.json --allow-network --out launchproof.rerun.json
node launchproof-0.1.0.mjs compare --before launchproof.report.json --after launchproof.rerun.json

A skipped, unsupported, missing, or incompatible check does not resolve a failure. Keep environment, deployment identity, versions, and plan differences in view. If scope or approval has expired, prepare and inspect a fresh plan and approval before rerunning.