Outcome

Supersedes #4 with the hardened NodeKit 0.2.0 candidate and closes the concrete empty-directory portability gap.

What changed

• Adds the smb-lending-fde and agentic-rl-research presets with bounded, honest proof levels.
• Normalizes text identity across LF/CRLF checkouts and binds generated proofs to the exact source/runtime identity.
• Rejects stale Understand Anything graph imports whose repository commit does not match the pinned source.
• Vendors the exact NodeKit compile/check runtime into generated apps instead of depending on mutable GitHub 0.1.0.
• Prevents the vendored runtime from polluting domain capability discovery.
• Adds npm run acceptance:factory, which starts from genuinely empty directories for both presets and executes install, compile, check, demo, eval, benchmark, and proof.
• Makes both preset proof verifiers fail closed after source/runtime drift.

Independent verification on 2c767907

• npm test: 39/39 passed
• npm run acceptance:factory: PASS for both presets
• npm run registry:check: PASS
• npm audit --omit=dev: 0 vulnerabilities
• npm pack --dry-run: 178 files, 95.2 kB packed / 394.7 kB unpacked
• factory receipt: proof/factory-acceptance.json
  • receipt digest: 3f792e0ddbf7cffe5173b543b96baf3c43a7c81567f746ebfbce1e2cebce9867
  • Agentic RL app hash: 6ec029c45898affba0801095ba6b506d0384f152a423ebe7c674aa9abc23b796
  • SMB lending app hash: 7e667aa5d789a22a9c97664b03ce2cb75087d68c29962e08e5095a257ef798d0

A secret-pattern scan found only the deliberate fake sk-... fixture used to prove literal-secret rejection.

Honest boundaries

• npm publication is not performed because the current npm session is unauthenticated (E401).
• No shared NodeBench Convex deployment was touched.
• The generated SMB app remains local-only until authenticated workspace/tenant isolation exists.
• The generated RL preset is a local deterministic research baseline, not trained frontier RL.
• Pre-existing cross-repository audit failures remain outside this PR (missing/misnamed checkouts and stale sibling declarations).