# MoonSeal MVP status

MoonSeal's minimum viable product is complete and reproducible.

## User workflow

1. Clone the public repository.
2. Run `moon update`.
3. Audit a MoonBit project with `moon run cmd/main scan PATH`.
4. Enforce blocking checks with `moon run cmd/main check PATH`.
5. Export a CycloneDX document with
   `moon run cmd/main sbom PATH -o moonseal.cdx.json`.
6. Analyze dependency health with `moon run cmd/main dependencies PATH`.
7. Enforce project policy with
   `moon run cmd/main policy PATH --policy moonseal-policy.json`.

## Implemented scope

- Current `moon.mod` and legacy `moon.mod.json` parsing
- Mooncakes dependency and version extraction
- SPDX declaration validation and license-text detection
- Fourteen release-readiness checks with stable finding codes
- Repository-specific policy and dependency-health checks
- Text, JSON, Markdown, and SARIF audit reports
- Deterministic CycloneDX 1.6 output
- Audit baseline comparison and SLSA provenance output
- CLI integration tests and WebAssembly CI

## Reproduction

```shell
moon update
moon check --target wasm
moon test --target wasm
moon build --target wasm --release
moon run --target wasm cmd/main check .
moon run --target wasm cmd/main dependencies .
moon run --target wasm cmd/main policy . --policy moonseal-policy.json
moon package --list
```

The project keeps feature work, tests, documentation, and release notes in
separate commits so that development progress can be reviewed from Git history.