forked from c-fu/arah2
- audit.mjs: zero-dep rendered-CSS scanner — flags off-token hex/rgb()/hsl() literals, non-sanctioned font families, non-zero border-radius, box-shadow, backdrop-filter, blur/drop-shadow; violations printed as file:line: declaration - drift guards (exit 2): <40 color tokens, any non-zero --radius-* token, missing token sheet / registered page / CSS input — no silent passes (T-1-07) - scope adjudication: framework layers + @property --tw-* skipped; @layer utilities audited only for classes used by implementation pages (mockup vocabulary is reference material, D-06; sheet/basemap pages are the registry) - token-hue+alpha 8-digit forms sanctioned; rounded-full sanctioned as circle primitive (spec geometry — puck/medallion signets); 50% radius stays flagged - wired: theme npm audit + test scripts (root audit delegate resolves)