Dogfooded the full weekly workflow and merged the output as a real PR:

PR: https://github.com/mcp-tool-shop/mcp-tool-shop/pull/2

Trust receipt: 8 artifacts SHA-256 hashed, tied to commit 43fa469. I ran all 10 generators twice to verify deterministic output — identical results excluding timestamps.

Example outputs (real, not mocked): https://github.com/mcp-tool-shop/mcp-tool-shop/tree/main/doc...

Why build this? Rankings are easy. Governance is the part that rots.

promo-kit makes "what changed / why promoted / what's frozen" verifiable:

- drift = entrants, exits, score changes week-over-week - freeze = pause automation, humans review before resuming - receipts = SHA-256 hashed inputs tied to git commits - automation = opens PRs, humans merge — never pushes to main

Zero dependencies, Node 22+, ESM-only. Quickstart is two commands: npx promo-kit init && npx promo-kit selftest