Thanks for weighing in. Agreed on both counts. Option A is exactly that: one readable script, runs offline, no dependencies. Option B is for people who won't run anyone else's code against their vault, even if they can read it. Same tests, same offline checker, but the code comes out of their own machine. Both routes get the test-before-vault step.