PackProof: Test What You Ship

A small npm library maintainer can ship a broken package even when source tests are green. A required template may exist in the checkout but disappear from the archive that users install. An import-only smoke test can miss the failure entirely. PackProof checks the artifact at that handoff. A maintainer supplies a trusted local package and a consumer contract describing a real operation. The CLI packs the package, installs that exact tarball into a fresh consumer outside the source tree, runs the contract, and writes a JSON report. Each report connects the archive hash and file list to the copied contract, installed-file checks, commands, output and observed outcome. PASS, FAIL and INCONCLUSIVE remain separate; a timeout or failed evidence check cannot become a pass. Our demonstration starts with five passing source-baseline tests. The missing-template archive then fails the actual label operation, although importing it succeeds. Including the template makes the same frozen operation pass. A deliberately wrong assertion still fails, a broken export fails, and an independent CommonJS package passes. All six expected observations matched. Independent validation on Windows with Node 24.16.0 and npm 11.13.0 passed 64 tests, with no failures or skips. The interactive viewer makes those saved reports inspectable: compare the broken and repaired archives, filter cases, inspect output and verification details, or import your own report locally. It presents saved executions; it does not run packages in the browser. The useful difference is a repeatable consumer check tied to the precise artifact and organized evidence. Existing metadata tools and manual consumer tests remain valuable; PackProof does not claim exclusive detection. It covers only the operation the contract exercises. This prototype uses trusted synthetic fixtures, is not a security sandbox, and has not been validated on Linux or measured with customers. The implementation is MIT-licensed and requires no cloud service or paid API.