- Tests four behavioral cases: unwaived High → blocking, waived High → not blocking, moderate/low only → not blocking, no advisories → not blocking - Uses node:test + node:assert (no extra dependencies) - Fails at RED: check-audit.mjs does not yet exist