Epic: open-source publication readiness

[suchapalaver]

Goal

Prepare this repository to be made public and shared with an external design partner. The code tree, git-history secrets, and GitHub issue/PR metadata have already been audited and cleaned. This epic tracks the remaining presentation, policy, and process gates before the visibility switch, and serves as the single go/no-go checklist.

Use generic language ("the design partner") in any new issues, comments, commits, or docs. Do not reintroduce the partner's name — the metadata was deliberately scrubbed of it.

Already done (context for anyone picking this up cold)

• Apache-2.0 license + NOTICE added (closed work).
• Secret scan of the working tree and full git history — zero live credentials; a standing gitleaks CI lane + pre-commit hook now guard against regressions (.gitleaks.toml, .github/workflows/secret-scan.yml).
• Metadata scrub — the partner's name, internal Notion/Slack/ClickUp links, and a third-party email were removed from all issue/PR bodies, titles, and comments; the highest-signal comments were deleted outright (link/contact/strategy).

Accepted residue (NOT open tasks — do not "fix")

• The partner's name still appears in main commit messages and in refs/pull/* commit history. Removing it would require a force-push that rewrites every SHA and severs the commit↔PR↔approval linkage relied on for SOC 2 change-management evidence. GitHub also retains PR commit refs permanently (PRs cannot be deleted). This residue is a deliberate trade-off, accepted to preserve the audit trail.
• Edit-history dropdowns on the ~45 low-signal edited items still show pre-edit text. The per-revision delete control is UI-only and was not reliably available; not worth deleting whole technical records to chase.

Remaining gates (child issues)

• docs: review/remove internal working docs (Pre-Roadmap.md) before public release #562 — review/remove internal working docs (Pre-Roadmap.md)
• docs: add SECURITY.md with a coordinated-disclosure policy #563 — add SECURITY.md (coordinated-disclosure policy)
• docs: rewrite README intro for external readers + add quickstart #564 — rewrite README intro for external readers + quickstart
• chore: add CONTRIBUTING, CODE_OF_CONDUCT, and issue/PR templates #565 — add CONTRIBUTING, CODE_OF_CONDUCT, issue/PR templates
• chore: enforce branch protection on main (reviews, checks, no force-push) #566 — enforce branch protection on main
• chore: keep the design-partner names out of merge commits #567 — rename feat/ford_demo + keep partner name out of merge commits
• chore: adopt REUSE compliance (SPDX headers + LICENSES/ + lint gate) #568 — decide on Apache-2.0 per-file license headers
• chore: decide whether to publish the .cursor/ directory before going public #570 — decide whether to publish the .cursor/ directory

Go / no-go (do these at publish time, in order)

• All child issues above closed.
• Final re-verify sweep: re-fetch all issue/PR bodies + comments and re-run gitleaks git . + gitleaks dir .; confirm 0 partner-name / internal-link / secret / PII hits. (Metadata can change between now and go-time.)
• Confirm the publish commit does not accidentally stage any untracked internal/strategy docs present in working trees (e.g. call summaries, narratives, weekly-progress notes).
• Confirm branch protection (child below) is active so the public repo cannot be force-pushed or merged-without-review on day one.
• Flip repository visibility to public.

[suchapalaver]

Status update — 2 gates left, both with owners

All content / docs / policy / licensing gates are done and merged to main:

• ✅ docs: review/remove internal working docs (Pre-Roadmap.md) before public release #562 — internal working docs removed
• ✅ docs: add SECURITY.md with a coordinated-disclosure policy #563 — SECURITY.md (private vuln reporting) — PR docs: add SECURITY, CONTRIBUTING, CODE_OF_CONDUCT, and issue/PR templates #571
• ✅ docs: rewrite README intro for external readers + add quickstart #564 — README intro + quickstart — PR docs: rewrite README intro for external readers + add quickstart #572
• ✅ chore: add CONTRIBUTING, CODE_OF_CONDUCT, and issue/PR templates #565 — CONTRIBUTING / CODE_OF_CONDUCT / issue + PR templates — PR docs: add SECURITY, CONTRIBUTING, CODE_OF_CONDUCT, and issue/PR templates #571
• ✅ chore: adopt REUSE compliance (SPDX headers + LICENSES/ + lint gate) #568 — REUSE 3.3 compliance (SPDX headers + LICENSES/ + reuse CI gate) — PR chore: adopt REUSE compliance (SPDX headers + LICENSES/ + lint gate) #573
• ✅ chore: decide whether to publish the .cursor/ directory before going public #570 — .cursor/ reviewed; decision recorded to keep (not a blocker; shared AI coding config)

Content-safety check: a fresh scan of the tracked tree shows 0 design-partner-name hits and no secrets (gitleaks + reuse CI lanes are both green on main). The working tree is safe to publish today.

Remaining gates

#566 — branch protection on main → @adebnar @suchapalaver
Partially in place: the Main Approval ruleset is active and blocks force-push and branch deletion with no admin bypass. Still missing from the acceptance, and needed before flip:

• require a PR before merging, with ≥1 approving review from someone other than the author;
• required status checks = nextest (workspace) + the secret-scan/gitleaks lane (and reuse);
• optionally, require signed commits.
  This is an admin/Settings → Rules action, not a code change.

#567 — keep the design-partner name off the public surface → @neithanmo
The partner-named feature branch this issue tracks still exists on the remote, so its name would appear in the public branch list on day one. Owner action (don't let anyone rename an active branch out from under you): rename it to a generic name, delete the stale remote ref, and use a generic squash-merge subject when the work lands so the name never reaches main. (Partner name already on main/refs/pull/* remains accepted residue per this epic.)

Go / no-go (at publish time, after the two above)

1. Re-run gitleaks git . + gitleaks dir .; confirm 0 partner-name / secret / PII hits.
2. Confirm the publish commit stages no untracked internal/strategy docs from working trees.
3. Confirm branch protection (chore: enforce branch protection on main (reviews, checks, no force-push) #566) is fully active.
4. Flip repository visibility to public.

Net: the repo is essentially publish-ready on content; the gate is now #566 (branch-protection completeness) and #567 (branch rename) — both owner/admin actions.