[isaacslee]

Why

The repository became public on 2026-10-16, and hosted CI now runs. The README, SECURITY.md and CONTRIBUTING.md still described a private repository with no CI and no branch protection. The acceptance record also stopped before the fixes that followed the independent review.

What changed

• README:
  • the status is a public alpha, with no release or tag;
  • each item still unverified is listed;
  • a short comparison with svc.sh, ARC and GARM;
  • a getting-started path.
• SECURITY.md: points at private vulnerability reporting, which is now enabled. The private-repository caveat is gone.
• CONTRIBUTING.md: records the main ruleset as it is configured:
  • changes arrive by pull request, merged by rebase only;
  • gate required, linear history, no force push or deletion;
  • administrators can bypass only when merging a pull request;
  • fork workflows need approval.
• contract.md: settles the decisions that were open. The Beta exit criteria now include:
  • status with an authenticated gh;
  • one x86_64 host;
  • an observed self-update.
• verification.md and the acceptance record:
  • public CI as a layer;
  • the real-host run of the mount refusal at 90f7ec8;
  • main's first hosted gate run.
• CHANGELOG: the real-host fixes and the Address the post-acceptance review of #15-#17 before merging #18 and review fixes, written for someone upgrading.

How it was verified

• Local: tests/run.sh with shellcheck 0.10.0. 20 scripts are clean, and 545 drill cases pass, 0 failed. The docs drill checks links, keys and spelling.
• Hosted CI on this PR: see the gate check.

Evidence level

Documentation only. Each claim points at the record it rests on, as the acceptance and verification documents describe.

Limitations

Nothing in this PR verifies x86_64, a systemd other than 255, a self-update or an authenticated status. The documents say so.

Risks

None at runtime: no code changes.

Compatibility impact

None.

Remaining work

The first release and tag remain a separate owner decision.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.