README: apply the image-led frame (RW-6b)

[jothimani-rajendran]

What

Applies the image-led README frame (RW-6b) to context-report: cover panel, then one panel per section, each followed by a "Text version" block. Only README.md changes. Merge after chock#234 (the panel links 404 until it merges).

Definition of done

• python -m ruff check . and python -m ruff format --check . clean
• python -m pytest -q green
• No schema changes
• No .agents/policies/ changes

Claims

• No row is described differently than before; the row and paper numbers kept are unchanged text from the previous README, each traced to the paper below.

1. Heading outline (grep -n '^## ' README.md)

24:## Application security for the code your agents write
44:## Install
65:## 30-second quickstart
148:## How it works
229:## What it stops
302:## Guardrails, not guarantees
308:## FAQ for people and agents
324:## For tools and agents
336:## Part of open-coder-ai
356:## Contributing
378:## License

(H1 at line 9 inside the first Text version block.) Panels: cover-context-report, appsec, adopt, layers (How it works), honest, family.

2. Checks that read README.md

• tests/test_quickstart_block.py (inside the full suite): 407 passed, 1 skipped.
• ruff check .: All checks passed!; ruff format --check .: 240 files already formatted.
• quickstart workflow, replayed locally: regenerated docs/quickstart.sh from README.md via tools/quickstart_block.py and diff -u docs/quickstart.sh generated: empty. Ran bash -euo pipefail quickstart.sh in a fresh dir: exit 0.
• figures workflow, replayed locally: cd docs/figures && for g in make_*.py; do python "$g"; done exit 0, git diff -- docs/figures empty (the row-basis figure is regenerated from the README quickstart block).
• No check loosened. The checker requires the exact heading ## 30-second quickstart and its first bash fence, so that heading and block are kept verbatim (inside the Install Text version block).

3. Self-check grep

grep -n -i -E "pip install chock|free forever|never leaves|would have prevented|\[stars\]|rtk|hallucinat|removes the findings|never sends|not on PyPI" README.md : empty (exit 1).
The pattern 100% matches only the six width="100%" image attributes, as in the reference README.

4. Numbers and derivations

• Catalog (chock-catalog main f25f5a3), python3 -c over registry.yaml: 71 policies; enforces Counter: enforced-at-commit 35, advisory 25, best-effort 11; Claude Code label keywords: block 39, advise 24, warn 5, ask 3; sum(eval_cases) 4280, sum(eval_executed) 4098. In the README only "71" (layers table) is used, plus the family table copied from the reference.
• "7 have a slice refused at commit, 0 fully covered" (appsec row) is the ruling in the brief and the appsec/honest panels; not re-derived here.
• Producer imports no network or model module: grep -rln "urllib\|anthropic\|http.client\|socket\|requests" src/context_report/produce : empty (exit 1) at 5fbef7b. The README previously said 3a1c0c3; updated to the commit measured.
• Paper-sourced figures kept unchanged (cited to the paper in the README): 18 plugins, 916.8 / 941.5 ms, 7.3 / 53.9 ms, 1,500 to 147,000 tokens, 168 transcripts; each string found by grep in paper/context-report.md (lines 226, 280, 282, 294, 317). The 11/3/1/7 row-basis split is unchanged and its figure regenerates without drift.

5. Deviations

• ## 30-second quickstart lives inside the Install "Text version" block (a ## inside <details>), because tools/quickstart_block.py needs that exact heading and cannot be loosened.
• The old pip install context-report line is kept inside the Install Text version block under "### Install context-report", as the brief allows.
• The appsec table adds an OWASP row to match the appsec panel; it has no policy-count numbers beyond the ruling.
• The demo GIF and the existing figures are kept in their original sections inside Text version blocks.

🤖 Generated with Claude Code

---

Generated by Claude Code