Prepare website repository for public release

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

BRANDING.md

@@ -0,0 +1,14 @@
+# Brand and visual assets
+
+The MIT License in [LICENSE](LICENSE) covers the source code and technical documentation in this repository unless a file states otherwise.
+
+It does not grant rights to the OSS Singularity name, logos, trade dress, or other brand identifiers. The following visual assets are also excluded from the MIT License:
+
+- `site/assets/brand/`
+- `site/assets/social/`
+- `site/assets/projects/`
+- `docs/assets/`
+
+Those assets may be viewed and redistributed unmodified as part of this repository or one of its forks, provided that their origin and ownership are not misrepresented. Any other use requires permission from the applicable rights holder. Product screenshots remain subject to the rights and licenses of their respective source projects.
+
+This separation is intended to keep the implementation genuinely reusable without suggesting endorsement or transferring the project's identity.

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing
+
+Thanks for taking the time to improve the OSS Singularity website. Small, focused pull requests are easiest to review.
+
+## Before opening a pull request
+
+1. Keep the site dependency-free and preserve the authored HTML, CSS, and progressive-enhancement approach.
+2. Do not add analytics, cookies, storage, third-party runtime assets, automatic network requests, credentials, private infrastructure details, or account-specific screenshots.
+3. Preserve keyboard access, reduced-motion behavior, responsive layouts, semantic structure, and the budgets in `docs/product-requirements.md`.
+4. Build and validate the complete production tree:
+
+   ```sh
+   ./scripts/check-repository.sh
+   ```
+
+5. Describe behavior and visual verification in the pull request. Include public-safe screenshots when a visible change benefits from them.
+
+Generated `dist/` output is intentionally ignored. Change the authored files in `site/`, then let the repository check rebuild and validate the production tree.
+
+## Security
+
+Do not disclose vulnerabilities, credentials, private paths, hosting account details, or complete infrastructure exports in an issue or pull request. Follow [SECURITY.md](SECURITY.md) for private reporting.
+
+## Production boundary
+
+Merging source does not authorize a production deployment. Deployment credentials stay outside the repository, and production changes follow the separately documented review, backup, allowlist, and rollback gates.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OSS Singularity contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,9 +1,19 @@
 # OSS Singularity Website
 
+[![Repository checks](https://github.com/oss-singularity/website/actions/workflows/repository-checks.yml/badge.svg)](https://github.com/oss-singularity/website/actions/workflows/repository-checks.yml)
+
 Source repository for [oss-singularity.io](https://oss-singularity.io/).
 
 Launch Pad is a dependency-free static site shaped around the “Signal Observatory” visual direction: a precise cosmic shell, an adaptive pointer-reactive signal field, authentic project interfaces, and an intentionally human open-source voice. GitHub remains canonical; `dist/` is a reproducible, allowlisted production artifact.
 
+## Why inspect the source?
+
+- Authored HTML and CSS with one small, dependency-free Canvas enhancement
+- No framework, package install, analytics, cookies, storage, third-party runtime assets, or automatic network requests
+- Deterministic allowlisted builds with an exact SHA-256 production manifest
+- Repository checks for accessibility structure, metadata, links, security policy, immutable assets, privacy boundaries, and explicit performance budgets
+- Real design exploration and decisions preserved in `design/` and `docs/`, not hidden behind a generated theme
+
 ## Development
 
 Build and validate the complete site with:
@@ -30,14 +40,20 @@ See [docs/hosting.md](docs/hosting.md) for the verified baseline, safety boundar
 
 See [docs/brand-inputs.md](docs/brand-inputs.md) for the verified identity and messaging sources that will inform the design process.
 
+## Contributing
+
+Thoughtful fixes and improvements are welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) for the repository boundaries and local verification command. Please report security-sensitive findings privately as described in [SECURITY.md](SECURITY.md).
+
+## License
+
+Source code and technical documentation are available under the [MIT License](LICENSE). The OSS Singularity identity and visual assets are excluded as described in [BRANDING.md](BRANDING.md).
+
 ## Status
 
 - Hosting access baseline: verified
-- Repository security baseline: verified
+- Repository security baseline: verified; public-repository protections tracked separately from source checks
 - Existing brand inputs: inventoried; canonical vector avatar source located and preserved
 - Requirements, architecture, visual direction, and static technology stack: selected and documented
 - Launch Pad v0: live and production-verified at [oss-singularity.io](https://oss-singularity.io/)
 - Canonical host: apex only; no published URL uses `www`
 - Open hosting follow-up: reissue TLS with the `www` SAN after Namecheap/SSL.com issuance error `1010` clears, then verify the redirect-only alias
-
-Security-sensitive findings should be reported privately as described in [SECURITY.md](SECURITY.md).

design/prototypes/signal-observatory.html

@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Signal Observatory direction</title><link rel="stylesheet" href="prototypes.css"></head><body class="observatory"><main class="frame"><header class="top"><div class="brand"><img src="../../site/assets/brand/oss-singularity-mark.svg" alt="">OSS Singularity</div><nav aria-label="Prototype"><a href="#work">Work</a><a href="#signal">Principles</a><a href="https://github.com/oss-singularity">GitHub ↗</a></nav></header><section class="hero"><div><p class="eyebrow">Open transmission · Berlin orbit</p><h1>Engineering for what comes <em>next.</em></h1><p class="lead">Privacy-minded tools and experiments built in the open — precise enough for real systems, human enough for the people using them.</p><div class="actions"><a class="button" href="#work">Explore the work</a><a class="button" href="https://github.com/oss-singularity">Open GitHub ↗</a></div></div><div class="visual"><img src="../../site/assets/brand/oss-singularity-mark.svg" alt=""></div></section><section class="strip" id="work"><article class="card"><b>PDrive Control Center</b><span>Reliable Proton Drive workflows for Linux.</span></article><article class="card"><b>ChatGPT Usage</b><span>Usage signals, directly in Cinnamon.</span></article><article class="card"><b>Desktop Systems</b><span>Small tools. Observable behavior. Open source.</span></article></section></main></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Signal Observatory direction</title><link rel="stylesheet" href="prototypes.css"></head><body class="observatory"><main class="frame"><header class="top"><div class="brand"><img src="../../site/assets/brand/oss-singularity-mark.svg" alt="">OSS Singularity</div><nav aria-label="Prototype"><a href="#work">Work</a><a href="#signal">Principles</a><a href="https://github.com/oss-singularity">GitHub ↗</a></nav></header><section class="hero"><div><p class="eyebrow">Open transmission · Signal 001</p><h1>Engineering for what comes <em>next.</em></h1><p class="lead">Privacy-minded tools and experiments built in the open — precise enough for real systems, human enough for the people using them.</p><div class="actions"><a class="button" href="#work">Explore the work</a><a class="button" href="https://github.com/oss-singularity">Open GitHub ↗</a></div></div><div class="visual"><img src="../../site/assets/brand/oss-singularity-mark.svg" alt=""></div></section><section class="strip" id="work"><article class="card"><b>PDrive Control Center</b><span>Reliable Proton Drive workflows for Linux.</span></article><article class="card"><b>ChatGPT Usage</b><span>Usage signals, directly in Cinnamon.</span></article><article class="card"><b>Desktop Systems</b><span>Small tools. Observable behavior. Open source.</span></article></section></main></body></html>

docs/brand-inputs.md

@@ -28,7 +28,7 @@ The organization Sponsors listing is not active yet. Until activation is verifie
 - Primary audiences, journeys, content hierarchy, calls to action and the relationship to GitHub are specified in `docs/product-requirements.md`.
 - “Signal Observatory” is the selected visual direction; the comparison and source prototypes are in `docs/design-directions.md` and `design/prototypes/`.
 - The canonical mark keeps its cyan/magenta event-horizon geometry. The website uses a deep observatory palette, system typography, restrained motion, and authentic project screenshots.
-- The launch target is WCAG 2.2 AA with explicit performance and privacy budgets. No analytics, cookies, tracking, third-party runtime requests, or executable client-side JavaScript ship in v0.
+- The launch target is WCAG 2.2 AA with explicit performance and privacy budgets. The only executable client-side JavaScript is a small, dependency-free decorative Canvas enhancement; it performs no analytics, tracking, storage, or third-party runtime requests and is removed for reduced-motion users.
 - GitHub remains canonical for repositories, releases, documentation and issues. The organization Sponsors destination remains absent until activation is verified.
 
 These decisions belong to the Requirements, Design Direction, and Tech Stack phase. Existing sources constrain authenticity, not creativity.

docs/hosting.md

@@ -38,7 +38,7 @@ Namecheap's jailed shell exposes `/usr/local/cpanel/bin/uapi`, but the command c
 
 ## GitHub controls and deployment access
 
-The source repository remains private by explicit owner choice. The available private-repository controls are accepted for this project: squash-only merges, branch cleanup, selected Actions, read-only workflow permissions, Dependabot alerts, and automated security updates.
+The source repository is published for transparent inspection and contribution. Repository policy keeps squash-only merges, branch cleanup, selected Actions, read-only workflow permissions, automated dependency updates, private vulnerability reporting, secret scanning with push protection, CodeQL, and a protected linear `main` branch with required repository checks. Public source does not widen the production credential or deployment boundary.
 
 The OSS Singularity organization currently disables deploy keys across its repositories. A repo-specific cPanel deploy key was therefore not retained, no broader personal access token or account key was installed on the shared host, and no cPanel mirror was created. The preferred low-complexity path is an initial reviewed release over the already verified local SSH connection, followed by a GitHub Actions push deployment after successful changes to `main`. The workflow must transfer only the declared build output, serialize production deployments, verify the live result, and retain a rollback target. A repository-scoped GitHub App is reserved for a future requirement that genuinely needs server-initiated pulls; do not add its token-rotation and private-key machinery without that need.
 

scripts/check-repository.sh

@@ -11,7 +11,7 @@ cd "$repo_root"
 git diff --check
 git diff --cached --check
 
-for required in README.md SECURITY.md docs/hosting.md docs/brand-inputs.md docs/product-requirements.md docs/design-directions.md; do
+for required in README.md CONTRIBUTING.md LICENSE BRANDING.md SECURITY.md docs/hosting.md docs/brand-inputs.md docs/product-requirements.md docs/design-directions.md; do
     if [ ! -s "$required" ]; then
         printf 'missing required repository baseline: %s\n' "$required" >&2
         exit 1