Prepare repository for public contributions (advances #78)

[vantasnerdan]

Objective and issue

Prepare the repository-level license, contribution, conduct, security, CI, dependency, and review-governance surfaces needed before public contributions.

Canonical issue: #78

Issue relationship: Advances #78

Authoring agent: codex-public-readiness

Intended independent merger: @vantasnerdan, @axis-marbell, or @mlops-kelvin, excluding this implementing Codex session.

• The canonical issue existed before this PR was submitted.
• I will not merge this PR because I opened it, authored a commit, or materially implemented it.

Change classification

• Reusable implementation or tooling
• Documentation or workflow
• Scientific proposal or campaign evidence
• Claim promotion transaction
• Harvest from an incomplete research PR
• Compatibility-only repair

Authority and scope

Base release and commit: accepted release v0.160.0; main at 1b00c3a0c984e15e3637cf1b76dbfbc20b2b3f98.

Accepted claims and canonical sources used: none; this PR changes no scientific claim, campaign, release, migration disposition, or generated scientific documentation.

Declared imports, assumptions, and conventions: Apache-2.0 is the owner-selected default project license. GPL-3.0-or-later tutorial material and CC-BY-SA-4.0 conduct-policy text remain separately identified in THIRD_PARTY_NOTICES.md.

Files or concerns intentionally out of scope: visibility mutation, history sanitization, PR #77, scientific authority, branch protection, security-feature activation, and collaborator permission changes. Those remain issue #78 gates.

New or materially changed public interfaces:

Symbol or module	Authority status	Accepted claim IDs	Owning issue/PR	Conditional boundary
Package license/readme/URL metadata	non-scientific utility	none	#78 / this PR	Distribution metadata only
Repository validation workflow	non-scientific utility	none	#78 / this PR	Runs existing full validator with read-only permissions

Unit-level disposition

Unit	Local claim or purpose	Dependencies	Evidence and tests	Proposed disposition
License and notices	State Apache-2.0 default and retain third-party terms	Owner choice; Zenodo rights metadata	package build; policy regression tests	merge
Contribution/community surfaces	Give public contributors issue-first, rights-safe workflow	AGENTS contract	YAML/link/policy tests	merge
CODEOWNERS and review policy	Require qualifying approval from the three designated maintainers	protected-main settings after publication	exact-owner regression test	merge
CI and Dependabot	Give PRs least-privilege validation and updates	existing bootstrap/validator	static workflow tests; full suite	merge
Gitleaks config	Narrowly adjudicate one immutable identifier-list false positive	prior redacted all-history audit	final filesystem scan	merge
Effort memory	Preserve decisions, debt, and continuation state	issue #78	memory validator	merge

• Artifact merge: yes; each unit is independently useful while the repository remains private.
• Claim promotion: none.
• Goal completion: no; public-history sanitation, independent merge, visibility, protection, security, permission reduction, and anonymous verification remain.

Verification and sensitivity

Scientific mutation/numeric/formal checks are N/A: this PR changes no scientific statement, equation, solver, verifier, or public physics API.

# scripts/bootstrap.sh
# exit 0; editable package metadata built and agent-memory 0.2.0 installed

# scripts/validate.sh --full
# exit 0; registry/generated/memory/skill/import/compile checks passed
# 2222 passed in 310.73s
# ALL REPOSITORY WORKFLOW CHECKS PASS (full pytest suite)

# git diff --cached --check
# exit 0

# docker run --rm -v "$PWD:/repo:ro" ghcr.io/gitleaks/gitleaks:v8.30.1 dir /repo --config /repo/.gitleaks.toml --redact --report-format json --report-path -
# exit 0; []

The Gitleaks image resolved to digest sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f.

GitNexus impact

The index was refreshed from this isolated worktree. detect_changes(scope="compare", base_ref="origin/main") reported 19 changed files, zero affected execution flows, and LOW risk. No framework function, class, or API symbol changes. The only indexed process, “Run → Check,” is unaffected.

Memory, governance, and generated state

Durable contract: memory/codex/efforts/public-contribution-readiness.md.

Proposal/campaign/claim/release changes: none.

Generated outputs and synchronization commands: no generated scientific outputs changed; scripts/render_docs.py --check and scripts/render_memory.py --check passed via the full validator.

Debt remaining inside the proposed merge unit: none.

Campaign frontier outside this merge unit: issue #78 publication transaction, especially rights-safe history sanitation.

Validation boundary

• Targeted tests and named scientific verifiers pass.
• Load-bearing mutations, counterexamples, or wrong-convention probes fail as expected. N/A for non-scientific policy/configuration; parser and exact-policy regression tests cover the load-bearing surface.
• Affected downstream consumers replay. No code execution flow is affected; the full suite passed.
• scripts/validate.sh --full passes because package/build metadata and public CI changed.
• The pytest scope remains valid against the merge base; the final full run was not duplicated.
• git diff --check passes in a separate invocation.
• No unrelated, generated-by-hand, or host-specific artifacts are included.

Author handoff

Independently inspect the license exceptions, exact CODEOWNERS set, least-privilege workflow, issue-first forms, and the successful Actions run. The riskiest assumption is that the two higher-dimensional tutorials are adaptations of the GPL-3.0-or-later source tutorial; the notices conservatively retain GPL terms.

After artifact merge, the next decisive action is an owner-authorized history-sanitation transaction for the Preparata publisher PDF/full extraction before any public visibility change. Do not merge this PR from this implementing session.

---

Reviewer disposition

To be completed by the independent reviewer.

• Canonical issue predates PR: yes

• Authoring or implementing agent: codex-public-readiness

• Distinct merger: pending

• Artifact merge:

• Claim promotion: none

• Goal completion: no

• Merge as written:

• Refactor or harvest:

• Leave in PR history:

• Next decisive action:

• Head branch disposition: auto-delete after merge; preserve if closed-unmerged/failed.

Reviewer checks

• Base release, issue, accepted boundary, diff, memory, and discussion inspected.
• The canonical issue existed before the PR was submitted.
• The designated merger did not open, author a commit for, or materially implement the PR.
• Load-bearing result independently rederived or reproduced.
• Dependencies, conventions, imports, consumers, and GitNexus impact audited.
• Every new public symbol has an explicit authority status and owning issue.
• Verification sensitivity and applicable numerical/formal limits audited.
• Merge, claim-promotion, and goal-completion decisions kept independent.
• Canonical issue handoff is posted or preserved ready to post.
• The exact same-repository head will be deleted after merge; open or closed-unmerged/failed heads are preserved unless an owner explicitly retires them.