OSS readiness: community health files, project status, scheduled settings audit

[adamXbot]

Summary

Fills the gaps a first-time visitor or contributor currently hits. None of these files existed before.

File	What it covers
CONTRIBUTING.md	Prerequisites, command table, what CI enforces, easy-to-miss conventions
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
SUPPORT.md	Where to ask what, and what information actually helps
.github/PULL_REQUEST_TEMPLATE.md	Verification-focused checklist
.github/CODEOWNERS	@AdamXweb + expensive-to-get-wrong paths
CHANGELOG.md	Published for the first time

Plus README gains Project status (beta, per-platform support table, release/versioning policy) and a Contributing section.

Notable choices

• CONTRIBUTING documents the things that actually break builds: the a11y gate is blocking and its known-issue allowlist must stay empty; copy goes through locales/en.json; Renovate owns dependency bumps; and the Playwright-reuses-:3000 trap that has cost real debugging time.
• The Code of Conduct routes reports through GitHub's private channels (private vulnerability reporting, a DM to the maintainer, GitHub abuse reporting) rather than an email address, because the project doesn't publish one. Worth swapping for a real address if you'd like one — that's the one line here I'd flag for your judgement.
• CHANGELOG covers v0.1.0–v0.1.2 retrospectively from the release notes, summarised rather than pasting the Dependabot PR lists. The Unreleased section already covers this branch's accessibility, security, and first-run work.
• CODEOWNERS documents reality — main is admin-protected, so @AdamXweb is the only account that can merge anyway.

Scheduled settings audit

scripts/audit-github-settings.mjs existed but nothing ever ran it. .github/workflows/repo-settings-audit.yml now runs it weekly and writes the report to the job summary.

Two deliberate design points, both documented in the workflow header:

• Advisory on cron, strict on demand. A scheduled job that goes red every week for a setting nobody intends to change is a job people learn to ignore. The cron leg always exits 0; run it manually with strict: true for a hard pass/fail.
• It wants a REPO_AUDIT_TOKEN. GITHUB_TOKEN cannot read branches/main/protection (needs repo-admin), so without a fine-grained PAT (administration:read) that half of the report reads as unreadable rather than passing. The workflow emits a ::notice:: when the secret is absent so it's never silently misleading. Same class of problem as RENOVATE_TOKEN.

Screenshot capture script

scripts/capture-screenshots.mjs (pnpm screenshots) captures a consistent set of UI shots — apps grid, app detail mid-diff, dashboard risk sections, privacy map, and a phone-width view — against the canned demo fixture.

docs/screenshots/ is gitignored: the images are for docs, issues, and release notes rather than repo weight, and a checked-in set would be stale by the next UI change. The script is the durable part. It applies the Strict privacy profile so the mismatch badges mean something, and disables the coachmark tour — without that the dashboard shot is a dimmed spotlight overlay.

Verification

• Both workflow YAMLs parse; the audit script was run live against this repo and produces its report correctly (it currently flags 5 settings — see below).
• Every relative markdown link across the new and edited files resolves.
• pnpm typecheck clean, 441 unit tests pass; the capture script lints clean and was exercised end-to-end.
• AGENTS.md gains a section on both topics, and its stale "all six GitHub workflows" line is corrected — there are ten; six install dependencies.

Heads-up from the live audit run: it reports Dependabot security updates, secret scanning, and push protection as not enabled, and can't read branch protection with the current token. Some of that is the token scope; some may be real. Worth a look in repo settings once this merges.

🤖 Generated with Claude Code

[adamXbot]

Pushed 56f9f24 — the screenshots half of this phase.

The README's screenshots section has been a TODO comment since the repo opened. It now carries four real captures (apps grid as the hero, an app detail page mid-diff, the dashboard's risk sections, the privacy map) plus a phone-width shot behind a disclosure.

Committed alongside them: scripts/capture-screenshots.mjs (pnpm screenshots). A one-off set of PNGs would be stale by the next UI change, so the capture is reproducible instead. It seeds the canned demo fixture (never real data), applies the Strict privacy profile so the mismatch badges actually show something, and disables the coachmark tour — without that last step the dashboard shot is just a dimmed spotlight overlay.

Two capture quirks are now comments in the script rather than lore: scrollIntoViewIfNeeded() silently no-ops when the target is already partly visible (which left the first-run checklist filling the dashboard shot), and the phone shot is taken at the top of the page because mid-scroll the sort pills bleed through the translucent nav.

Verified by deleting every PNG and regenerating the committed set from scratch with the committed script.

🤖 Generated with Claude Code

[adamXbot]

Screenshots pulled from this PR (ce258a0, force-pushed).

The branch was rewritten rather than given a delete-commit, so the PNGs aren't in its history at all — nothing to carry into main. Verified: no image blobs anywhere in origin/main..HEAD.

What changed from the previous push:

• docs/screenshots/*.png — gone, and the directory is now gitignored so captures never land in the repo by accident.
• README — the screenshots gallery and hero image are reverted to the original placeholder comment. The new quick-links row (Install for macOS · Run with Docker · Documentation) stays, since that's a README improvement independent of the images.
• scripts/capture-screenshots.mjs — kept, reframed as a general capture tool for docs/issues/release notes rather than "regenerate the README shots". It's self-contained, produces only gitignored output, and is genuinely useful for anyone wanting a consistent set. Say the word if you'd rather it came out too and I'll drop it along with its CONTRIBUTING/CHANGELOG/AGENTS references.

🤖 Generated with Claude Code

[adamXbot]

Cherry-picked the postcss advisory fix onto this branch so it goes green independently of merge order — see #141 for the full diagnosis.

Short version: a new PostCSS advisory (GHSA-r28c-9q8g-f849, fixed in 8.5.18) turned the quality job red on every open PR and on main's Docker publish, with nobody having changed code. The existing ^8.5.12 override wasn't enough — a caret is not a floor that moves, and the lockfile had resolved the vulnerable 8.5.17.

If #141 merges first, this commit drops out cleanly on rebase (identical patch).

🤖 Generated with Claude Code