Make CineTrace release evidence inspectable

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Report a reproducible CineTrace failure or false verdict.
+title: "[bug] "
+labels: [bug]
+body:
+  - type: textarea
+    id: observed
+    attributes:
+      label: What happened?
+      description: Include the command, exit code and unexpected verdict.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What should have happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Link a public fixture or paste the smallest safe example.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: CineTrace 0.3.0, Node 22, Chromium 151, macOS arm64
+    validations:
+      required: true
+  - type: checkboxes
+    id: security
+    attributes:
+      label: Security check
+      options:
+        - label: This report does not disclose a vulnerability or private target data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/evanpaul90/cinetrace/security/advisories/new
+    about: Report vulnerabilities without disclosing them publicly.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Oracle proposal
+description: Propose a new machine-checkable failure condition.
+title: "[oracle] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: failure
+    attributes:
+      label: What real failure should CineTrace catch?
+      description: Describe the user-visible or structural failure, not only an implementation idea.
+    validations:
+      required: true
+  - type: textarea
+    id: oracle
+    attributes:
+      label: Proposed oracle
+      description: State the machine-checkable pass/fail condition.
+    validations:
+      required: true
+  - type: textarea
+    id: controls
+    attributes:
+      label: Clean and mutated controls
+      description: Explain how a clean fixture passes and a deliberate mutation fails.
+    validations:
+      required: true
+  - type: textarea
+    id: boundary
+    attributes:
+      label: Evidence boundary
+      description: What must this check not claim to prove?
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## Failure or opportunity
+
+Describe the behaviour this change addresses.
+
+## Evidence
+
+- [ ] Clean fixture passes
+- [ ] Deliberate mutation fails for the intended reason
+- [ ] `npm test` passes in the affected engines
+- [ ] `npm run evidence:verify` passes
+- [ ] Evidence boundaries remain accurate
+
+## Public contract
+
+List any CLI, adapter, schema, report or package-surface change. Write `none` when unchanged.

.github/workflows/pages.yml

@@ -0,0 +1,40 @@
+name: pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - docs/**
+      - evidence/**
+      - .github/workflows/pages.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/configure-pages@v5
+      - name: Assemble public evidence site
+        run: |
+          mkdir -p _site/evidence
+          cp -R docs/. _site/
+          cp evidence/*.json evidence/*.mjs evidence/SHA256SUMS _site/evidence/
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: _site
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/test.yml

@@ -21,5 +21,6 @@ jobs:
       - run: npm ci
       - run: npx playwright install --with-deps chromium firefox webkit
       - run: npm test
+      - run: npm run evidence:verify
       - run: npm audit --audit-level=moderate
       - run: npm pack --dry-run

CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 0.3.0 - 2026-09-02
+
+- Added deterministic same-build control runs with screenshot, state, environment and oracle
+  fingerprints.
+- Added pre-navigation adapter preparation for clocks, seeded randomness and public capture seams.
+- Added Firefox and WebKit coverage for the generic audit corpus.
+- Added forced WebGL failure, no-JavaScript, keyboard, overlay, reduced-motion and page-error checks.
+- Added explicit detection for late scroll-geometry mutation and screenshot-path collisions.
+- Published the exact Odessis production adapter, complete sanitized control reports, SHA-256
+  manifest and inspectable sample filmstrip.
+
+The project remains source-distributed. No npm package is published for this release.

CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# Code of conduct
+
+CineTrace contributors and maintainers commit to a respectful, harassment-free project space.
+
+## Expected behaviour
+
+- Discuss code, evidence and trade-offs without attacking people.
+- Give specific, reproducible feedback and accept correction when the evidence changes.
+- Respect different backgrounds, identities, experience levels and accessibility needs.
+- Keep private vulnerability reports and personal information private.
+
+Harassment, discriminatory language, threats, sustained disruption and publishing another person's
+private information are not accepted. Maintainers may edit or remove contributions and restrict
+participation when this policy is violated. Serious abuse should also be reported through GitHub's
+Report abuse mechanism so it can be handled privately.
+
+This policy applies in repository issues, pull requests, discussions and other project spaces.

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing to CineTrace
+
+CineTrace is a focused audit tool. Contributions should preserve deterministic evidence, honest
+scope boundaries and compatibility with Chromium, Firefox and WebKit.
+
+## Before opening a pull request
+
+1. Open an issue for a new oracle or report-contract change so its failure condition can be agreed
+   before implementation.
+2. Add one clean fixture and one deliberate mutation for any new oracle. A check without a known
+   failing control is not release evidence.
+3. Run the local release checks:
+
+   ```sh
+   npm ci
+   npx playwright install chromium firefox webkit
+   npm test
+   npm run evidence:verify
+   npm audit --audit-level=moderate
+   npm pack --dry-run
+   ```
+
+4. Keep product-specific adapters and proof outside the distributable package payload.
+5. Document evidence limits. Do not turn a sampled browser check into a claim about physical
+   devices, complete accessibility conformance or universal renderer behavior.
+
+Small bug fixes can go straight to a pull request. Explain the failure, the oracle that catches it
+and the evidence that proves the fix.

PROOF.md

@@ -100,6 +100,12 @@ same-build control. Both controls produced fingerprint `1273464af6848e6b` under
 `evidence/odessis-production-control-2026-09-02.json`; the exact public application adapter used by
 the command is preserved at `evidence/odessis-adapter.mjs`.
 
+The two complete sanitized reports are preserved as
+`evidence/odessis-production-control-run-1-report.json` and
+`evidence/odessis-production-control-run-2-report.json`. Sanitization changed only the private local
+adapter pathname to its public repository path. `evidence/SHA256SUMS` binds those reports, the
+adapter and the compact summary; `npm run evidence:verify` verifies the manifest.
+
 CineTrace's reverse, screenshot and control oracles were not weakened. The earlier premature green
 remains invalid evidence; the final result passed only after the target's real readiness and
 determinism defects were corrected.
@@ -109,7 +115,7 @@ determinism defects were corrected.
 - `npm audit --audit-level=moderate`: 0 vulnerabilities
 - `node --check` on every source file: PASS
 - `report.schema.json` JSON syntax: PASS
-- `npm pack --dry-run`: PASS, 10 distributable files, 20.4 kB packed / 72.0 kB unpacked
+- `npm pack --dry-run`: PASS, 10 distributable files, 20.9 kB packed / 73.5 kB unpacked
 - Product-coupling scan over the distributable package payload: no Odessis references
 - Readiness scan: no `networkidle` dependency
 - `git diff --check`: PASS

README.md

@@ -1,7 +1,15 @@
 # CineTrace
 
+[![test](https://github.com/evanpaul90/cinetrace/actions/workflows/test.yml/badge.svg)](https://github.com/evanpaul90/cinetrace/actions/workflows/test.yml)
+[![license: MIT](https://img.shields.io/badge/license-MIT-2f7f73.svg)](LICENSE)
+[![Node 22+](https://img.shields.io/badge/node-%3E%3D22-35506b.svg)](package.json)
+
 CineTrace turns a progress-driven web experience into a deterministic filmstrip, then checks whether the experience remains structurally sound in both directions. It is a small, MIT-licensed Node 22+ CLI built on Playwright.
 
+[![Five real CineTrace checkpoints from the Odessis production audit](docs/assets/cinetrace-filmstrip.webp)](https://evanpaul90.github.io/cinetrace/)
+
+**[Inspect the live sample report](https://evanpaul90.github.io/cinetrace/)** · **[Read the raw production evidence](evidence/README.md)**
+
 It reports:
 
 - horizontal overflow, including likely offending elements;
@@ -17,10 +25,15 @@ It reports:
 
 ## Install and run
 
+The npm name is reserved for a future package release but is **not published today**. Run the
+tagged source release directly:
+
 ```sh
-npm install
+git clone --depth 1 --branch v0.3.0 https://github.com/evanpaul90/cinetrace.git
+cd cinetrace
+npm ci
 npx playwright install chromium firefox webkit
-npx cinetrace audit https://example.test \
+node src/cli.js audit https://example.test \
   --viewports desktop,mobile \
   --steps 15 \
   --reverse \
@@ -130,10 +143,17 @@ The test corpus proves native-scroll checkpoint accuracy, bounded readiness with
 
 ## Production evidence
 
-The repository includes the exact public adapter and a machine-readable summary for the 2 September
-2026 Odessis production control under `evidence/`. That audit covered five checkpoints forward and
-reverse at desktop and phone-sized viewports, repeated the entire run in a fresh same-build control,
-and returned zero defects with matching fingerprint `1273464af6848e6b`. `PROOF.md` records both the
+The repository includes the [exact public adapter](evidence/odessis-adapter.mjs),
+[machine-readable summary](evidence/odessis-production-control-2026-09-02.json), complete sanitized
+[run 1](evidence/odessis-production-control-run-1-report.json) and
+[run 2](evidence/odessis-production-control-run-2-report.json) reports, and a checked
+[SHA-256 manifest](evidence/SHA256SUMS). That audit covered five checkpoints forward and reverse at
+desktop and phone-sized viewports, repeated the entire run in a fresh same-build control, and
+returned zero defects with matching fingerprint `1273464af6848e6b`.
+
+The [live sample report](https://evanpaul90.github.io/cinetrace/) uses five unaltered frames from
+that production audit. The `v0.3.0` GitHub Release carries the complete evidence bundle, including
+all 40 original PNG captures and both generated static reports. [PROOF.md](PROOF.md) records both the
 passing evidence and the earlier premature green result that CineTrace rejected after a longer audit
 crossed a real late-layout mutation.
 

SECURITY.md

@@ -0,0 +1,19 @@
+# Security policy
+
+## Supported version
+
+Security fixes are applied to the latest tagged release. CineTrace is currently in the 0.x series,
+so fixes may ship with a minor version change.
+
+## Report a vulnerability
+
+Do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting form:
+
+https://github.com/evanpaul90/cinetrace/security/advisories/new
+
+Include the affected version, a minimal reproduction, impact and any suggested mitigation. You can
+expect an acknowledgement within five business days. No bounty programme is currently offered.
+
+Project adapters are executable JavaScript supplied by the operator and run with the local Node and
+browser permissions of the CineTrace process. Only run adapters you trust. CineTrace is a local CLI,
+not a hosted URL-scanning service.

docs/.nojekyll

@@ -0,0 +1 @@
+