[immakermatty]

Status: ready for review. #65 and #66 are merged; this is rebased on main d93de8d. Plan DEV-6646, phase B1 of the fork cleanup (task 2026-10-13-712).

Why

Root decision 0200 of the Lazurio project names this distribution "Lazurio T3 Code": a modified distribution of T3 Code, the T3 Code mark kept, "T3 Code (Lazurio)" in the app. Today the repository shows upstream's README, so a visitor cannot tell what this repository is, how it differs from T3 Code, or where to report a problem. That last point matters, because a problem with the overlay should not reach the T3 Code team.

What changes

.github/README.md, a new file. GitHub shows it in place of the root README.md, which stays byte-equal to upstream. Its sections:

• What it is. A modified distribution of T3 Code and the Chat app of Lazurio; not an official T3 Code release.

• How it differs. The Environment browser first: in the web client the right panel shows a thread's tabs of the Environment's one shared Chromium, and the desktop app keeps its own browser. Then:

  • the Lazurio Folder project;
  • the name and the light look on a Lazurio Environment (release, web, docs: the distribution Lazurio T3 Code, the in-app name T3 Code (Lazurio) and the design system's light look (root 0200) #66);
  • the shell;
  • prepared prompts;
  • hosting behind a reverse proxy;
  • updates from this repository.

  Apart from the name, each change stays off without its setting or a Lazurio Environment.

• Tracking upstream. main is an upstream stable tag with the overlay commits on top.

• Releases. The stable and preview channels, and what each release carries.

• Reporting issues. Report here, not to the T3 Code team. Security problems go privately, through the Security tab.

• Credit and license. T3 Code by T3 Tools Inc. and its contributors, MIT.

The fork's security policy (.github/SECURITY.md, commit 2). GitHub shows this file on the Security tab beside "Report a vulnerability". Upstream's text sent every report to the T3 Code team, which competed with the README. The policy now starts with the distribution's route: report privately here. A problem that also affects upstream T3 Code goes to the T3 Code team too. Upstream's text stays below, word for word, under "Upstream T3 Code".

The runbook (commit 3) counts both files among the distribution's files (Overlay row 5, the target stack) for the rebuild on a new upstream release.

What deliberately does not change

• Upstream's root README.md and issue forms; upstream's security text, which stays word for word in its own section.
• Repository settings are not part of this PR. They were set on 2026-10-13 under the plan's D6 and D7: private vulnerability reporting is enabled, and the Security tab shows "Report a vulnerability". The description is "Lazurio T3 Code: a modified distribution of T3 Code for Lazurio Environments", with the Releases page as the homepage.

Verification

• vp fmt --check on the README, the policy and the runbook: correct format.
• Every line of the README and the policy is 100 characters or shorter.
• The release contract test: 29/29.
• No organization or person names.
• The links are relative to .github/ (../LICENSE, ../README.md) or absolute to this repository's Releases and Issues pages.

🤖 Generated with Claude Code

[agentrozjedemeai]

Blocking documentation mismatch on exact head 1d0305fa1eae9d96d45c69cde9eb82696459baa6: .github/README.md:91-92 directs vulnerability reporters to this repository’s private Security-tab form, but this branch and current main still contain .github/SECURITY.md:3-7, which directs T3 Code security reports and the reader of that same Security tab to the upstream team at security@ping.gg and links upstream’s policy. Those are competing destinations for fork vulnerabilities. Turning on private vulnerability reporting at merge (D7) does not update the policy. Please align the fork’s Security-tab policy with the README (either in this PR or a prerequisite PR merged before #67), while preserving a clear upstream-only route, and verify private reporting is enabled before the public README is published.

Otherwise the one-file change is scoped: the root README is byte-identical, relative links resolve from .github/, all 99 lines are <=100 characters, and the Folder-off behavior on merged #65 plus the name and standard-light-theme gate in #66 (d2d85a96cad8cb72c5e90046d7ea088b1e688622) match the text. AGENT_BROWSER_SESSION is unconditionally injected but by itself grants no browser access. This review does not authorize merging before #66 or the repository-setting gate.

[agentrozjedemeai]

@immakermatty Re-review of exact head 4848f18 on main d93de8d: the prior security-routing blocker is fixed. .github/README.md and .github/SECURITY.md both route fork vulnerabilities to this repository’s private Report a vulnerability form; the upstream-only route remains under its own heading, with the upstream policy body byte-exact. Private vulnerability reporting is enabled (live API). The runbook assigns both files to overlay row 5 and the rebuild stack. The root README and LICENSE are unchanged; local release contract 29/29, diff --check clean, both public documents at most 99 characters per line. Current-head CI has four passing checks and one skipped check; no unresolved review threads. Approved as a documentation-only change; canary verification remains a separate post-merge gate.