diff --git a/.github/workflows/community-health-invariants.yml b/.github/workflows/community-health-invariants.yml
new file mode 100644
index 0000000..17f95db
--- /dev/null
+++ b/.github/workflows/community-health-invariants.yml
@@ -0,0 +1,28 @@
+name: Community Health Invariants
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-community-health:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '20.11.0'
+
+      - name: Validate shared community-health invariants
+        run: node scripts/validate-community-health.mjs
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9a575b8..74e24bd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,7 +2,7 @@
 
 This document describes how to contribute to Riverbraid public repositories.
 
-It is a community health surface only. It does not create governance authority, maintainer capacity, guaranteed response times, legal approval, certification, production readiness, or external validation.
+It is a community-health surface only. It does not create governance authority, maintainer capacity, guaranteed response times, legal approval, certification, production readiness, or external validation.
 
 ## Contribution posture
 
@@ -10,40 +10,72 @@ Riverbraid prioritizes bounded, inspectable, evidence-preserving changes.
 
 Preferred contributions are:
 
-- Documentation corrections
-- Claim boundary fixes
-- Reproduction notes
-- Verification failure reports
-- Surface coherence improvements
-- Small, reviewable pull requests
-- Issues that separate observed facts from interpretation
+- documentation corrections;
+- claim-boundary fixes;
+- reproduction notes;
+- verification-failure reports;
+- surface-coherence improvements;
+- small, reviewable pull requests;
+- issues that separate observed facts from interpretation.
+
+## Read before contributing
+
+Review the shared policies that apply where the receiving repository does not provide a narrower rule:
+
+- `GOVERNANCE.md` — authority and disposition;
+- `MAINTAINERS.md` — current authority map;
+- `INBOUND_CONTRIBUTION_RIGHTS.md` — contributor rights and licensing representations;
+- `PULL_REQUEST_TEMPLATE.md` — change, evidence, and claim-boundary fields;
+- `SECURITY.md` — sensitive reporting route;
+- `SUPPORT.md` — issue routing;
+- `FORKING.md` — provenance and authority for adaptations;
+- `SUPPORTED_VERSIONS.md` — source-bound support posture;
+- `RELEASE_AND_COMPATIBILITY.md` — release, comparison, and compatibility rules.
+
+Repository-specific guidance governs within its declared scope.
 
 ## Before opening a pull request
 
 Check whether the change affects:
 
-- Protocol semantics
-- Verification commands
-- Registry entries
-- Workflow behavior
-- Hashes or seals
-- Public claims
-- Repository lifecycle status
+- protocol semantics;
+- verification commands, expected results, or verification depth;
+- registry entries, pins, manifests, or source identities;
+- workflow behavior or action identity;
+- dependencies, environments, locks, or network behavior;
+- schemas, machine contracts, or comparison contracts;
+- hashes, seals, evidence, or provenance;
+- public claims or nonclaims;
+- governance, authority, or maintainer scope;
+- security, privacy, access, or disclosure;
+- repository lifecycle, release, compatibility, or supersession status;
+- the proposed F0–F4 control package.
+
+If it touches any of those, clearly state the exact impact and required authority in the pull request body.
 
-If it touches any of those, clearly state the impact in the pull request body.
+Use `PULL_REQUEST_TEMPLATE.md` where GitHub applies the shared account default.
 
 ## Pull request scope
 
-Use small pull requests with a clear scope.
+Use small pull requests with a clear subject and boundary.
 
 A good pull request states:
 
-- What changed
-- Why it changed
-- What did not change
-- Whether code, workflow, registry, verifier, hash, seal, or protocol behavior changed
+- what changed;
+- why it changed;
+- the exact base and proposed subject;
+- what did not change;
+- tests and observations performed;
+- negative, blocked, unavailable, malformed, or degraded cases;
+- evidence not yet available;
+- supported and refused claims;
+- authority or further disposition required;
+- whether code, workflow, registry, verifier, schema, environment, hash, seal, authority, or protocol behavior changed;
+- rollback, supersession, recovery, and re-entry notes where material.
+
+Do not delete a template section merely because a result is inconvenient. Use `NOT_APPLICABLE` with a short reason when appropriate.
 
-## Suggested pull request boundary block
+## Suggested boundary block
 
 ```text
 Scope:
@@ -54,28 +86,76 @@ No registry changes.
 No verifier changes.
 No hash or seal changes.
 No protocol changes.
+No adoption or gate advancement.
 ```
 
-Adjust this block if the pull request actually changes one of those surfaces.
+Adjust the block when the pull request actually changes one of those surfaces.
+
+## Evidence rule
+
+A successful check applies only to the exact source, configuration, commands, environment, and verification depth observed.
+
+Do not present:
+
+- file presence as execution;
+- execution as correctness;
+- self-execution as independent reproduction;
+- one component pass as an integrated or account-wide pass;
+- a historical result as automatically current;
+- a merge as adoption or F0–F4 gate advancement.
+
+When a technical claim is made, preserve an attributable command, source identity, environment, result, and limitation record sufficient for review.
+
+## Inbound rights and licensing
+
+`INBOUND_CONTRIBUTION_RIGHTS.md` is the shared policy candidate for authorship, licensing, third-party material, generated content, provenance, and acceptance boundaries.
+
+Its current posture is:
+
+- no separate Contributor License Agreement is required by default;
+- no Developer Certificate of Origin sign-off is required by default;
+- contributors must have the right to submit their material;
+- accepted contributions are provided under the target repository's applicable license unless that repository declares a narrower policy;
+- third-party and materially tool-generated inputs must be disclosed where relevant;
+- submission or merge does not transfer Riverbraid governance or maintainer authority.
+
+If the target repository has no clear license, or the contribution cannot be distributed under that license, stop and open a licensing issue before submitting the change.
+
+This policy is not legal advice or a completed legal review.
 
 ## Issues
 
 Use issues for:
 
-- Reproduction failures
-- Documentation mismatch
-- Inconsistent metadata
-- Broken links
-- Verification ambiguity
-- Claim boundary problems
-- Public surface coherence issues
+- reproduction failures;
+- documentation mismatch;
+- inconsistent metadata;
+- broken links;
+- verification ambiguity;
+- claim-boundary problems;
+- public-surface coherence issues;
+- licensing or provenance uncertainty;
+- bounded compatibility or lifecycle questions;
+- requests for a private security-reporting route without sensitive details.
+
+Do not publish vulnerability details, credentials, secrets, private keys, personal data, or unredacted exploit information in public issues. Follow `SECURITY.md`.
+
+## Governance and forks
+
+A contribution does not adopt the F0–F4 control package, advance a gate, refresh the Evaluation Kit registry, establish independent review, appoint a maintainer, or transfer protocol or release authority unless the required attributable authority and evidence are present.
 
 ## Conduct
 
 Contributions should be factual, bounded, and respectful.
 
-Do not use issues or pull requests to imply unsupported maturity, adoption, certification, legal approval, production readiness, external audit, complete AI safety, absolute security, or absence of defects.
+Do not use issues or pull requests to imply unsupported maturity, adoption, certification, legal approval, production readiness, external audit, complete AI safety, absolute security, full-constellation operation, or absence of defects.
+
+## Acceptance boundary
+
+Submission does not guarantee review, acceptance, support, attribution format, or response time.
+
+A merge does not automatically appoint the contributor as a maintainer, transfer registry or protocol authority, establish independent review, or support claims beyond the evidence actually reviewed.
 
 ## Boundary
 
-This guide does not guarantee review, acceptance, support availability, response time, or maintenance capacity.
+This guide does not guarantee review, acceptance, support availability, response time, maintenance capacity, legal sufficiency, compatibility, security coverage, or future project direction.
\ No newline at end of file
diff --git a/FORKING.md b/FORKING.md
new file mode 100644
index 0000000..71722a0
--- /dev/null
+++ b/FORKING.md
@@ -0,0 +1,78 @@
+# Forking and Adaptation Policy
+
+Riverbraid repositories may be forked and adapted under each repository's applicable license.
+
+## Core rule
+
+A fork inherits source history and license obligations. It does **not** automatically inherit Riverbraid authority, identity, registry membership, verification results, adoption state, endorsement, or evidence continuity.
+
+## Required distinctions
+
+A public fork or adaptation should state:
+
+- upstream repository and exact source commit;
+- fork or adaptation name;
+- files and behavior changed;
+- whether upstream tests were rerun;
+- whether new tests or evidence exist;
+- which upstream claims still apply unchanged;
+- which claims are no longer applicable;
+- who now owns maintenance and security response;
+- whether the fork remains compatible with any Riverbraid profile.
+
+## Naming and presentation
+
+A fork may accurately say that it is derived from Riverbraid.
+
+It must not imply that it is:
+
+- the canonical Riverbraid repository;
+- an adopted Riverbraid profile;
+- included in the Evaluation Kit registry;
+- verified by upstream results after material changes;
+- maintained, approved, endorsed, certified, or audited by Riverbraid;
+- entitled to use upstream evidence as proof of changed bytes or behavior.
+
+Materially divergent adaptations should use a distinct name and prominent provenance statement.
+
+## Evidence continuity
+
+Upstream evidence remains attributable only to the exact upstream subject it assessed.
+
+After a fork changes code, configuration, dependencies, workflows, registry entries, environment locks, expected results, schemas, hashes, seals, or claim boundaries, the fork must create new evidence for those changed surfaces.
+
+Copying an evidence file does not transfer the truth of the evidence to a new subject.
+
+## Registry and profile relationship
+
+A fork is not part of the Riverbraid Evaluation Kit registry or any future F3/F4 functional core unless an authorized process explicitly admits and pins it.
+
+Compatibility may be claimed only at the tested level and under the observed environment.
+
+## Security and support
+
+Fork maintainers are responsible for their own:
+
+- security reporting route;
+- dependency and workflow review;
+- releases and tags;
+- incident response;
+- legal and compliance decisions;
+- user support;
+- claim boundaries.
+
+Riverbraid does not guarantee support for forks or adaptations.
+
+## Contribution back upstream
+
+Changes proposed upstream should be submitted as small, reviewable pull requests that preserve provenance and disclose:
+
+- the fork commit where the change originated;
+- the upstream base;
+- tests performed;
+- evidence and limitations;
+- any license or third-party contribution considerations.
+
+## F0–F4 boundary
+
+Forking, copying, or publishing the proposed F0–F4 control package does not adopt or execute it. Adoption and gate advancement remain subject to the authority and evidence rules of the applicable control records.
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
new file mode 100644
index 0000000..f9bc88d
--- /dev/null
+++ b/GOVERNANCE.md
@@ -0,0 +1,141 @@
+# Riverbraid Governance
+
+**Governance model:** Founder-led, evidence-constrained, forkable  
+**Account type:** GitHub user account  
+**Current protocol authority:** Riverbraid-Core  
+**Public evaluation authority:** Riverbraid-Evaluation-Kit for its exact pinned profile  
+**F0–F4 status:** Proposed, not adopted, not executed
+
+## Purpose
+
+This file explains how Riverbraid decisions are made without converting historical authorship, repository access, file presence, or technical contribution into current authority.
+
+## Governing principles
+
+Riverbraid governance follows these rules:
+
+- evidence precedes claims;
+- missing required evidence fails closed;
+- authority must be explicit, attributable, scoped, and current;
+- repository visibility is not registry membership;
+- registry membership is not equal verification depth;
+- verification is not adoption;
+- adoption is not execution;
+- execution is not external review;
+- history is preserved rather than silently rewritten;
+- founder authorship must not require permanent founder dependency for ordinary continuation;
+- forks remain permitted, but forked claims and authority do not inherit automatically.
+
+## Current authority model
+
+### Founder authority
+
+The Riverbraid founder retains final disposition authority for:
+
+- adoption or supersession of protocol-defining control records;
+- changes to the F0–F4 gate definitions or claim ceilings;
+- registry succession where a current record reserves that decision;
+- changes that materially alter Riverbraid's public identity or governing purpose;
+- exceptional conflict or succession dispositions not already delegated.
+
+Founder authority does not convert unperformed work into evidence and cannot declare a technical PASS contrary to observed results.
+
+### Protocol authority
+
+`Riverbraid-Core` defines current public protocol terminology and audit-floor semantics within its declared claim boundary.
+
+A Core file does not become controlling merely because it exists. Applicability depends on its declared status, exact source identity, adoption state where required, and relationship to other controlling records.
+
+### Evaluation authority
+
+`Riverbraid-Evaluation-Kit` defines the public pinned evaluation profile for its exact registry, commands, expected results, environment contract, and claim ceiling.
+
+A successful Evaluation Kit run applies only to the exact observed subject and does not establish registry freshness, equal verifier depth, independent reproduction, adoption, or full-account operation.
+
+### Repository maintenance authority
+
+Repository maintainers may review and merge changes within the authority already delegated to that repository.
+
+Maintenance authority does not by itself authorize:
+
+- protocol redefinition;
+- registry succession;
+- F0–F4 adoption or gate advancement;
+- certification or production-readiness claims;
+- deletion or rewriting of required historical evidence.
+
+### Evidence and review roles
+
+A contributor, reviewer, evaluator, or evidence recorder may produce attributable findings and recommendations.
+
+Those roles do not automatically carry disposition authority. An evidence producer must not approve their own result as independent review.
+
+## Decision classes
+
+Every material decision should identify its class:
+
+- `TECHNICAL_DETERMINATION` — resolved by source inspection, deterministic validation, or execution evidence;
+- `BOUNDED_MAINTENANCE_DECISION` — resolved by an authorized maintainer within an existing claim boundary;
+- `FOUNDER_DISPOSITION` — reserved for adoption, scope, identity, succession, or other explicitly retained authority;
+- `EXTERNAL_OR_INDEPENDENT_DISPOSITION` — requires a distinct reviewer or operator under declared independence conditions;
+- `NOT_YET_DECIDABLE` — required evidence or authority is absent.
+
+No decision may be upgraded merely to satisfy a schedule.
+
+## Change process
+
+Material pull requests should state:
+
+1. exact subject and scope;
+2. authority affected;
+3. files and behaviors changed;
+4. tests or observations performed;
+5. evidence not yet available;
+6. allowed and refused claims;
+7. rollback or reconstitution path where material;
+8. whether founder, maintainer, or independent disposition is required.
+
+Changes affecting protocol semantics, registry pins, verifier commands, evidence formats, claim ceilings, workflows, environment locks, hashes, seals, releases, or lifecycle status require explicit review of those surfaces.
+
+## Adoption and execution boundary
+
+A proposal is not adopted until the required authority performs an attributable adoption act.
+
+An adopted record is not executed until the required actions occur and execution evidence exists.
+
+No pull request, successful workflow, issue closure, or file merge may silently adopt the F0–F4 control package or advance P0, F0, F1, F2, F3, or F4.
+
+## Conflict and appeal
+
+When sources conflict:
+
+1. preserve both source identities;
+2. identify applicability, authority, freshness, and supersession state;
+3. stop claim expansion;
+4. open an attributable issue or fault record;
+5. obtain the required disposition rather than selecting the more convenient source.
+
+## Succession and continuity
+
+Riverbraid should remain understandable, forkable, and maintainable without continuous founder intervention.
+
+A future succession record should identify:
+
+- successor authority;
+- scope and effective time;
+- transferred and retained powers;
+- custody of keys, evidence, registries, and release processes;
+- re-entry and rollback procedures;
+- public notice and supersession links.
+
+Until such a record exists, no contributor should infer succession from inactivity, repository access, or historical contribution.
+
+## Forkability
+
+Forks are permitted under the licenses of the applicable repositories.
+
+A fork must not imply inherited Riverbraid authority, registry membership, verification, adoption, endorsement, or evidence continuity. See `FORKING.md`.
+
+## Non-claims
+
+This governance file does not establish a legal entity, board, staffed maintainership program, service level, certification body, external audit, production-readiness authority, or automatic succession.
diff --git a/INBOUND_CONTRIBUTION_RIGHTS.md b/INBOUND_CONTRIBUTION_RIGHTS.md
new file mode 100644
index 0000000..a45bfa5
--- /dev/null
+++ b/INBOUND_CONTRIBUTION_RIGHTS.md
@@ -0,0 +1,77 @@
+# Inbound Contribution Rights Policy
+
+**Status:** Shared public contribution policy candidate  
+**Applies through GitHub inheritance only where the receiving repository does not provide a narrower policy**
+
+## Purpose
+
+Riverbraid must be able to accept useful contributions without creating uncertainty about authorship, licensing, third-party material, generated content, or the authority created by a merge.
+
+## Contributor representations
+
+By submitting a pull request, patch, issue attachment, or other proposed contribution, the contributor represents that:
+
+1. they created the contribution or otherwise have the right to submit it;
+2. they may license it under the receiving repository's applicable license;
+3. third-party code, text, data, media, specifications, and generated material are identified with their source and applicable license or usage terms;
+4. the contribution does not knowingly include secrets, credentials, private keys, confidential information, unlawfully disclosed personal data, or material they are not permitted to publish;
+5. material limitations affecting authorship, provenance, security, privacy, or verification are disclosed;
+6. the contribution does not intentionally misrepresent tests, evidence, authority, adoption, compatibility, or current applicability.
+
+## License relationship
+
+Unless a receiving repository states otherwise, accepted contributions are provided under that repository's existing license or licenses.
+
+No separate contributor license agreement is currently required by this shared policy. No Developer Certificate of Origin sign-off is currently required unless a repository adopts that requirement explicitly.
+
+This policy does not transfer trademarks, personal publicity rights, patent rights beyond those provided by the applicable repository license, or authority over Riverbraid governance.
+
+## Tool-assisted and generated contributions
+
+AI-assisted, generated, translated, or mechanically transformed material is not prohibited. The contributor remains responsible for:
+
+- the right to submit it;
+- review of its accuracy and security;
+- disclosure of material source or tool involvement when relevant;
+- identifying copied or third-party material;
+- ensuring that generated output does not fabricate evidence, provenance, tests, authority, or licensing.
+
+Tool output is not automatically independent review or original evidence.
+
+## Evidence and provenance
+
+A contributor should preserve enough provenance for a reviewer to understand:
+
+- the upstream or base source;
+- the change introduced;
+- tests or observations performed;
+- third-party inputs;
+- generated transformations;
+- known limitations;
+- the exact subject to which any result applies.
+
+Copied evidence does not transfer its result to changed source bytes or behavior.
+
+## Acceptance and authority boundary
+
+Submission does not guarantee review, acceptance, attribution format, support, or response time.
+
+Acceptance or merge means only that the contribution entered the receiving repository under its applicable authority and license. It does not automatically:
+
+- adopt the F0–F4 control package;
+- advance a gate;
+- appoint the contributor as a maintainer;
+- transfer registry, release, security-response, or protocol authority;
+- establish independent review;
+- certify the contribution or the resulting repository;
+- validate claims beyond the evidence actually reviewed.
+
+## Repository-specific overrides
+
+A repository may adopt a narrower or stronger inbound-rights policy, including a DCO, CLA, provenance form, data-use condition, or contribution restriction.
+
+The repository-specific policy governs within its declared scope. Conflicts or uncertainty must be disclosed before merge rather than resolved by assumption.
+
+## Review trigger
+
+Review this policy when Riverbraid adopts a DCO or CLA, accepts material external contributions, creates a legal entity, changes licensing, receives patent-sensitive contributions, or establishes additional maintainer authority.
\ No newline at end of file
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
new file mode 100644
index 0000000..5559582
--- /dev/null
+++ b/MAINTAINERS.md
@@ -0,0 +1,82 @@
+# Riverbraid Maintainers and Authority Map
+
+**Status:** Declarative current-state map  
+**As of:** 2026-07-27
+
+## Purpose
+
+This file distinguishes repository access, maintenance work, review, evidence production, protocol authority, and founder disposition.
+
+It does not create a team, employment relationship, guaranteed response capacity, or authority beyond the scopes declared below.
+
+## Current authority holders
+
+| Surface | Current authority | Scope | Exclusions |
+|---|---|---|---|
+| Founder disposition | Riverbraid founder / authenticated account owner | Adoption, identity, governing scope, reserved succession and exceptional dispositions | Cannot turn missing evidence into PASS |
+| Protocol semantics | `Riverbraid-Core` under its declared authority files | Current public protocol and audit-floor semantics | Does not control unrelated experimental behavior or establish adoption by existence |
+| Public pinned evaluation profile | `Riverbraid-Evaluation-Kit` | Exact registry, commands, expected results, environment contract, and claim ceiling | Does not establish freshness, equal depth, independence, or production readiness |
+| Constellation classification | `Riverbraid-Golds` | Role/lifecycle/registry/depth crosswalks within declared noncontrolling boundaries | Does not select the F3/F4 functional core |
+| Explanatory documentation | `Riverbraid-Documentation` | Human-readable context, limitations, crosswalks, and evidence references | Does not override protocol, registry, or execution evidence |
+| Shared community-health defaults | `Riverbraid/.github` | Default guidance and templates where GitHub inheritance applies | Does not prove per-repository inheritance or user-profile rendering |
+
+## Maintainer status
+
+The current public surface is founder-maintained.
+
+No additional individual or team is declared here as having independent merge, release, registry, security-response, or protocol authority.
+
+Repository collaborator permissions may exist for operational reasons, but permission is not equivalent to governing authority. Any future maintainer appointment should be recorded with:
+
+- GitHub identity;
+- repositories and paths covered;
+- authority type;
+- effective time;
+- review and revocation conditions;
+- whether release, registry, workflow, or security-setting authority is included;
+- conflict-of-interest and independent-review limits.
+
+## Authority types
+
+- `FOUNDATION_AUTHORITY` — governing purpose, adoption, scope, and reserved founder dispositions.
+- `PROTOCOL_AUTHORITY` — meaning and rules within an explicit protocol boundary.
+- `REGISTRY_AUTHORITY` — admission, pin, succession, and rollback authority for a declared registry.
+- `MAINTENANCE_AUTHORITY` — bounded repository changes and issue/PR disposition.
+- `RELEASE_AUTHORITY` — tags, releases, package publication, and release evidence.
+- `SECURITY_RESPONSE_AUTHORITY` — private intake, triage, disclosure, and remediation coordination.
+- `EVIDENCE_RECORDER` — produces attributable observations without automatically approving them.
+- `INDEPENDENT_REVIEWER` — performs a declared independent assessment and records limitations.
+
+One person or account may hold multiple roles, but each action must still identify the authority being exercised.
+
+## CODEOWNERS status
+
+`CODEOWNERS` is intentionally not declared by this file.
+
+Adding CODEOWNERS should occur only after:
+
+- maintainers beyond the founder are actually appointed;
+- path ownership matches real review capacity;
+- required-review settings are understood;
+- fallback and succession behavior are defined;
+- the file will not create a false automated-governance signal.
+
+## Review expectations
+
+Maintainers should reject or return changes that:
+
+- overstate available evidence;
+- combine or skip gates;
+- rewrite history without preservation;
+- treat file presence as verification;
+- hide failed or unavailable results;
+- silently alter authority, registry, environment, or claim ceilings;
+- imply certification, production readiness, external audit, or complete AI safety without evidence.
+
+## Availability boundary
+
+No response time, review time, security coverage, release cadence, or long-term maintenance capacity is guaranteed.
+
+## Review trigger
+
+Update this file when authority is appointed, removed, delegated, superseded, or materially changed; when the account becomes an organization; or when release/security responsibilities become operational.
diff --git a/PULL_REQUEST_TEMPLATE.md b/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..2992edb
--- /dev/null
+++ b/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,104 @@
+# Riverbraid Pull Request
+
+## Summary
+
+Describe the smallest complete change in plain language.
+
+## Exact subject and scope
+
+- **Repository or profile affected:**
+- **Base source identity or ref:**
+- **Primary files or surfaces changed:**
+- **Explicit exclusions:**
+
+## Change classification
+
+Check every applicable class.
+
+- [ ] Documentation or wording only
+- [ ] Code or executable behavior
+- [ ] Test, fixture, or evaluator behavior
+- [ ] Workflow or automation
+- [ ] Registry, manifest, or source identity
+- [ ] Schema, protocol, or comparison contract
+- [ ] Environment, dependency, or lock
+- [ ] Hash, seal, provenance, or evidence format
+- [ ] Governance, authority, or maintainer scope
+- [ ] Security, privacy, access, or disclosure boundary
+- [ ] Release, lifecycle, compatibility, or supersession state
+- [ ] Public claim or nonclaim
+
+## Authority and disposition
+
+- **Authority exercised:**
+- **Authority source:**
+- **Further disposition required:** `NONE` / `MAINTAINER` / `FOUNDER` / `INDEPENDENT_REVIEW` / `NOT_YET_DECIDABLE`
+- **Gate effect:**
+
+A pull request, merge, successful check, or issue closure does not silently adopt the F0–F4 control package or advance P0, F0, F1, F2, F3, or F4.
+
+## What changed
+
+Explain the implementation, including any changed interfaces, commands, outputs, identities, or failure behavior.
+
+## What did not change
+
+State the important neighboring surfaces that remain unchanged.
+
+## Evidence and validation
+
+- **Commands or checks run:**
+- **Exact source or commit tested:**
+- **Environment observed:**
+- **Artifacts or logs produced:**
+- **Positive result:**
+- **Negative, blocked, unavailable, malformed, or degraded cases:**
+- **What remains unverified:**
+
+Do not use a checkbox as a substitute for an attributable evidence identity when the change makes a technical claim.
+
+## Claim effect
+
+### Supported by this change
+
+State only the bounded claims directly supported by the changed source and available evidence.
+
+### Not supported by this change
+
+List refused claims, including any relevant limits on adoption, execution, independence, registry freshness, verification depth, portability, security, production readiness, certification, or external review.
+
+## Dependencies and composition
+
+- **Dependencies added, removed, or changed:**
+- **Cross-repository interfaces affected:**
+- **Component failures propagated visibly:** `YES` / `NO` / `NOT_APPLICABLE`
+- **Does this PR rely on another unmerged PR or mutable branch?**
+
+A passing component result must not be presented as an integrated or account-wide result without direct evidence for the composition.
+
+## Security, privacy, and disclosure
+
+- [ ] No secrets, credentials, private keys, personal data, or sensitive exploit details are included.
+- [ ] Raw and sanitized evidence remain distinct where sanitization occurred.
+- [ ] Any new network, permission, token, or external-service requirement is disclosed.
+- [ ] Sensitive vulnerability information was not placed in this public pull request.
+
+Describe any residual risk or disclosure limitation.
+
+## History, rollback, and recovery
+
+- **Historical records preserved:**
+- **Rollback or supersession path:**
+- **Recovery impact:**
+- **Reconstitution required:** `YES` / `NO` / `NOT_ASSESSED`
+
+## Contributor rights
+
+- [ ] I have read `INBOUND_CONTRIBUTION_RIGHTS.md`.
+- [ ] I have the right to submit this contribution under the repository's applicable license.
+- [ ] Third-party material and its license or source are identified.
+- [ ] Generated or tool-assisted material is disclosed when material to authorship, licensing, security, or verification.
+
+## Final boundary
+
+This pull request establishes only what its exact source changes and attributable evidence support. It does not imply certification, legal approval, production readiness, external audit, complete AI safety, full-constellation operation, universal applicability, or absence of defects.
\ No newline at end of file
diff --git a/README.md b/README.md
index 0f25c83..9e00ac0 100644
--- a/README.md
+++ b/README.md
@@ -1,30 +1,57 @@
-# Riverbraid Organization Configuration
+# Riverbraid GitHub Support Configuration
 
-This repository provides organization level profile and community health files for the Riverbraid public repository surface.
+This repository provides shared community-health files and profile candidates for the Riverbraid public repository surface.
 
-**Primary Entrance:** [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit)
+**Account type:** GitHub user account  
+**Primary evaluation entrance:** [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit)
 
-## Role
+## Account-surface boundary
 
-This repository supports the public Riverbraid GitHub profile. It is not a separate conceptual landing page and does not define Riverbraid protocol semantics.
+`Riverbraid` is currently a GitHub **user account**, not an organization.
 
-## Public Route
+GitHub displays a personal profile README only from a public repository named exactly `Riverbraid/Riverbraid` with a non-empty root `README.md`.
 
-The intended public route is:
+The file `profile/README.md` in this `.github` repository is the organization-profile convention. Under the current user-account structure, it must be treated as a profile candidate and documentation surface, not as proof that the Riverbraid account profile renders that content.
 
-1. GitHub profile
-2. Riverbraid-Evaluation-Kit
-3. Riverbraid-Documentation
-4. Domain specific Riverbraid repositories as needed
+`USER_PROFILE_README_CANDIDATE.md` contains the clean candidate text for a future `Riverbraid/Riverbraid/README.md` if that repository is created manually. Issue #6 records that account-level action.
 
-## Community Health
+## Current public route
 
-Organization level community health files in this repository may provide default contribution and security reporting guidance across public Riverbraid repositories.
+Until the personal profile repository exists, the mechanically available route is:
 
-## Authority Boundary
+1. Open `Riverbraid/.github` or another known Riverbraid repository.
+2. Follow the primary entrance to `Riverbraid-Evaluation-Kit`.
+3. Use `Riverbraid-Documentation` for explanatory and source-custody context.
+4. Inspect `Riverbraid-Core` or a domain repository as needed.
 
-Riverbraid-Core remains the normative source for protocol semantics. This repository does not replace code, test vectors, registry entries, signatures, seals, workflow evidence, or claim boundary documents.
+The intended future profile route is:
 
-## Non Claims
+```text
+Riverbraid user profile → Evaluation Kit → Documentation → Core or domain repository
+```
 
-This repository does not claim certification, production readiness, external audit, legal approval, complete AI safety, absolute security, or absence of defects.
+## Shared governance and community-health files
+
+- `GOVERNANCE.md` — founder-led authority, decision classes, adoption, succession, and conflict boundaries.
+- `MAINTAINERS.md` — current authority map and CODEOWNERS deferral.
+- `CONTRIBUTING.md` — review posture and links to the dedicated rights policy.
+- `INBOUND_CONTRIBUTION_RIGHTS.md` — authorship, licensing, third-party material, generated content, and acceptance boundaries.
+- `FORKING.md` — fork identity, evidence continuity, and non-inherited claims.
+- `RELEASE_AND_COMPATIBILITY.md` — release identity, compatibility classes, supersession, rollback, and supply-chain boundaries.
+- `SUPPORTED_VERSIONS.md` — exact source identity, current support posture, freshness, and non-support rules.
+- `SECURITY.md` — fail-closed sensitive-reporting route and private-intake limitations.
+- `SUPPORT.md` — bounded routing and availability limits.
+- `CODE_OF_CONDUCT.md` — conduct expectations.
+- `PULL_REQUEST_TEMPLATE.md` — evidence, authority, claim, dependency, rollback, security, contributor-rights, and F0–F4 checks.
+
+GitHub may use supported files from this public `.github` repository as account defaults when an owned repository lacks its own file of the same type.
+
+Per-repository files take precedence, and local issue-template directories may override account defaults. File presence here does not prove that every repository inherits, displays, or enforces every surface.
+
+## Authority boundary
+
+Riverbraid-Core remains the normative source for protocol semantics. This repository does not replace code, test vectors, registry entries, signatures, seals, workflow evidence, claim-boundary documents, or the F0–F4 control package.
+
+## Non-claims
+
+This repository does not claim certification, production readiness, external audit, legal approval, complete AI safety, absolute security, adoption, profile-rendering completeness, account-wide template inheritance, account-wide support, or absence of defects.
diff --git a/RELEASE_AND_COMPATIBILITY.md b/RELEASE_AND_COMPATIBILITY.md
new file mode 100644
index 0000000..da9b5e9
--- /dev/null
+++ b/RELEASE_AND_COMPATIBILITY.md
@@ -0,0 +1,101 @@
+# Release and Compatibility Policy
+
+**Status:** Shared public policy candidate
+
+## Purpose
+
+This policy keeps release identity, source identity, compatibility, verification, adoption, and current applicability separate.
+
+## Release identity
+
+A release should identify:
+
+- repository and exact source commit;
+- tag or release identifier;
+- release authority;
+- included artifacts and digests where material;
+- environment and dependency assumptions;
+- verification commands and observed results;
+- compatibility scope;
+- known limitations and nonclaims;
+- supersession, rollback, and review triggers.
+
+A tag, GitHub release, package publication, generated archive, or version label does not by itself establish correctness, adoption, support, security, or compatibility.
+
+## Compatibility classes
+
+Use an explicit relationship such as:
+
+- `EXACT_MATCH` — exact source, contract, and required environment identity match;
+- `DECLARED_COMPATIBLE` — compatibility is permitted by a versioned contract and has attributable evidence;
+- `EXPLAINED_VARIANT` — a declared difference is within the comparison contract;
+- `PARTIALLY_COMPATIBLE` — only named interfaces or behaviors are supported;
+- `INCOMPATIBLE` — a material contract or behavior conflict is observed;
+- `NOT_ASSESSED` — no sufficient compatibility assessment exists;
+- `COMPARISON_NOT_VALID` — the subjects or conditions fall outside the comparison contract.
+
+A successful command under an out-of-contract configuration is not an `EXACT_MATCH`.
+
+## Cross-repository compatibility
+
+Repositories are compatible only at the interfaces directly assessed.
+
+The following do not establish integration compatibility:
+
+- common ownership;
+- similar names;
+- registry co-membership;
+- use of the same runtime;
+- separate passing tests;
+- simultaneous cloning;
+- documentation that says components are intended to work together.
+
+An integrated claim requires direct evidence that real inputs and outputs crossed the relevant repository boundaries and that blocking component states propagated visibly.
+
+## Versioning
+
+Individual repositories may use semantic versioning or another declared scheme. Riverbraid does not currently impose one account-wide semantic-versioning contract.
+
+A version number must not silently encode:
+
+- adoption status;
+- gate closure;
+- certification;
+- production readiness;
+- verification depth;
+- registry freshness;
+- compatibility with every other repository.
+
+Those dimensions require separate records or explicit declarations.
+
+## Pre-release and proposed material
+
+Draft branches, proposed control packages, candidate schemas, and unmerged pull requests remain candidates unless an authorized record states otherwise.
+
+They may be tested and reviewed, but their existence or successful self-check does not make them adopted, released, or currently applicable on a default branch.
+
+## Supersession and rollback
+
+A newer release does not erase an older release or retroactively change what an earlier result established.
+
+Supersession should preserve:
+
+- prior identity;
+- replacement identity;
+- reason and authority;
+- effective time;
+- affected claims and dependencies;
+- migration or rollback path;
+- current applicability of both subjects.
+
+Rollback restores a previously valid operational state under the same governing grammar. A change to the governing schema or representational basis requires reconstitution rather than silent rollback.
+
+## Security and dependency boundary
+
+Release evidence must disclose unresolved network acquisition, mutable dependencies, unpinned actions or images, unavailable security settings, and other supply-chain limitations material to the claim.
+
+A digest-pinned base or source commit narrows identity. It does not by itself establish offline, hermetic, independently reproduced, or fully supply-chain-isolated operation.
+
+## Non-claims
+
+This policy does not establish a release cadence, long-term-support program, universal backward compatibility, package-distribution commitment, production readiness, certification, external audit, or full-constellation operation.
\ No newline at end of file
diff --git a/SECURITY.md b/SECURITY.md
index 5827c12..1b97ec9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,55 +1,82 @@
 # Security Policy
 
-This document describes how security concerns should be reported for Riverbraid public repositories.
+This document describes the bounded reporting route for security concerns affecting Riverbraid public repositories.
 
-It is a community health surface only. It does not create certification, legal approval, production readiness, guaranteed response times, staffed security operations, external audit, absolute security, or absence of defects.
+It is a community-health surface only. It does not create certification, legal approval, production readiness, guaranteed response times, staffed security operations, external audit, absolute security, or absence of defects.
 
 ## Scope
 
 This policy applies to public Riverbraid repositories as a reporting and routing surface.
 
-It does not mean every repository is production ready, independently audited, or safe for deployment.
+It does not mean every repository is production-ready, independently audited, actively monitored, or safe for deployment.
 
-## Reporting security concerns
+## Sensitive reporting rule
 
-To report a security vulnerability, please open an issue in the most relevant repository or contact the maintainers through the profile channels. We follow a fail closed response posture.
+Do **not** publish any of the following in a public issue, pull request, discussion, commit, gist, or workflow log:
 
-If the concern affects the public Evaluation Kit or the canonical verification floor, use:
+- exploit instructions or proof-of-concept code for an unremediated vulnerability;
+- credentials, tokens, private keys, secrets, or recovery material;
+- personal or confidential data;
+- unredacted logs containing sensitive values;
+- information that would materially increase immediate exploitation risk.
 
-```text
-Riverbraid-Evaluation-Kit
-```
+## Preferred private route
 
-If the concern affects repository mapping, public documentation, or claim boundaries, use:
+For the affected repository, first check its **Security** tab for a **Report a vulnerability** option.
 
-```text
-Riverbraid-Documentation
-```
+Use that route only when GitHub visibly provides the private vulnerability-reporting form for the exact repository.
 
-## Report contents
+Private vulnerability-reporting enablement is currently a manual repository-setting confirmation item tracked in `Riverbraid-Documentation#19`. File presence in this repository does not prove that the private route is enabled everywhere.
 
-Include:
+## When no verified private route is available
 
-- Repository name
-- Affected file or surface
-- Observed behavior
-- Expected behavior
-- Reproduction steps, if applicable
-- Whether the issue affects documentation, verification, workflow behavior, or public claims
+Fail closed:
 
-## Boundary
+1. do not send sensitive details through a public channel;
+2. open a minimal public issue in the affected repository titled `Private security contact requested`;
+3. include only the repository name, a high-level affected surface, and a statement that details are being withheld pending a verified private route;
+4. do not include exploitability, secrets, vulnerable line details, or reproduction steps;
+5. wait for an attributable maintainer response establishing an appropriate private channel.
 
-Riverbraid currently provides public inspection surfaces and verification artifacts. This security policy does not imply a staffed response team, emergency response availability, formal vulnerability disclosure program, bounty program, third party audit, or production deployment support.
+A public placeholder issue is routing metadata, not a vulnerability report.
 
-## Non claims
+## Non-sensitive security findings
+
+A public issue may be appropriate when the information is already public and does not increase exploitation risk, such as:
+
+- stale or contradictory security documentation;
+- missing claim boundaries;
+- visibly unpinned workflow references;
+- a public workflow failure that contains no secrets;
+- a request to confirm security-setting status without vulnerability details.
+
+## Report contents for a verified private route
+
+Include only what is necessary:
+
+- repository and exact commit or ref;
+- affected file, workflow, dependency, or setting;
+- observed behavior and security impact;
+- bounded reproduction steps;
+- environment and prerequisites;
+- whether credentials or personal data may have been exposed;
+- suggested containment, if known;
+- disclosure constraints or timing concerns.
+
+## Response boundary
+
+Riverbraid currently provides public inspection surfaces and verification artifacts. This policy does not imply a staffed response team, emergency availability, formal disclosure program, bounty program, guaranteed remediation, third-party audit, or production-deployment support.
+
+## Non-claims
 
 This policy does not claim:
 
-- Certification
-- Legal approval
-- Production readiness
-- Absolute security
-- External audit
-- Complete AI safety
-- Guaranteed response time
-- Absence of defects
+- certification;
+- legal approval;
+- production readiness;
+- absolute security;
+- external audit;
+- complete AI safety;
+- guaranteed response time;
+- private vulnerability-reporting availability in every repository;
+- absence of defects.
diff --git a/SUPPORT.md b/SUPPORT.md
index 1ab7a0a..fce01fe 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -1,68 +1,64 @@
 # Riverbraid Support
 
-This document describes support routes for Riverbraid public repositories.
+Riverbraid is an open-source public-good project with bounded maintenance capacity.
 
-It is a community health surface only. It does not create guaranteed response times, staffed support operations, production support, legal support, certification, external audit, or security hardening claims.
+This file routes questions and reports. It does not guarantee response time, resolution, compatibility, deployment support, security operations, or continued maintenance.
 
-## Start here
+## Where to start
 
-For first-time technical inspection, start with:
+- Public evaluation or reproduction question: `Riverbraid-Evaluation-Kit`
+- Protocol terminology or Core audit behavior: `Riverbraid-Core`
+- Repository classification, lifecycle, or coordination: `Riverbraid-Golds`
+- Documentation, claim-boundary, or source-custody question: `Riverbraid-Documentation`
+- Repository-specific defect: the affected repository
 
-```text
-Riverbraid-Evaluation-Kit
-```
+## Before opening an issue
 
-For explanatory documentation, claim boundaries, roadmap surfaces, and audit inventory, use:
+Include only information necessary to understand the observed problem:
 
-```text
-Riverbraid-Documentation
-```
+- repository and exact commit or ref;
+- operating system and runtime versions;
+- command performed;
+- observed output;
+- expected output;
+- whether the issue concerns code, documentation, workflow, registry, environment, evidence, or public claims;
+- whether the report contains sensitive information.
 
-For protocol authority and core audit behavior, use:
+Do not place secrets, credentials, private keys, personal data, or unredacted vulnerability details in a public issue.
 
-```text
-Riverbraid-Core
-```
+## Supported question types
 
-## Where to open issues
+Useful public issues include:
 
-Open an issue in the repository most directly affected.
+- reproducible verifier failures;
+- mismatches between documentation and source;
+- missing or ambiguous claim boundaries;
+- broken public evaluation instructions;
+- repository classification errors;
+- evidence attribution problems;
+- bounded proposals for clearer public operation.
 
-Use `Riverbraid-Documentation` when the issue concerns:
+## Out of scope
 
-- public explanation
-- claim boundaries
-- roadmap surfaces
-- evidence classification
-- readiness matrix fields
-- documentation consistency
+Riverbraid does not provide guaranteed:
 
-Use `Riverbraid-Evaluation-Kit` when the issue concerns:
+- production deployment support;
+- legal or regulatory advice;
+- certification;
+- security monitoring or emergency response;
+- custom integration engineering;
+- recovery of lost credentials or data;
+- validation of downstream AI behavior;
+- support for forks or materially changed adaptations.
 
-- reproduction path
-- registry snapshot
-- Evaluation Kit workflow behavior
-- expected results
-- verifier command classification
+## Security reports
 
-Use `Riverbraid-Core` when the issue concerns:
+Follow `SECURITY.md`. Do not publish exploit details or secrets in a public issue.
 
-- protocol authority
-- core audit behavior
-- canonical verifier rules
-- byte audit behavior
+## F0–F4 questions
 
-## What to include
-
-Include:
-
-- repository name
-- affected file or workflow
-- observed behavior
-- expected behavior
-- reproduction steps if available
-- whether the issue affects documentation, verification, registry state, workflow behavior, release state, or public claims
+The F0–F4 control package remains proposed until an attributable adoption act occurs. General questions, planning, file discovery, or byte comparison do not constitute adoption, execution, or gate advancement.
 
 ## Boundary
 
-This support document does not claim that Riverbraid provides enterprise support, emergency response, security response SLAs, production support, legal advice, compliance certification, external audit, or guaranteed maintenance capacity.
+This support document does not claim enterprise support, security-response service levels, production support, external audit, guaranteed maintenance capacity, adoption, or absence of defects.
diff --git a/SUPPORTED_VERSIONS.md b/SUPPORTED_VERSIONS.md
new file mode 100644
index 0000000..a50582a
--- /dev/null
+++ b/SUPPORTED_VERSIONS.md
@@ -0,0 +1,75 @@
+# Supported Versions and Source Identities
+
+**Status:** Shared public policy candidate  
+**Account-wide support window:** Not declared
+
+## Core rule
+
+Riverbraid does not use one global version number or the newest visible branch as a substitute for exact source identity, current applicability, or support.
+
+A repository, profile, schema, evaluator, workflow, or release is supported only to the extent that its own current records declare:
+
+- exact repository and source identity;
+- role and scope;
+- version or profile identity;
+- environment and dependency contract;
+- verification command and depth;
+- current applicability and freshness;
+- known limitations and nonclaims;
+- maintenance or disposition authority.
+
+## Current support posture
+
+No account-wide promise is made that:
+
+- every public repository is active;
+- every default branch is compatible with every other default branch;
+- every tag or release remains supported;
+- registry membership equals functional-core membership;
+- a passing historical run remains current;
+- all repositories use the same runtime, schema, workflow, or compatibility policy.
+
+The preferred public evaluation entrance is `Riverbraid-Evaluation-Kit` for its exact pinned profile and declared claim ceiling.
+
+Repositories outside that profile must not be described as supported by the profile merely because they share a name, owner, runtime, or conceptual relationship.
+
+## Status vocabulary
+
+A repository or version should use a bounded status such as:
+
+- `SUPPORTED_EXACT_PROFILE`;
+- `SUPPORTED_WITH_DECLARED_LIMITATIONS`;
+- `MAINTENANCE_ONLY`;
+- `EXPERIMENTAL`;
+- `REFERENCE_ONLY`;
+- `DORMANT`;
+- `SUPERSEDED`;
+- `ARCHIVED`;
+- `NOT_ASSESSED`;
+- `SUPPORT_STATUS_UNKNOWN`.
+
+The exact vocabulary may be narrowed by a repository-specific contract. Silence must not be converted into `SUPPORTED`.
+
+## Security updates
+
+No universal security-maintenance period is currently promised.
+
+A security fix applies only to the exact source state containing it. A patched file without attributable execution or review evidence must remain distinguished from an executed or verified repair.
+
+Sensitive reports must follow `SECURITY.md`.
+
+## Compatibility and freshness
+
+Compatibility is current only when the depended-on source identities, schemas, commands, environments, and claim boundaries remain applicable under the declared review triggers.
+
+A stale result may remain historically true. It is not sufficient for a present support claim unless the relevant freshness policy is satisfied.
+
+## Repository-specific authority
+
+A repository may publish a narrower supported-versions table, release line, long-term-support commitment, or end-of-support date.
+
+That repository-specific declaration governs only within its stated scope and does not create an account-wide obligation.
+
+## Non-claims
+
+This file does not establish guaranteed maintenance, backward compatibility, security coverage, service levels, production readiness, certification, external audit, universal interoperability, or support for every Riverbraid repository.
\ No newline at end of file
diff --git a/USER_PROFILE_README_CANDIDATE.md b/USER_PROFILE_README_CANDIDATE.md
new file mode 100644
index 0000000..31f4e19
--- /dev/null
+++ b/USER_PROFILE_README_CANDIDATE.md
@@ -0,0 +1,24 @@
+# Riverbraid: A Deterministic Integrity Floor for AI Governance
+
+Riverbraid is an open source verification floor for making structure, authority, and drift visible before trust is granted.
+
+## Start here
+
+| Path | Repository | Purpose |
+|---|---|---|
+| 🚀 Start Here | [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit) | Run the public evaluation path. |
+| 📖 Read More | [Riverbraid-Documentation](https://github.com/Riverbraid/Riverbraid-Documentation) | Understand concepts, boundaries, source custody, and the system map. |
+| ⚖️ Protocol Source | [Riverbraid-Core](https://github.com/Riverbraid/Riverbraid-Core) | Inspect the normative protocol source. |
+| 🧭 Coordination | [Riverbraid-Golds](https://github.com/Riverbraid/Riverbraid-Golds) | Inspect repository classification and coordination surfaces without inferring registry or verification status. |
+| 🛡️ Safety Example | [Riverbraid-Safety-Gold](https://github.com/Riverbraid/Riverbraid-Safety-Gold) | Review a bounded safety verification surface. |
+| ✨ Visual Demo | [Riverbraid-Gold-V2](https://github.com/Riverbraid/Riverbraid-Gold-V2) | See the integrity concept visually. |
+
+> [!IMPORTANT]
+> A successful evaluation applies only to the exact source, configured commands, verification depth, environment, and evidence recorded for that run. It does not automatically establish registry freshness, equal verifier depth, independent reproduction, adoption, production readiness, or full-constellation operation.
+
+> [!IMPORTANT]
+> Riverbraid does not claim certification, legal approval, production readiness, external audit, complete AI safety, absolute security, or absence of defects.
+
+## Public route
+
+Profile → Evaluation Kit → Documentation → Core or domain repository as needed.
diff --git a/profile/README.md b/profile/README.md
index 5edffcc..a0897d9 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -1,4 +1,8 @@
-# Riverbraid: A Deterministic Integrity Floor for AI Governance
+# Riverbraid profile candidate
+
+> **Account-surface note:** `Riverbraid` is currently a GitHub user account. GitHub's `profile/README.md` convention applies to organizations, so this file is a maintained organization-profile candidate and repository documentation surface. It is not evidence that this content currently renders on the Riverbraid user profile.
+
+## Riverbraid: A Deterministic Integrity Floor for AI Governance
 
 Riverbraid is an open source verification floor for making structure, authority, and drift visible before trust is granted.
 
@@ -6,16 +10,19 @@ Riverbraid is an open source verification floor for making structure, authority,
 
 | Path | Repository | Purpose |
 |---|---|---|
-| 🚀 Start Here | [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit) | Run the public proof path. |
-| 📖 Read More | [Riverbraid-Documentation](https://github.com/Riverbraid/Riverbraid-Documentation) | Understand concepts, boundaries, and the system map. |
+| 🚀 Start Here | [Riverbraid-Evaluation-Kit](https://github.com/Riverbraid/Riverbraid-Evaluation-Kit) | Run the public evaluation path. |
+| 📖 Read More | [Riverbraid-Documentation](https://github.com/Riverbraid/Riverbraid-Documentation) | Understand concepts, boundaries, source custody, and the system map. |
 | ⚖️ Protocol Source | [Riverbraid-Core](https://github.com/Riverbraid/Riverbraid-Core) | Inspect the normative protocol source. |
-| 🧭 Registry | [Riverbraid-Golds](https://github.com/Riverbraid/Riverbraid-Golds) | See the coordinated repository surface. |
+| 🧭 Coordination | [Riverbraid-Golds](https://github.com/Riverbraid/Riverbraid-Golds) | Inspect repository classification and coordination surfaces without inferring registry or verification status. |
 | 🛡️ Safety Example | [Riverbraid-Safety-Gold](https://github.com/Riverbraid/Riverbraid-Safety-Gold) | Review a bounded safety verification surface. |
 | ✨ Visual Demo | [Riverbraid-Gold-V2](https://github.com/Riverbraid/Riverbraid-Gold-V2) | See the integrity concept visually. |
 
+> [!IMPORTANT]
+> A successful evaluation applies only to the exact source, configured commands, verification depth, environment, and evidence recorded for that run. It does not automatically establish registry freshness, equal verifier depth, independent reproduction, adoption, production readiness, or full-constellation operation.
+
 > [!IMPORTANT]
 > Riverbraid does not claim certification, legal approval, production readiness, external audit, complete AI safety, absolute security, or absence of defects.
 
-## Public route
+## Intended public route
 
 Profile → Evaluation Kit → Documentation → Core or domain repository as needed.
diff --git a/scripts/validate-community-health.mjs b/scripts/validate-community-health.mjs
new file mode 100644
index 0000000..254515e
--- /dev/null
+++ b/scripts/validate-community-health.mjs
@@ -0,0 +1,129 @@
+import fs from "node:fs";
+
+const requiredFiles = [
+  "README.md",
+  "GOVERNANCE.md",
+  "MAINTAINERS.md",
+  "CONTRIBUTING.md",
+  "INBOUND_CONTRIBUTION_RIGHTS.md",
+  "FORKING.md",
+  "RELEASE_AND_COMPATIBILITY.md",
+  "SUPPORTED_VERSIONS.md",
+  "SECURITY.md",
+  "SUPPORT.md",
+  "CODE_OF_CONDUCT.md",
+  "PULL_REQUEST_TEMPLATE.md",
+  "USER_PROFILE_README_CANDIDATE.md",
+  "profile/README.md"
+];
+
+function fail(code, details = {}) {
+  console.error(JSON.stringify({ status: "FAILED", code, ...details }, null, 2));
+  process.exit(1);
+}
+
+function read(path) {
+  if (!fs.existsSync(path)) {
+    fail("REQUIRED_FILE_MISSING", { path });
+  }
+
+  const content = fs.readFileSync(path, "utf8").replace(/^\uFEFF/, "");
+  if (content.trim().length === 0) {
+    fail("REQUIRED_FILE_EMPTY", { path });
+  }
+  return content;
+}
+
+function requireText(path, content, expected) {
+  if (!content.includes(expected)) {
+    fail("REQUIRED_TEXT_MISSING", { path, expected });
+  }
+}
+
+function forbidText(path, content, forbidden) {
+  if (content.toLowerCase().includes(forbidden.toLowerCase())) {
+    fail("FORBIDDEN_TEXT_PRESENT", { path, forbidden });
+  }
+}
+
+const files = new Map(requiredFiles.map((path) => [path, read(path)]));
+
+const rootReadme = files.get("README.md");
+requireText("README.md", rootReadme, "GitHub user account");
+requireText("README.md", rootReadme, "Riverbraid/Riverbraid");
+requireText("README.md", rootReadme, "Riverbraid-Evaluation-Kit");
+requireText("README.md", rootReadme, "account-wide template inheritance");
+forbidText("README.md", rootReadme, "public proof path");
+
+const profileCandidate = files.get("profile/README.md");
+requireText("profile/README.md", profileCandidate, "organization-profile candidate");
+requireText("profile/README.md", profileCandidate, "user account");
+
+const governance = files.get("GOVERNANCE.md");
+requireText("GOVERNANCE.md", governance, "Founder-led, evidence-constrained, forkable");
+requireText("GOVERNANCE.md", governance, "silently adopt the F0–F4 control package");
+requireText("GOVERNANCE.md", governance, "No decision may be upgraded merely to satisfy a schedule");
+
+const maintainers = files.get("MAINTAINERS.md");
+requireText("MAINTAINERS.md", maintainers, "current public surface is founder-maintained");
+requireText("MAINTAINERS.md", maintainers, "CODEOWNERS");
+requireText("MAINTAINERS.md", maintainers, "permission is not equivalent to governing authority");
+
+const contributing = files.get("CONTRIBUTING.md");
+for (const reference of [
+  "INBOUND_CONTRIBUTION_RIGHTS.md",
+  "PULL_REQUEST_TEMPLATE.md",
+  "SECURITY.md",
+  "SUPPORTED_VERSIONS.md",
+  "RELEASE_AND_COMPATIBILITY.md"
+]) {
+  requireText("CONTRIBUTING.md", contributing, reference);
+}
+requireText("CONTRIBUTING.md", contributing, "No adoption or gate advancement");
+
+const rights = files.get("INBOUND_CONTRIBUTION_RIGHTS.md");
+requireText("INBOUND_CONTRIBUTION_RIGHTS.md", rights, "No separate contributor license agreement");
+requireText("INBOUND_CONTRIBUTION_RIGHTS.md", rights, "No Developer Certificate of Origin sign-off");
+requireText("INBOUND_CONTRIBUTION_RIGHTS.md", rights, "does not automatically");
+
+const security = files.get("SECURITY.md");
+requireText("SECURITY.md", security, "Do **not** publish");
+requireText("SECURITY.md", security, "Report a vulnerability");
+requireText("SECURITY.md", security, "Private security contact requested");
+requireText("SECURITY.md", security, "does not prove that the private route is enabled everywhere");
+
+const pullRequestTemplate = files.get("PULL_REQUEST_TEMPLATE.md");
+for (const expected of [
+  "Exact subject and scope",
+  "Authority and disposition",
+  "Evidence and validation",
+  "Claim effect",
+  "Security, privacy, and disclosure",
+  "Contributor rights",
+  "does not silently adopt"
+]) {
+  requireText("PULL_REQUEST_TEMPLATE.md", pullRequestTemplate, expected);
+}
+
+const versions = files.get("SUPPORTED_VERSIONS.md");
+requireText("SUPPORTED_VERSIONS.md", versions, "Account-wide support window:** Not declared");
+requireText("SUPPORTED_VERSIONS.md", versions, "Silence must not be converted into `SUPPORTED`");
+
+const releasePolicy = files.get("RELEASE_AND_COMPATIBILITY.md");
+requireText("RELEASE_AND_COMPATIBILITY.md", releasePolicy, "A tag, GitHub release, package publication");
+requireText("RELEASE_AND_COMPATIBILITY.md", releasePolicy, "does not by itself establish");
+requireText("RELEASE_AND_COMPATIBILITY.md", releasePolicy, "COMPARISON_NOT_VALID");
+
+for (const [path, content] of files) {
+  forbidText(path, content, "full constellation operational: yes");
+  forbidText(path, content, "certified by Riverbraid");
+  forbidText(path, content, "production ready and secure");
+}
+
+console.log(JSON.stringify({
+  status: "COMMUNITY_HEALTH_INVARIANTS_PASS",
+  required_file_count: requiredFiles.length,
+  account_type: "GITHUB_USER_ACCOUNT",
+  personal_profile_repository_required: "Riverbraid/Riverbraid",
+  f0_f4_effect: "NONE"
+}, null, 2));