SLICE-004 — Publication preparation: MIT license, public-facing documentation, and metadata

[maximalfocus]

Prepares this repository to be published as a public, open-source teaching demo, and records the
publication-surface review. No application behaviour, endpoint, test, or security posture changes.

The visibility change is deliberately not part of this merge — it follows on the exact verified
default-branch commit.

What changed

File	Change
LICENSE	New. Canonical OSI MIT Licence text, year 2026, holder maximalfocus.
pyproject.toml	SPDX license = "MIT" + license-files, education/security classifiers, and Private :: Do Not Upload — nothing here is ever published to a package index.
SECURITY.md	New. Separates the intentionally demonstrated flaw from a real vulnerability, and routes the latter to private reporting.
CONTRIBUTING.md	New. Docker-only workflow, the verify gate, and the six invariants that keep an intentionally vulnerable project safe.
README.md	Adds a "Not a product" section (nothing hosted or packaged; no production-readiness, support, or compatibility promise) and links the three documents above.
repository metadata	Description rewritten from the private-development placeholder to a public-facing one; topics set; homepage left empty.

SECURITY.md names the opt-in vulnerable application, the deliberately broken "hardened" endpoint,
the hand-rolled Zip-Slip import, and the fictional demo tokens as in scope by design and not
reportable, and names a hole in the containment boundary — a secure-app escape, the vulnerable app
starting without both opt-in actions, a write leaving the disposable fixture tree, command execution,
egress, or a genuinely real credential in history — as the thing that is reportable. Reporting goes
through GitHub's private vulnerability reporting, so no personal address is published.

Verification

Run on this branch's tree, through the same Compose boundary CI runs:

Command	Result
docker compose build	green
docker compose run --rm verify	68 passed, Ruff + mypy green
docker compose run --rm demo	16/16 checks passed
ALLOW_VULNERABLE_DEMO=true docker compose --profile vulnerable run --rm compare	12/12 rows passed

Package metadata was additionally read back out of a built wheel to prove the SPDX declaration
resolves rather than merely being present in source:

Metadata-Version: 2.5
Name: boundless
License-Expression: MIT
License-File: LICENSE

Publication-surface review

Every surface that becomes public on the visibility change was reviewed. The applied denylist is
case-, punctuation-, spacing-, and spelling-tolerant, and covers real governments, public
authorities, agencies, organizations, products, aliases, and abbreviations, plus the identity,
location, and URL of the private companion requirements repository. The secret scan covers provider
token prefixes, cloud access-key IDs, model-provider and chat-platform keys, PEM private-key blocks,
and JWTs.

Surface	How it was reviewed	Result
Tracked files (44)	denylist + secret scan over the working tree	clean
Reachable Git history	git grep over every commit in git rev-list --all	clean
Commit messages	full log across all refs	clean
Author / committer identities	every commit across all refs	clean — GitHub noreply addresses only, no personal address
Retained pull-request refs	refs/pull/2/head, refs/pull/4/head, refs/pull/6/head fetched locally and scanned	clean
Unreachable objects	git fsck --lost-found	none present
Branches	main and this feature branch only	clean
Tags / releases	none exist	n/a
Repository metadata	description, topics, homepage	rewritten in this change; homepage empty
Issues (#1, #3, #5, #7)	bodies and all comments	clean
Pull requests (#2, #4, #6)	bodies, comments, reviews, commit lists	clean
Actions runs	all 11 runs, ~557 KB of logs	clean
Actions artifacts	API-reported count	0
Fixture "secrets"	manual read of identity.py, fixtures.py, config.py	fictional and conspicuously labelled (…NOT-A-REAL-SECRET, DEMO_SENTINEL)

No unresolved secret or private-content finding. Nothing in the reviewed surface references the
private companion requirements repository, discloses private motivation, or names a real
organization; no history rewrite is required.

A CI guard enumerating forbidden terms was deliberately not added: such a guard would itself
write those terms into a retained pull-request ref that no later history rewrite can reach. The
review stays a process gate, recorded here.

Non-goals honoured

• No deployment, hosting, published package, or public demo endpoint.
• No change to either application's behaviour or containment posture.
• No change to the private companion requirements repository.

Closes #7