[gregnazario]

Companion to #2, but config/docs rather than install UX. The repo was scaffolded in sessions that templated another project's identity — anomalyco/mustfile + must.ai — into generated artifacts. This PR repoints all of it at gregnazario/must or removes it:

File	Change
.github/CODEOWNERS	collapsed to default owner @gregnazario (review requests were routing to an anomalyco team that doesn't exist here)
.github/SECURITY.md	vulnerability reporting now via GitHub private advisories on this repo; removed security@must.ai email and anomalyco advisory URL
.github/ISSUE_TEMPLATE/config.yml	Documentation contact link → in-repo docs/ tree
site/mkdocs.yml	site_url → https://gregnazario.github.io/must/; repo name/URL → this repo
.github/workflows/deploy-docs.yml	dropped the must.ai CNAME step so Pages deploys cleanly without a custom domain
AGENTS.md	doc-site note says GitHub Pages
examples/ci-cd/*, site/docs/advanced/github-actions.md	replaced invocations of composite actions (anomalyco/mustfile@main / anomalyco/must@main) that never existed in this repo with a real install-then-run pattern
site/docs/guide/getting-started.md	dropped Homebrew tab (no tap exists) and the cargo install must tab (that crates.io name isn't ours); fixed clone/curl URLs to this repo
.github/workflows/release.yml release body	correct curl URL, fetch-then-run form, Homebrew block removed

Notes:

• install.sh and the README doc-site links are intentionally not touched here — they're already fixed on Docs polish: fix install.sh repo, add badges, quick-install and doc-site link #2; no overlap.
• Deployed docs land at https://gregnazario.github.io/must/ once Pages is enabled for the repo.
• Verified: YAML parses on all touched workflows/configs (mkdocs' own python/name: tags aside), residue grep for anomalyco|must.ai is clean outside Docs polish: fix install.sh repo, add badges, quick-install and doc-site link #2's two files.

[hedgehog-pr-bot]

Pi code review

Medium — .github/ISSUE_TEMPLATE/config.yml:4 — Documentation link points to a nonexistent path

The contact link now points to https://github.com/gregnazario/must/tree/main/docs, but the docs tree lives at site/docs/ (evidenced by site/mkdocs.yml and site/docs/... paths elsewhere in this PR, and edit_uri: edit/main/site/docs/). Users clicking "Check the documentation before opening an issue" will get a 404.
Fix: use https://github.com/gregnazario/must/tree/main/site/docs, or link the published site at https://gregnazario.github.io/must/ once Pages is enabled.

Low — .github/workflows/release.yml:~120-125 — leftover double blank line in release body

The Homebrew block was deleted but the blank line that preceded it remains, so the rendered release notes have an extra blank paragraph between the Windows line and ## Checksums. Harmless but sloppy in a generated artifact. Remove one of the adjacent blank lines.

Low — install snippets depend on install.sh existing as a release asset under gregnazario/must

All new snippets (examples/ci-cd/.github/workflows/ci.yml:16-20,33-37, site/docs/advanced/github-actions.md, site/docs/guide/getting-started.md, site/docs/index.md, and the release.yml body) fetch https://github.com/gregnazario/must/releases/latest/download/install.sh. If this repo is a fork (no releases carried over) rather than a rename (old URLs would redirect), every documented install path 404s until the first release containing that asset is published. Confirm a release with an install.sh asset exists before/with merging, especially given the stated ordering dependency on #2.

Low — unpinned latest install in CI examples, no checksum verification

examples/ci-cd/.github/workflows/ci.yml installs releases/latest on every run and the docs recommend the same, even though the release body publishes checksums. Not a regression (the old @main action reference was equally unpinned), but since these snippets are being rewritten anyway, consider showing a tag-pinned download with checksum verification as the recommended CI pattern.

Low — site/docs/index.md:13-19 — odd indentation carried into rewritten code fence

The commands are indented four spaces under non-indented # Install comments (pre-existing style, but these exact lines were rewritten). The rendered/ copied block has leading whitespace that differs from every other snippet in the PR (getting-started.md, github-actions.md are flush-left). Normalize while touching the lines.

Checked and clean: CODEOWNERS collapse to a valid owner, SECURITY.md advisory-only reporting, mkdocs.yml site_url/repo_url/edit_uri are mutually consistent for a project-pages deploy at /must/, CNAME removal matches the custom-domain removal, the anomalyco/must.ai sweep is complete within the diff, and YAML in touched files is syntactically valid. The must --profile <p> <cmd> global-flag placement couldn't be verified against the CLI but is used consistently across all rewritten examples.

---

_{Reviewed d0b0276 with Pi 0.84.2 using zai/glm-5.3:high.}

[gregnazario]

Addressing each finding:

• index.md crates.io install (High) — valid catch; front page now uses the source-build form (git clone … && cargo install --path crates/must-cli) consistent with getting-started. The phantom-crate risk is gone from every surface.
• Issue-template link (Medium) — not a defect: root docs/ exists and contains DESIGN.md, MIGRATION_GUIDE.md, OVERVIEW.md, SCRATCHPAD.md, TASKS.md, USER_GUIDE.md, so /tree/main/docs resolves. Keeping it over the Pages URL while the site isn't published yet; can revisit once Pages is enabled.
• Profile consistency (Low) — verified in source: --profile is a clap global = true arg (main.rs:43-45), so pre-subcommand placement is canonical. Example workflow now runs must --profile ci ci, matching must --profile release build in the docs page.
• install.sh asset + integrity (Low) — confirmed the release job includes an Upload Install Script step publishing install.sh as a release asset, so the snippets' dependency holds once the first release is cut. SHA256SUMS covers the binaries/archives; signing install.sh itself (or adding checksum docs beside each snippet) noted as future hardening rather than added now.