chore: prepare public readiness

Source-only public-readiness preparation. No visibility, release, publish, deploy, live send, DB mutation, credential movement, or history rewrite performed.

Author: jinon86

.gitleaks.toml

@@ -0,0 +1,9 @@
+title = "agent-olympics public-readiness gitleaks allowlist"
+
+[allowlist]
+description = "Allow source-only proof-token SHA-256 fixture fields; these are challenge hashes, not credentials."
+paths = [
+  'fixtures/proof-token-verification/challenge-set.yaml',
+  'fixtures/proof-token-verification/positive-result-packet.yaml',
+  'fixtures/proof-token-verification/negative-result-packet.yaml',
+]

README.md

@@ -18,7 +18,7 @@ motto, and Korean working line.
 
 Agent Olympics is an MVP evaluation framework with source packs, schemas,
 validation tooling, adapter fixtures, and dry-run examples. It is ready for
-schema and harness development. It is not yet a fully verified public
+schema and harness development. It is public-source-ready for schema and harness review, but it is not yet a fully verified public
 competition: most Season 001 tasks remain draft-tier until baseline runs and
 judge records promote them to smoke or verified status.
 
@@ -366,3 +366,14 @@ v2 schemas add public/private separation and oracle cross-referencing:
 - `schemas/judge-record-v2.schema.json` — Judge Record v2
 
 See [docs/migration-v1-to-v2.md](docs/migration-v1-to-v2.md) for the migration guide.
+
+## Public source visibility boundary
+
+This repository is being prepared for possible public source visibility. A
+public repository setting would be source-only: it would not approve release or
+tag creation, package/image publication, production deploy/restart/reload,
+database mutation, provider or Telegram sends, credential movement, history
+rewrite, or any other live operation.
+
+Runtime credentials and private operational data must stay outside the
+repository. Example configuration must use placeholders only.

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported scope
+
+This repository is being prepared for possible public source visibility. Public
+visibility, release publication, package publication, deployment, provider or
+Telegram sends, database mutation, credential movement, and history rewrite are
+separate approval-gated actions.
+
+## Reporting a vulnerability
+
+Do not open a public issue with secrets, tokens, private URLs, personal data, or
+exploit details. Open a minimal maintainer-contact issue that says you need a
+private security route, or contact the repository owner through an already
+established private channel. Share sensitive details only after a private route
+is confirmed.
+
+## Secret handling
+
+- Do not commit real API keys, bot tokens, cookies, sessions, private keys,
+  production logs, private host paths, or raw runtime data.
+- Example files must use placeholders only.
+- Runtime credentials belong in local environment variables or operator-owned
+  secret stores outside this repository.

SUPPORT.md

@@ -0,0 +1,10 @@
+# Support
+
+This repository is a source-visibility candidate for design review, local
+experimentation, and issue discussion. It does not imply production support,
+managed hosting, release publication, package publication, deployment approval,
+or live-operation approval.
+
+Use GitHub Issues for non-sensitive bugs and documentation problems. Do not
+post secrets, private runtime data, production logs, chat IDs, tokens, or
+personal data in issues or pull requests.

docs/adapter-execution-contract.md

@@ -600,7 +600,7 @@ redaction_policy:
 | ✅ Correct | ❌ Wrong |
 |---|---|
 | `api_token_value` | `sk-proj-abc123def456` |
-| `private_key_material` | `-----BEGIN RSA PRIVATE KEY-----MIIEpA...` |
+| `private_key_material` | `<private-key-material-redacted>` |
 | `session_cookie` | `session=abc123; path=/` |
 
 ### Approval Boundaries