CI, Linux scanners, catalog validation, case export, TUI guides, update rollback, and a real README

.gitattributes

@@ -0,0 +1,39 @@
+# Line endings must be identical on every platform, because this repository
+# ships a SHA-256 manifest of its own source files and verifies it at launch.
+#
+# Without this, git on Windows converts LF to CRLF on checkout. Every byte of
+# every .py file changes, so every hash changes, and `verify_package_integrity`
+# reports the entire `rescue/` package as tampered — on a clean checkout, with
+# nothing wrong. CI surfaced exactly that: the Windows job printed "modified:"
+# for all 56 manifest entries.
+#
+# The wrong fix would be to normalise line endings before hashing. That would
+# weaken the check for everyone in order to accommodate a checkout setting: a
+# tamper check that ignores a class of byte difference is a tamper check with a
+# hole in it. Making the checkout byte-identical instead keeps the hash exact.
+#
+# A user who gets a tamper warning on every launch learns to ignore the one
+# signal that would tell them their install had been modified, which is worse
+# than having no check at all.
+
+* text=auto eol=lf
+
+# Binary and already-compressed formats: never touched.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.icns binary
+*.pdf binary
+*.zip binary
+*.gz binary
+*.dmg binary
+*.exe binary
+*.dll binary
+
+# Windows-only scripts genuinely need CRLF: cmd.exe mis-parses LF batch files.
+# These are not covered by the integrity manifest (it hashes rescue/**/*.py).
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Default owner for everything in this repository.
+* @lizTheDeveloper
+
+# The safety boundary of the whole product lives in these files: the read-only
+# default, the guidance-vs-mutation split, self-integrity, and the content-update
+# trust root. Changes here need the same review as changes to the trust config,
+# so they are called out explicitly rather than relying on the catch-all above.
+/rescue/module_base.py   @lizTheDeveloper
+/rescue/models.py        @lizTheDeveloper
+/rescue/security/        @lizTheDeveloper
+/rescue/update/          @lizTheDeveloper
+/rescue/runtime.py       @lizTheDeveloper
+/SECURITY.md             @lizTheDeveloper
+/.github/workflows/      @lizTheDeveloper

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,125 @@
+name: Bug report
+description: The tool crashed, hung, printed something wrong, or did not do what it said.
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing: if the bug is that a **check reported a healthy result
+        when it should not have**, that is a security bug in this project — see
+        [SECURITY.md](https://github.com/lizTheDeveloper/multiverse-device-rescue/blob/main/SECURITY.md)
+        and report it privately instead.
+
+        If the bug is a **wrong finding** (reported a problem that is not real,
+        or missed one that is), use the "False positive / false negative"
+        template instead — it asks for the right things.
+
+        Issues are public. Redact anything you would not post on a forum.
+        `rescue export` redacts credentials, tokens, email addresses, your
+        username, and your home path, but module output is free text — read the
+        file before pasting from it.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you expected, and what you got instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to reproduce
+      description: The exact command you ran and the output, trimmed and redacted.
+      placeholder: |
+        $ rescue run some_module --yes
+        ...
+      render: shell
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `rescue version`.
+      placeholder: multiverse-device-rescue 0.1.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+        - Linux
+        - Other / more than one
+    validations:
+      required: true
+
+  - type: input
+    id: os-version
+    attributes:
+      label: OS version
+      placeholder: "macOS 15.2 / Windows 11 23H2 / Ubuntu 24.04"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: python
+    attributes:
+      label: Python version
+      options:
+        - "3.11"
+        - "3.12"
+        - "3.13"
+        - "Not applicable (desktop app or PyInstaller binary)"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install
+    attributes:
+      label: How it was installed
+      options:
+        - Source checkout (running from the repo)
+        - pip install .
+        - pip install -e ".[dev]"
+        - PyInstaller binary
+        - Desktop app
+    validations:
+      required: true
+
+  - type: textarea
+    id: integrity
+    attributes:
+      label: Integrity check output
+      description: >-
+        Did launching the tool print "WARNING: rescue's own installed files do
+        not match the expected integrity manifest"? If so, paste it. If not, say
+        so — it rules out a modified install.
+    validations:
+      required: false
+
+  - type: textarea
+    id: traceback
+    attributes:
+      label: Traceback or error output
+      render: shell
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Before submitting
+      options:
+        - label: I redacted anything sensitive in the output above.
+          required: true
+        - label: This is not a security vulnerability (those go through the private advisory form).
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/lizTheDeveloper/multiverse-device-rescue/security/advisories/new
+    about: >-
+      Do not open a public issue for a security flaw. This includes a check that
+      reports a healthy result when it should not. See SECURITY.md.
+  - name: Documentation
+    url: https://lizthedeveloper.github.io/multiverse-device-rescue/
+    about: Command reference, module catalog, and guides.
+  - name: What is and is not finished
+    url: https://github.com/lizTheDeveloper/multiverse-device-rescue/blob/main/docs/ROADMAP_STATUS.md
+    about: Read this before filing "X is missing" — several gaps are already documented.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,80 @@
+name: Feature request
+description: Something the tool should do that is not a new module.
+title: "[feature] "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a new **check**, use the "New module proposal" template instead.
+
+        Please skim
+        [docs/ROADMAP.md](https://github.com/lizTheDeveloper/multiverse-device-rescue/blob/main/docs/ROADMAP.md)
+        and
+        [docs/ROADMAP_STATUS.md](https://github.com/lizTheDeveloper/multiverse-device-rescue/blob/main/docs/ROADMAP_STATUS.md)
+        first. Several known gaps — sandboxed module discovery, real signing
+        keys, signed release artifacts, per-call command bounding — are already
+        written down with reasons. Adding detail to one of those is more useful
+        than a new issue restating it.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: >-
+        What you were trying to do, and where the tool got in the way. Describe
+        the situation, not the solution.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like it to do
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which part of the tool
+      options:
+        - CLI
+        - TUI
+        - Profiles / guides
+        - JSON output or case export
+        - Update and trust (signed content)
+        - AI layer (opt-in)
+        - Desktop app
+        - Packaging / distribution
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What you tried instead
+      description: Existing commands, flags, or workarounds, and why they were not enough.
+    validations:
+      required: false
+
+  - type: textarea
+    id: safety
+    attributes:
+      label: Safety implications
+      description: >-
+        Would this make the tool change more of the system, run more code,
+        reach the network, or reduce how much the user confirms? Say so plainly
+        — it is not a reason to reject the idea, it is a reason to design it
+        carefully.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: offer
+    attributes:
+      label: Are you offering to build it
+      options:
+        - label: I intend to open a PR for this.

.github/ISSUE_TEMPLATE/finding_accuracy.yml

@@ -0,0 +1,108 @@
+name: False positive / false negative
+description: A check reported something that is not true, or missed something that is.
+title: "[finding] "
+labels: ["finding-accuracy"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is the most valuable kind of report this project gets. Every
+        finding is something a person may act on — freezing credit, wiping a
+        machine, confronting someone — and every missed finding is someone
+        walking away believing a device is clean.
+
+        **If a check reported "No issues found" on a machine where the
+        condition it detects is genuinely present, that is a security bug.**
+        Report it privately through the
+        [security advisory form](https://github.com/lizTheDeveloper/multiverse-device-rescue/security/advisories/new)
+        instead of here, especially if it is reproducible or generalises beyond
+        your machine. Use this template for accuracy problems that are safe to
+        discuss in public.
+
+        Issues are public. Redact hostnames, usernames, paths, serial numbers,
+        and anything else identifying.
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Which is it
+      options:
+        - False positive — reported a problem that is not real
+        - False negative — missed a problem that is real
+        - Misleading — technically true, but the description leads to the wrong conclusion
+        - Wrong severity
+    validations:
+      required: true
+
+  - type: input
+    id: module
+    attributes:
+      label: Module name
+      description: The name in the `=== module_name ===` header, or the `name` field in JSON.
+      placeholder: linux_ssh_hardening
+    validations:
+      required: true
+
+  - type: input
+    id: code
+    attributes:
+      label: Finding code
+      description: >-
+        The `code` field from `rescue scan --json`, if the finding has one.
+        Looks like `category.module.slug`.
+      placeholder: security.linux_ssh_hardening.password_auth_enabled
+    validations:
+      required: false
+
+  - type: textarea
+    id: reported
+    attributes:
+      label: What the tool reported
+      description: Paste the finding, redacted. `rescue scan --json` output is ideal.
+      render: json
+    validations:
+      required: true
+
+  - type: textarea
+    id: truth
+    attributes:
+      label: What is actually true, and how you know
+      description: >-
+        The evidence that contradicts the finding — the real setting, the real
+        command output, the vendor documentation. This is the part that lets a
+        maintainer write a failing test.
+    validations:
+      required: true
+
+  - type: textarea
+    id: system
+    attributes:
+      label: System context
+      description: >-
+        OS and version, hardware where relevant, and anything unusual about this
+        machine — managed by an employer, non-default security software,
+        unusual filesystem layout, a distro or shell that is not the common case.
+    validations:
+      required: true
+
+  - type: textarea
+    id: consequence
+    attributes:
+      label: What acting on this finding would have caused
+      description: >-
+        Optional but useful for prioritising. "I would have reinstalled the OS"
+        and "I would have ignored a real problem" are different severities.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Before submitting
+      options:
+        - label: I redacted hostnames, usernames, paths, and anything else identifying.
+          required: true
+        - label: >-
+            This is not a reproducible false-healthy result that would generalise to other
+            machines (those go through the private security advisory form).
+          required: true