build(deps): bump actions/setup-python from 5.6.0 to 7.0.0

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.md]
+indent_size = 2
+trim_trailing_whitespace = false
+
+[*.json]
+indent_size = 2

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/test.yml

@@ -0,0 +1,39 @@
+name: Test
+
+on:
+  pull_request:
+    paths:
+      - "skills/**"
+      - ".github/workflows/test.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "skills/**"
+      - ".github/workflows/test.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+        python-version:
+          - "3.11"
+          - "3.12"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run tests
+        run: python skills/solution-debranding/tests/test_scripts.py

.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.coverage
+.pytest_cache/
+.venv/
+debranding-findings.json
+release-readiness.json

CONTRIBUTING.md

@@ -0,0 +1,54 @@
+# Contributing
+
+Contribution requirements for the Solution Debranding skills.
+
+## Welcome
+
+Pull requests are welcome — bug fixes, new scanner detections, and documentation
+improvements all help. Open an issue first if you want to discuss a larger change.
+
+## Ground rules
+
+* Use fictional organizations and reserved example domains in tests and docs
+* Never commit real brand names, credentials, or production identifiers
+* Preserve the plan → apply → verify separation
+* Add or update a test for behavioral changes
+
+## Run the tests
+
+```bash
+git clone https://github.com/lshade/solution-debranding.git
+cd solution-debranding
+python skills/solution-debranding/tests/test_scripts.py
+```
+
+No dependencies beyond Python 3.11+ and Git.
+
+For release checks, also run:
+
+```powershell
+python skills\solution-debranding\scripts\scan-debranding.py `
+  --root skills `
+  --source-customer <source-customer> `
+  --no-derive-terms `
+  --history-path <artifact-root> `
+  --fail-on-blocking `
+  --summary
+python skills\solution-debranding\scripts\check-readiness.py `
+  --root . `
+  --workflow-artifact-path <artifact-root>
+```
+
+## What makes a good PR
+
+* Describe what broke, the smallest fix, and what you ran to validate it
+* Keep it focused — one change per PR
+* This tool handles sensitive content, so reviewers will check that matched
+  values stay redacted, fixtures are fictional, and approval gates are not
+  weakened
+
+## Reporting security issues
+
+Do not file security problems as public issues. Use
+[GitHub private vulnerability reporting](https://github.com/lshade/solution-debranding/security/advisories/new)
+and include the affected script, impact, and a redacted proof of concept.

README.md

@@ -1 +1,252 @@
-# solution-debranding
+# 🧹 Solution Debranding
+
+Three agent skills that coordinate a plan → apply → verify workflow for
+removing brand-specific identity from a codebase. You get a scan of everything
+that needs to change (names, tenant IDs, credentials, internal APIs,
+infrastructure, and Git history), a plan that tracks approvals and evidence,
+one-change-at-a-time application so nothing slips through in bulk, and an
+independent audit to verify the result.
+
+[✨ When it fits](#when-it-fits) · [⚙️ How it works](#workflow-stages) ·
+[📦 Install](#installation) · [🚀 Try it](#try-it) ·
+[🛡️ Safety](#safety-constraints) · [❓ FAQ](#faq) ·
+[🤝 Contributing](#contributing)
+
+## When it fits
+
+### Reuse and resale
+
+* 🔄 **Reuse across brands.** Reuse a solution without shipping the first brand's
+  name, tenant IDs, or API keys
+* 🏷️ **White-label a product.** Load each deployment's logo, palette, and name
+  from configuration instead of hardcoded values
+* 🧬 **Extract a shared platform.** Find where the original tenant leaked into
+  common code
+
+### Handover and ownership transfer
+
+* 📤 **Hand over or open-source.** Remove your firm's internal tooling, planning
+  records, and credentials before transfer
+* 🤝 **Offboard a contractor.** Remove references, agent configuration, and
+  planning artifacts left in the codebase
+* 🏢 **Transfer between teams.** Remove hostnames, distribution lists, and
+  on-call details owned by the original business unit
+
+### Rebranding and design
+
+* 🎨 **Adopt a design system.** Rebrand through Fluent 2, Carbon, Material, or
+  another system using its supported theming contract
+
+### Compliance and release
+
+* 🔍 **Assess public-release readiness.** Check Git history, external surfaces,
+  datasets, and documentation
+* 📋 **Prepare acquisition evidence.** Record embedded third-party brands,
+  credentials, and tenant identity
+* 🛡️ **Protect proprietary knowledge.** Verify release authority, flag
+  customer-owned assets, and detect decision history and datasets that leak
+  architecture or PII
+* 🌍 **Change deployment region.** Untangle region-specific endpoints,
+  certificates, and identity providers before deploying elsewhere
+
+### Development workflow
+
+* 🍴 **Clean a fork.** Remove organization-specific changes before contributing
+  upstream or publishing it
+* 🎤 **Prepare a demo.** Avoid exposing a real customer's data, tenant IDs, or
+  environment configuration
+
+## Workflow stages
+
+| Stage     | Skill                            | What it does                                                                                                  |
+|-----------|----------------------------------|---------------------------------------------------------------------------------------------------------------|
+| 📋 Plan   | `/solution-debranding-plan`      | Scans the repository, classifies findings, and creates an implementation plan without changing product code. |
+| ✏️ Apply  | `/solution-debranding-apply`     | Executes approved units in dependency order, validating each before the next, and records the evidence in the plan. |
+| ✅ Verify | `/solution-debranding-verify`    | Runs independent scans and checks, then reports failures without remediating them.                            |
+
+The plan is the shared record for decisions, approvals, changes, and residual
+risks across all three stages.
+
+Plan mode goes beyond literal matches when the outcome calls for it. A
+multi-lens coupling review finds customer-specific logic, data models, and
+authorization patterns that survive a plain rename, and a modernization pass
+recommends portable alternatives for brand-specific gateways, identity
+providers, and platform services. Findings outside the current run's scope
+route to the track that owns them (deployment, modernization, security)
+instead of being silently dropped.
+
+## Prerequisites
+
+The target repository can use any language or framework. Mixed Python, .NET,
+Java, JavaScript, infrastructure, and documentation repositories are supported.
+
+* 🐍 Python 3.11 or later for the bundled scripts
+* 🔀 Git for repository discovery and delta scans
+* 🤖 GitHub Copilot, Claude Code, or another agent that discovers `SKILL.md` packages
+* 🔐 Gitleaks or TruffleHog on `PATH` when certifying Git history for public release
+
+The Python scripts use only the standard library. No package installation is required.
+
+## Installation
+
+Clone the repository and copy the `skills/` directory into your project:
+
+**Claude Code:**
+
+```bash
+git clone https://github.com/lshade/solution-debranding.git /tmp/solution-debranding
+cp -r /tmp/solution-debranding/skills/* .claude/skills/
+```
+
+**GitHub Copilot:**
+
+```bash
+git clone https://github.com/lshade/solution-debranding.git /tmp/solution-debranding
+cp -r /tmp/solution-debranding/skills/* .github/skills/
+```
+
+**Other agents:**
+
+```bash
+git clone https://github.com/lshade/solution-debranding.git /tmp/solution-debranding
+cp -r /tmp/solution-debranding/skills/* <your-skills-directory>/
+```
+
+This installs four sibling directories:
+
+```text
+skills/
+   solution-debranding/
+   solution-debranding-plan/
+   solution-debranding-apply/
+   solution-debranding-verify/
+```
+
+> [!IMPORTANT]
+> Install all four sibling directories without flattening them. The stage skills
+> resolve the shared package by relative path.
+
+## Try it
+
+Strip a brand and prepare for public release:
+
+```text
+/solution-debranding-plan Contoso scope=full release-scope=public
+```
+
+Strip a brand and rebrand with a design system:
+
+```text
+/solution-debranding-plan Contoso scope=full design-system=https://fluent2.microsoft.design/
+```
+
+Keep the current brand but adopt a design system:
+
+```text
+/solution-debranding-plan Contoso scope=branding design-system=https://carbondesignsystem.com/
+```
+
+White-label for a new organization:
+
+```text
+/solution-debranding-plan Contoso scope=full target=Northwind
+```
+
+Scan first and see what would need to change:
+
+```text
+/solution-debranding-plan Contoso scope=full
+```
+
+Then apply and verify:
+
+```text
+/solution-debranding-apply docs/debranding/2026-08-26-001-contoso-plan.md
+/solution-debranding-verify docs/debranding/2026-08-26-001-contoso-plan.md
+```
+
+## Generated evidence
+
+Each run produces one plan file under `ARTIFACT_ROOT` (default: `docs/debranding/`).
+The plan carries the summary, implementation units, assessment, and validation
+evidence. See the
+[full artifact format](./skills/solution-debranding/references/artifacts.md).
+
+## Safety constraints
+
+* 📋 Plan never modifies product code
+* ✅ Apply requires an existing plan and recorded approvals
+* 1️⃣ Apply changes one unit at a time
+* 🚫 Verify reports failures without fixing them
+* 🔒 Git history, credentials, and external systems require explicit authorization
+
+Read the
+[full safety contract](./skills/solution-debranding/SKILL.md#non-negotiable-rules).
+
+## Integration with other planning workflows
+
+Solution Debranding is designed to coexist with plan-driven workflows like
+[Compound Engineering](https://github.com/EveryInc/compound-engineering-plugin).
+It treats planning artifacts from other skills (`docs/plans/`, `docs/solutions/`,
+`docs/brainstorms/`, etc.) as history records, scanning them for brand exposure
+without rewriting or deleting them. The plan phase asks you to decide the
+disposition of each planning directory (delete, anonymize, or exclude from the
+public tree) rather than silently dropping work that other workflows depend on.
+
+## FAQ
+
+<details>
+<summary>Do I need to install any Python packages?</summary>
+
+No. The scripts use only the standard library.
+</details>
+
+<details>
+<summary>Does plan mode change my code?</summary>
+
+No. Plan mode scans and writes a plan artifact. It does not touch product,
+configuration, or infrastructure files.
+</details>
+
+<details>
+<summary>Does debranding remove copyright or license notices?</summary>
+
+Not automatically. The workflow reports copyright, ownership, attribution,
+bundled fonts, and licensed assets for review. It does not remove legitimate
+third-party names, licenses, standards, or required attribution. Confirm that
+you have authority to change or redistribute each item before approving it.
+</details>
+
+<details>
+<summary>What agents are supported?</summary>
+
+Any agent that discovers `SKILL.md` packages. The package avoids agent-specific
+APIs, but discovery and invocation syntax can differ between agents.
+</details>
+
+<details>
+<summary>Can I provide a design system for the replacement brand?</summary>
+
+Yes. Pass `design-system=https://fluent2.microsoft.design/` (or any structured
+system URL) to `/solution-debranding-plan`. The plan first identifies the real
+consumer and supported theming API, then maps only the values that integration
+requires. If the repository has no design-system consumer, the plan asks whether
+adoption is actually in scope instead of generating an unused token layer.
+</details>
+
+<details>
+<summary>What if the scanner finds nothing but I know there is branding?</summary>
+
+The scanner detects literals, opaque identifiers, and tenant-specific
+authorities. It does not detect coupling that survives renaming. Run the coupling
+review documented in the shared skill's references for semantic analysis.
+</details>
+
+## Contributing
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for validation commands and submission
+guidelines.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).