Prepare repository for MIT public source publication

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 maximalfocus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,6 +1,8 @@
 # Echoes Between Runs
 
-A deterministic, browser-only incident simulator for exploring how discoveries can persist between fictional agent runs and where defensive controls interrupt the chain.
+Echoes Between Runs is a deterministic, browser-only incident simulator for exploring how discoveries can persist between fictional agent runs and where defensive controls interrupt the chain. It is a teaching model, not a historical reconstruction, exploit trainer, or predictor of real compromise.
+
+The bundled “The Stuck Agent” scenario presents six synchronized beats across a timeline, fictional infrastructure view, and activity feed. A guided comparison replays the same seed while changing only note visibility, then offers closed local defensive-control experiments, learning checks, and a portable JSON report.
 
 ## Development
 
@@ -11,4 +13,38 @@ npm run dev
 
 Use `npm test`, `npm run typecheck`, `npm run lint`, and `npm run build` for the repository gates.
 
-The simulator is closed by design: it contains no networking, credential validation, arbitrary URL loading, or command execution.
+## Architecture
+
+- `src/simulation/` contains authored scenario data and pure deterministic transition rules.
+- `src/ui/` renders synchronized views, comparison metrics, controls, and learning checks.
+- `src/report/` serializes paired runs into a local JSON report.
+
+Simulation state stays in the browser. There is no backend, account system, database, cloud persistence, analytics integration, or runtime dependency on an LLM.
+
+## Safety and provenance
+
+The simulator is closed by design. It contains no networking, credential validation, arbitrary URL loading, command execution, vulnerability implementation, or connection to real infrastructure. All actors, credentials, services, packages, identities, organizations, nodes, and transitions are fictional bundled data.
+
+Events display one of four provenance labels:
+
+- `sourced` for the supplied chronology represented by a beat;
+- `simulated` for authored rule-based transitions;
+- `inferred` for conclusions illustrated by the model;
+- `mixed` when a beat combines classifications and exposes event-level provenance.
+
+The baseline/defended comparison demonstrates that run-scoped notes remove one modeled cross-run inheritance edge. It does not claim universal prevention.
+
+## Report export
+
+The export button creates a JSON file locally in the browser. It contains the seed, configuration, ordered fictional event log, provenance, final infrastructure state, metrics, paired differences, assumptions, and limitations. It does not upload or submit data.
+
+## Limitations
+
+- The authored rules do not reproduce real vulnerabilities or private agent reasoning.
+- Simulated steps and time do not predict real compromise, detection, or containment timelines.
+- The project is not a cyber range, scanner, credential validator, or autonomous red-team tool.
+- Only the bundled scenario and local fictional fixtures are supported.
+
+## License
+
+Released under the [MIT License](LICENSE).

package.json

@@ -2,6 +2,7 @@
   "name": "echoes-between-runs",
   "private": true,
   "version": "0.1.0",
+  "license": "MIT",
   "type": "module",
   "scripts": {
     "dev": "vite",