Make the README safe to share, and show the product instead of describing it

[thecelestialmismatch]

Description

Two problems with the README as it stood: it published operational detail that should not be public, and it described the product without ever showing it.

Removed — things a public repo should not advertise

What	Why it had to go
The "Status — honest" section	It named which production environment variables were unset and spelled out the consequence — "a paid order writes no row, sends the buyer no receipt, and raises no alert." That is a live misconfiguration map for anyone reading. Runtime health now comes from /api/health, which cannot go stale and is not a standing invitation.
AUTH_SERVER_ROUTES=off	Documented as a rollback that disables the server-side credential routes and "takes effect without a rebuild." Naming a kill switch for auth hardening, with its no-restart property, is not documentation a reader needs.
Exact lockout and timing thresholds	Attempt count, lockout window, latency floor. The control mapping stays — NIST 800-171 3.1.8 / CMMC AC.2.008 — but the tunable numbers are gone. The code is MIT and readable; the README does not need to hand over the dial settings.
Business strategy	The pricing rationale about procurement thresholds, the customer count, and the DOJ False Claims Act enforcement angle. The forward-looking roadmap link is dropped from the header for the same reason.

Added — safe, verifiable, and visual

• A mermaid architecture diagram of the interception path, with the trust boundary drawn as an explicit subgraph so the local-only claim is visible rather than asserted. Renders natively on GitHub — no build step, no new binary asset, no external host.
• The 16 detection engines as a table grouped by what they protect (defense / health / credentials / proprietary), plus a worked blocked-request example — the same curl and JSON already published in the public API docs.
• A "Compliance context" section carrying only the standing obligations the product maps to — DFARS 252.204-7012, the 110 NIST SP 800-171 Rev 2 controls, the annual SPRS self-assessment, HIPAA 45 CFR Part 164 — with certification claims pointed at /trust rather than restated.

Also corrected

• Repository map said 59 API routes; the measured count is 66.
• Screenshots are now date-stamped 2026-08-15, because the landing page changed in Make the buy path readable, and stop the outreach email misquoting its source #301 and Security: code-only password reset, evidence-first site, and production hardening #302 after they were captured. A screenshot that predates a redesign is worse than none — it still looks authoritative.
• docs/assets/README.md no longer claims production has not deployed since ⛔ BLOCKED ON A DASHBOARD SETTING — delete the repo-root vercel.json so middleware executes #288. It has.

Type of change

• Documentation update

Jordan's Test Plan (CMMC Buyer — required before merge)

• npm run build passes in compliance-firewall-agent/ — unchanged by this PR; no application file touched
• Brain AI tests pass — included in the full suite below
• No hardcoded secrets — this PR removes configuration detail, adds none
• Local-only data boundary preserved — the new diagram makes the boundary explicit
• Compliance patterns untouched — nothing under proxy/patterns/ modified
• SPRS scoring logic unchanged — documentation only
• Proxy benchmark — proxy untouched
• Supabase not used for CUI data storage — unchanged

Verification

Two markdown files changed, +109 / −44. No application code.

• Test suite passes — 2,993 passed / 212 files, 0 failures
• lib/detection/__tests__/doc-counts.test.ts scans the README against the shipped registry and passes, so the engine and pattern figures in the new table are computed truth, not prose
• Every internal link resolves; both new anchor targets exist
• Code fences balanced (8 pairs); one mermaid block

Residual-check for everything this PR set out to remove — all zero:

STRIPE_WEBHOOK_SECRET   0      600 ms floor    0
AUTH_SERVER_ROUTES      0      5 attempts      0
Zero paying customers   0      TURNSTILE       0
procurement approval    0      ENCRYPTION_KEY  0

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas — n/a, documentation
• I have made corresponding changes to the documentation — this is the documentation
• No TypeScript any types added in compliance-critical code

Note

The limitations that are genuinely useful to a reader are kept, not buried: Docker Hub publication is still pending, there is no SOC 2 report and no FedRAMP authorization, and the hosted trial is explicitly not a CUI or PHI environment. Honesty about what the product does not do is different from publishing its runtime configuration.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compliance-firewall-agent	Ready	Preview	Aug 19, 2026 7:42am

[supabase]

This pull request has been ignored for the connected project qifynzuyrdxmxlumpsrq because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.