Public package and publication checklist

Project name and publication-folder name: PatchCairn.

A public GitHub repository-name search on 2026-10-23 at approximately 19:15 UTC returned no public results for PatchCairn. This was a dated public search, not reservation of a repository name, a private-repository check, or trademark clearance.

Public query: https://github.com/search?q=PatchCairn%20in%3Aname%20is%3Apublic&type=repositories

Repository names are scoped to an owner's namespace. The person publishing must choose their own owner/account and check availability at that time. No laptop account, remote URL or private identity is hardcoded in the toolkit. The public attribution Developed by Michael is intentional.

What belongs in the public package

• Reusable instructions, skill, scripts/native source, templates and schema/allowlist.
• Fictional reusable test fixtures with unmistakable fixture labels.
• Platform references with source links and accurate capability/test limits.
• Security/privacy guidance and a version identity that contains no machine facts.

Do not include work/, run ledgers, real inventories, screenshots, local logs, exports of another computer, credentials, editor state, private configuration, recovery copies or .git/ in the portable archive or clean delivery folder. Keep development history out of the delivery. A future authorized publication starts from the reviewed source in a fresh repository with a separately authorized initial UTC commit; do not copy the development repository's Git directory or history.

Before any upload

1. Run fixture safety/parity tests and independent security/compatibility reviews. Record precisely which platforms and behaviors were actually tested.
2. Create the source-only export through the exact allowlist.
3. Inspect the archive entries and included text. Check for personal names, usernames, account/host identifiers, absolute local paths and secret indicators without echoing suspected values.
4. Check that documentation does not claim current CVE coverage, actual-machine testing or universal unattended support that was not performed.
5. Preserve the owner's selected MIT License, copyright 2026 Michael, with the source package. The licensing decision is complete and does not authorize uploading, creating a repository, or changing an account. See GitHub's licensing guidance.
6. Review the final owner/name, file list, visibility and publishing command. Obtain owner authorization before creating a remote/repository or pushing.

Publishing a public source toolkit does not authorize uploading any person's maintenance run. External vulnerability research should use public product identifiers, not full private inventories or diagnostic logs.

Support expectations

The four workflows use a deterministic session engine, mode skills and a checked adapter service. Python and PowerShell assessment-record helpers are components of this same product. Test evidence must name the actual host, runtime, filesystem and scope. Fixed or mocked macOS contracts do not establish native Mac behavior; a committed CI matrix is not an executed result. Missing elevation, a locked desktop, unavailable tools or unsupported capabilities produce an explained hold. See platform support.

See docs/GITHUB_SETUP.md for the suggested description, topics, repository branding and beginner-facing presentation. The root README is the canonical landing page. The selected wordmark lives in assets/; private design exploration stays under work/. Follow docs/UTC_PUBLICATION.md before creating a publication commit or annotated tag.

The GitHub Pages workflow builds a static documentation site from exact public source files. It never publishes work/, machine inventories or run reports, and it contains no live maintenance controls. Building the site locally does not enable Pages or publish a repository. A reviewed owner explicitly starts deployment after configuring the hosting repository.

The workflow is intended to assist systematic maintenance and diagnosis. It does not guarantee complete vulnerability discovery, unique original-cause identification or a risk-free update.

Developed by Michael. Private session records belong locally under work/; this public guide contains no live computer records.