[Modsofthenation]

Summary

Addresses the public-release readiness feedback so the repo can be flipped to public as an honest open-source solo-EM workbench.

Changes

Must-fix items

• AGENTS.md — MCP unlock no longer claims a silent PRM_PASSWORD=workbench default (aligned with @prm/mcp)
• Tauri capabilities — committed gen/schemas/capabilities.json matches source (core:default + launch/version IPC only; no shell:allow-open)
• SECURITY.md — prefers GitHub private vulnerability reporting / Security Advisories; email remains fallback
• Settings → Check for updates — clear 404 path when no GitHub Release exists yet; points at Release / Desktop Installers
• docs/PUBLIC_RELEASE.md — maintainer checklist for the visibility flip

Hygiene / post-public prep

• CHANGELOG.md, THIRD_PARTY.md (bundled Node sidecar)
• Issue templates + contact link for security
• Dependabot (npm / Actions / Cargo)
• CODEOWNERS, **/.session gitignore
• MIT license on workspace packages + Cargo.toml
• Doc honesty: FEATURES priorities, DELIVERY module layout, LOCAL_STACK security baseline, CORE_LOOP “this branch” wording

Maintainer action still required (cannot automate)

GitHub → Settings → Code security → enable Private vulnerability reporting (and optionally Dependabot alerts) before or when making the repo public.

After merge, optional: Actions → Release → cut 0.1.0-alpha.1 so update checks have a real latest tag.

Explicitly not in this PR

• Code signing / notarization / Tauri auto-updater keys
• OS keychain for API keys
• Fixing residual pnpm build packaging issues

Test plan

• pnpm -r typecheck
• pnpm test

  

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f0f3302-cf25-4de6-abf7-0c7daab704d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}