Prepare repo for public open-source release

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default owners for review routing after the repo is public.
+# Adjust GitHub handles as maintainers prefer.
+* @Modsofthenation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,54 @@
+name: Bug report
+description: Something is broken or unsafe
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a bug. **Do not** report security vulnerabilities here — see [SECURITY.md](https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/SECURITY.md).
+        Never paste real employee PII, vault dumps, or live API keys.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What went wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps with synthetic / demo data only
+      placeholder: |
+        1. Create empty workspace…
+        2. …
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface
+      options:
+        - Browser (pnpm dev)
+        - Packaged desktop
+        - API / MCP only
+        - Unsure
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: Tag, commit SHA, or “main @ <date>”
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / errors
+      description: Redact secrets. Desktop API log is under the OS app-data directory (e.g. %APPDATA%\\com.prm.workbench\\desktop-api.log).

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Modsofthenation/PerformanceReviewManager/security/advisories/new
+    about: Report security issues privately (do not file a public issue). See SECURITY.md.
+  - name: Product docs
+    url: https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/docs/PRODUCT_BRIEF.md
+    about: Scope, trust model, and v1 non-goals before requesting features.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Propose a product or DX improvement
+title: "[feat] "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Prefer aligning with [docs/PRODUCT_BRIEF.md](https://github.com/Modsofthenation/PerformanceReviewManager/blob/main/docs/PRODUCT_BRIEF.md) and the solo-EM trust model.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What EM workflow is painful today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: Concrete behavior change (not just “make AI better”)
+    validations:
+      required: true
+  - type: dropdown
+    id: mode
+    attributes:
+      label: Mode
+      options:
+        - Workbench (local solo EM)
+        - Import-path collaboration
+        - Hosted-only (out of v1)
+        - Unsure
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      production-minor:
+        dependency-type: production
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: "/apps/desktop/src-tauri"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.gitignore

@@ -1,6 +1,7 @@
 node_modules
 dist
 data/
+**/.session
 .DS_Store
 *.log
 .env

AGENTS.md

@@ -26,6 +26,6 @@ Performance Review Manager — a local, single-user ("solo EM") pnpm monorepo. S
 
 ### Cursor MCP (`@prm/mcp`)
 - Stdio MCP for bulk-loading dossier evidence into the local API: `pnpm mcp` (or `pnpm --filter @prm/mcp start`).
-- Requires API on `127.0.0.1:8787`; unlocks with `PRM_PASSWORD` (default `workbench`).
+- Requires API on `127.0.0.1:8787`. Unlock via `prm_unlock` or set `PRM_PASSWORD` to the workspace password — there is **no** built-in demo default (demo vaults often use `workbench`, but never assume that for real data).
 - Setup example: `.cursor/mcp.json.example` and `packages/mcp/README.md`.
 - Typical flow with other MCPs (Jira/Google): fetch externally → `prm_bulk_load_evidence` / `prm_upload_document` here.

CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to Performance Review Manager are documented here.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Versions follow [SemVer](https://semver.org/) (`0.1.0-alpha.x` while the public API and packaging are still settling).
+
+## [Unreleased]
+
+### Added
+
+- Dedicated **Desktop Installers** and **Release** GitHub Actions workflows
+- Public-release checklist (`docs/PUBLIC_RELEASE.md`) and clearer vulnerability reporting guidance
+
+### Changed
+
+- Settings → Check for updates explains missing GitHub Releases (404) instead of a generic failure
+- MCP / AGENTS docs no longer imply a silent `PRM_PASSWORD=workbench` default
+
+### Fixed
+
+- Committed Tauri `gen/schemas/capabilities.json` aligned with source capabilities (no `shell:allow-open`)
+
+## [0.1.0-alpha.1] - TBD
+
+First tagged alpha intended for GitHub Releases via Actions → **Release**.
+
+### Notes
+
+- Unsigned desktop installers only
+- Demo vault password `workbench` is exploration-only
+- Merge gate remains `pnpm -r typecheck` + `pnpm test`

CONTRIBUTING.md

@@ -41,11 +41,13 @@ Production `pnpm build` may still have packaging rough edges; typecheck + tests
 
 ## Desktop
 
-Desktop installers are **not** built on every merge. Use Actions → **Desktop Installers** → **Run workflow** (defaults to Windows + Linux). See `apps/desktop/README.md`.
+Desktop installers are **not** built on every merge. Use Actions → **Desktop Installers** → **Run workflow** (defaults to Windows + Linux), or Actions → **Release** to attach installers to a GitHub Release. See `apps/desktop/README.md`.
 
 ## Security
 
-Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md). Do not file public issues that include exploit detail for unfixed flaws.
+Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md) (prefer GitHub private vulnerability reporting when enabled). Do not file public issues that include exploit detail for unfixed flaws.
+
+Maintainer checklist before making the repo public: [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md).
 
 ## Code of conduct
 

README.md

@@ -249,16 +249,18 @@ Regenerate with `pnpm screenshots` (UI + API running; demo password `workbench`)
 - **Sprint pulse** for date-window coaching
 - **Eight accents × dark/light** appearance system (Coral, Amber, Magenta, Citrus plus Teal, Ocean, Forest, Slate)
 - **AI**: digests, section draft, peer synthesize, chat, with citation allowlist
-- **Desktop** packaging (Tauri); installers via Actions → **Desktop Installers** → **Run workflow**
-- **Delete / recreate workspace** from Unlock or Settings
+- **Desktop** packaging (Tauri); installers via Actions → **Desktop Installers** or tagged **Release**- **Delete / recreate workspace** from Unlock or Settings
 
 ## Docs
 
-Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Theme matrix: [`docs/screenshots/THEMES.md`](./docs/screenshots/THEMES.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md).
+Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Theme matrix: [`docs/screenshots/THEMES.md`](./docs/screenshots/THEMES.md). Public flip checklist: [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md).
 
 ## License & community
 
 - License: [`LICENSE`](./LICENSE) (MIT)
+- Third-party notices (bundled Node sidecar): [`THIRD_PARTY.md`](./THIRD_PARTY.md)
+- Changelog: [`CHANGELOG.md`](./CHANGELOG.md)
 - Security reports: [`SECURITY.md`](./SECURITY.md)
 - Contributing: [`CONTRIBUTING.md`](./CONTRIBUTING.md)
 - Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md)
+- Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md)

SECURITY.md

@@ -27,15 +27,23 @@ What PRM does **not** claim today:
 - Automatic refusal of Dropbox / iCloud / OneDrive data directories (warn when detected; sync folders remain risky)
 - Cryptographic anonymity for peer feedback
 - Tamper-proof legal custody of the activity log (hash-chained and HMAC-exportable, but the EM can re-sign after unlock)
-- Signed auto-update for desktop installers (manual **Desktop Installers** artifacts; verify checksums yourself)
+- Signed auto-update for desktop installers (manual **Desktop Installers** / **Release** artifacts; verify checksums yourself)
 
 Details: [`docs/architecture/TRUST_MODEL.md`](./docs/architecture/TRUST_MODEL.md).
 
 ## Reporting a vulnerability
 
 **Do not open a public GitHub issue for security vulnerabilities.**
 
-Email **[email protected]** with:
+### Preferred: GitHub private vulnerability reporting
+
+If [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) is enabled on this repository, use **Security → Report a vulnerability** (or open a draft Security Advisory). That keeps PoCs out of the public issue tracker and gives maintainers a private thread.
+
+Maintainers: enable it under **Settings → Code security → Private vulnerability reporting** before or when making the repo public. See [`docs/PUBLIC_RELEASE.md`](./docs/PUBLIC_RELEASE.md).
+
+### Fallback: email
+
+If private reporting is unavailable, email **[email protected]** with:
 
 1. A clear description of the issue and impact
 2. Steps to reproduce (PoC welcome; keep payloads minimal)

THIRD_PARTY.md

@@ -0,0 +1,24 @@
+# Third-party notices
+
+Performance Review Manager is MIT-licensed (see [`LICENSE`](./LICENSE)). Packaged desktop builds may also ship the following redistributed components:
+
+## Node.js (desktop API sidecar)
+
+When building installers with `PRM_BUNDLE_NODE=1` / `bundle-api-sidecar.mjs --node`, a portable **Node.js** binary is copied next to `prm-api.mjs` under `apps/desktop/src-tauri/sidecars/`.
+
+- Project: [nodejs/node](https://github.com/nodejs/node)
+- License: MIT (see Node’s `LICENSE` in the upstream release tarball)
+- Purpose: runtime for the bundled Hono API sidecar inside the Tauri app
+
+Node is **not** modified; it is redistributed as a binary dependency of the desktop package.
+
+## better-sqlite3 (native binding)
+
+The sidecar copies the `better-sqlite3` package (and small helper deps such as `bindings`) into `sidecars/node_modules/` so the API can open SQLite without a system-wide install.
+
+- Package: [WiseLibs/better-sqlite3](https://github.com/WiseLibs/better-sqlite3)
+- License: MIT
+
+## Other npm / Cargo dependencies
+
+Application source depends on many MIT/Apache-2.0 (and similar) libraries declared in the root `pnpm-lock.yaml` and `apps/desktop/src-tauri/Cargo.lock`. Those licenses apply to their respective packages; this notice only calls out binaries/resources that are **copied into** desktop installer artifacts beyond normal node_modules resolution at build time.

apps/api/package.json

@@ -24,5 +24,6 @@
     "@types/node": "^22.13.10",
     "tsx": "^4.19.3",
     "typescript": "^5.8.2"
-  }
+  },
+  "license": "MIT"
 }

apps/desktop/README.md

@@ -44,7 +44,7 @@ On Windows the Node child is spawned with `CREATE_NO_WINDOW`. Sidecar stdout/std
 
 ### Updates
 
-Settings → **Check for updates** compares the packaged version (`get_app_version` IPC) to the latest GitHub Release. Fully signed silent auto-update still needs `tauri-plugin-updater` + CI signing keys.
+Settings → **Check for updates** compares the packaged version (`get_app_version` IPC) to the latest GitHub Release. If no release exists yet (404), the UI says so and points at the **Release** / **Desktop Installers** workflows. Fully signed silent auto-update still needs `tauri-plugin-updater` + CI signing keys.
 
 Packaged data lives in the OS app-data directory (for example `%APPDATA%\com.prm.workbench` on Windows). Sidecar stdout/stderr is appended to `desktop-api.log` there for debugging startup failures.
 

apps/desktop/package.json

@@ -13,5 +13,6 @@
   "devDependencies": {
     "@tauri-apps/cli": "^2.4.0",
     "esbuild": "^0.25.12"
-  }
+  },
+  "license": "MIT"
 }

apps/desktop/src-tauri/Cargo.toml

@@ -3,6 +3,7 @@ name = "prm-desktop"
 version = "0.1.0-alpha.1"
 description = "Performance Review Manager desktop shell"
 authors = ["Damon van der Linde"]
+license = "MIT"
 edition = "2021"
 
 [build-dependencies]

apps/desktop/src-tauri/gen/schemas/capabilities.json

@@ -1 +1,13 @@
-{"default":{"identifier":"default","description":"Default permissions for the EM workbench window","local":true,"windows":["main"],"permissions":["core:default","shell:allow-open"]}}
+{
+  "default": {
+    "identifier": "default",
+    "description": "Default permissions for the EM workbench window — no shell/open IPC",
+    "local": true,
+    "windows": ["main"],
+    "permissions": [
+      "core:default",
+      "allow-get-launch-config",
+      "allow-get-app-version"
+    ]
+  }
+}

apps/ui/package.json

@@ -21,5 +21,6 @@
     "@vitejs/plugin-react": "^4.3.4",
     "typescript": "^5.8.2",
     "vite": "^6.2.2"
-  }
+  },
+  "license": "MIT"
 }

apps/ui/src/pages/SettingsPage.tsx

@@ -604,7 +604,7 @@ export function SettingsPage({
         id="settings-desktop"
         title="Desktop updates"
         when="Use on packaged desktop builds when you want to know if a newer installer is available."
-        how="Check GitHub Releases for the latest tag versus your installed version; signed auto-update needs Tauri updater keys in CI."
+        how="Compares your installed version to the latest GitHub Release tag. This is a manual check only — signed silent auto-update needs Tauri updater keys in CI."
         action={
           <button
             type="button"
@@ -626,19 +626,33 @@ export function SettingsPage({
                   "https://api.github.com/repos/Modsofthenation/PerformanceReviewManager/releases/latest",
                   { headers: { Accept: "application/vnd.github+json" } },
                 );
+                if (res.status === 404) {
+                  setMsg(
+                    `Installed app version ${localVersion}. No public GitHub Release yet — maintainers can publish one via Actions → Release, or build unsigned installers via Actions → Desktop Installers.`,
+                  );
+                  return;
+                }
                 if (!res.ok) {
-                  setMsg(`Could not reach GitHub releases (${res.status}). Download artifacts from Actions on main.`);
+                  setMsg(
+                    `Could not reach GitHub Releases (${res.status}). Try again later, or download unsigned installers from Actions → Desktop Installers / Release.`,
+                  );
                   return;
                 }
-                const json = (await res.json()) as { tag_name?: string; html_url?: string; name?: string };
+                const json = (await res.json()) as {
+                  tag_name?: string;
+                  html_url?: string;
+                  name?: string;
+                  prerelease?: boolean;
+                };
                 const tag = json.tag_name ?? json.name ?? "unknown";
+                const pre = json.prerelease ? " (pre-release)" : "";
                 setMsg(
-                  `Installed app version ${localVersion}. Latest GitHub release: ${tag}. ${json.html_url ?? ""}`,
+                  `Installed app version ${localVersion}. Latest GitHub release: ${tag}${pre}. ${json.html_url ?? ""} — download the installer for your OS; installs are not auto-applied.`,
                 );
               } catch (e) {
                 setMsg(
                   e instanceof Error
-                    ? `${e.message} — use CI artifact desktop-windows-x86_64 / desktop-linux / desktop-macos`
+                    ? `${e.message} — use Actions artifacts desktop-windows-x86_64 / desktop-linux-x86_64 / desktop-macos-aarch64`
                     : "Update check failed",
                 );
               }
@@ -650,6 +664,7 @@ export function SettingsPage({
       >
         <p className="muted" style={{ margin: 0 }}>
           Packaged builds serve the UI from the local API (same-origin) to avoid WebView “Failed to fetch”.
+          Releases are unsigned until code signing lands — verify checksums yourself.
         </p>
       </Section>
       </PageSectionsLayout>