[manuamest]

Brings the repository up to the standard a public repo needs: a licence chosen on evidence, pinned dependency versions, a contributing guide, a reviewed .gitignore, and a root README that did not exist before.

Documentation and dependency metadata only. No code changes, no Spanish comments touched.

---

Licence audit → MIT

Measured before deciding, not assumed.

cd frontend && npm ci && npx license-checker --production --summary
pip install -e './backend[dev]' pip-licenses && pip-licenses

Python (backend[dev], 6 packages): MIT ×4, BSD-2-Clause, Apache-2.0 OR BSD-2-Clause. All permissive.

Node, shipped set (--production, 32 packages): MIT ×21, Apache-2.0 ×5, ISC ×2, BSD-3-Clause, 0BSD, CC-BY-4.0, LGPL-3.0-or-later. Adding dev dependencies (350 packages) brings in only BSD-2-Clause ×7, MPL-2.0, Python-2.0, CC0-1.0 and BlueOak-1.0.0.

Only two entries are not plainly permissive, and neither blocks MIT:

• @img/sharp-libvips-linux-x64 — LGPL-3.0-or-later. The prebuilt libvips binary behind sharp, which next declares as an optional dependency for image optimisation. Separate platform-specific npm package, loaded dynamically at runtime, not vendored here, not statically linked, not bundled into the shipped JavaScript. Using an LGPL library that way puts no obligation on the licence of the work that uses it.
• caniuse-lite — CC-BY-4.0. A browser-support dataset used at build time; none of it is redistributed.

LICENSE added — MIT, 2026 STACKSPECT. The full audit is written into the README's dependency section.

Dependency versions

• frontend/package.json: ^ ranges closed to the versions package-lock.json had already resolved (@supabase/supabase-js 2.116.0, @tanstack/react-query 5.103.1, @types/*, eslint 9.39.5, typescript 5.9.3). Added engines.node >=22 <23 (the major CI uses) and license: MIT.
• npm install --package-lock-only changed only the lockfile's root mirror entry — zero packages added or removed, zero resolved versions changed. Verified by diffing the package map before and after.
• backend/pyproject.toml: dev extras pinned to pytest==9.1.1, ruff==0.16.8. The runtime dependencies = [] list is untouched — the SDK stays dependency-free on purpose.
• No requirements.txt added.

CONTRIBUTING.md

Written from what the repo actually does: dev as the integration branch, conventional commits with Spanish subjects (documented as practised, with real examples from the history), dev.sh, the checks, and what CI enforces. Carries over the rules from AGENTS.md that cost the most in review — no Tailwind, colours only from styles/colors.css, and that npm run lint is eslint plus check-colors.mjs and check-contrast.mjs.

.gitignore

Reviewed, not rewritten; every existing comment preserved. One genuine gap:

• .claude/settings.local.json was ignored only through this clone's .git/info/exclude, which does not travel with the repository — a fresh public clone would have offered it for commit.
• Also corrected the secrets comment, which still described the frontend/.env.local that refactor(front): un solo .env deliberately removed.

README.md

Brand header from the assets already in the repo, badges, a Mermaid architecture diagram, both screenshots, and installation/usage derived from dev.sh — its six steps, the three SQL files, the three backend/seed/ generators, backfill.py, and the SDK's two write paths. Plus the security note: SUPABASE_SERVICE_KEY bypasses RLS and must never reach the browser.

frontend/README.md's create-next-app boilerplate replaced with a short pointer up.

---

Three things that need a second pair of eyes

1. Derived light-theme brand variants. frontend/public/brand/{mark,wordmark}.png are white on transparent — the app uses them as CSS masks coloured by --logo, so they are invisible on GitHub's light background. I derived black variants from those same files (alpha-preserving colour inversion, no new artwork) as docs/img/{mark,wordmark}-light.png and serve each theme with <picture>. Happy to drop them if you would rather solve it another way.

2. AGENTS.md had stale facts that would have contradicted the new README: it listed /runs/[id] and /runs/[id]/[seed] as pending when both ship and the build compiles them, and omitted 003_snapshots.sql, which dev.sh probes for. Corrected under its own "corrígelo en el mismo PR" rule.

3. humo_live.py does not set synthetic — it writes through RunLog, which never touches the column, and 002_design.sql defaults it to false. Its smoke-test run therefore reads as measured data. I had written the broader claim into the README and corrected it (51746c3), but the underlying inconsistency is real and out of scope here: a smoke-test run that reads as measured is exactly what the project's own rules exist to prevent. Worth a follow-up issue. The captain's project currently has no humo-live runs, so nothing is affected today.

---

Screenshots

Captured at 1440×1000 from the running app against the real project, in both themes, served as theme-aware <picture> pairs. Reviewed and approved before commit.

The Runs shot deliberately has two runs selected so the comparison panel shows "No comparable" with its reasons — an empty "select 2 runs" state demonstrates nothing, and blocking a bad comparison is the feature that distinguishes this platform. The episode shot is a measured, oracle run, and the caption says so rather than letting those numbers read as a full pipeline's.

Verification

Run on the final tree, exactly what CI runs:

Check	Result
npm ci && npm run lint && npm run build	green
ruff check backend	green
pytest backend -q with DATABASE_URL → throwaway postgres:16	116 passed
Every README/CONTRIBUTING link and image path	resolves
Mermaid diagram	rendered with mmdc to confirm it parses and lays out
git status after a full build	clean

Every command quoted in the README has actually been run, apart from git clone.

The .env used for the screenshots was never committed (.gitignore:5, verified before staging) and has been shredded from the worktree.