Summary

Structural polish for the repo now that it has public traction. Adds the community files drive-by contributors expect and tidies the root. Content is sourced from existing canonical docs — no duplicated rules. No Python source edits.

Reduced from the previous version of this PR per maintainer feedback — see "Changes since previous revision" at the bottom.

What's in

Structural reorg

• DEPLOYMENT.md, VIBE_CODING.md, CONVERSATIONS.md moved into docs/
• Inbound links in README.md fixed
• Project-structure tree block updated to reflect the new layout

Community files (thin pointers, no new rules)

• CONTRIBUTING.md → points at ENGINEERING_PRINCIPLES.md + CLAUDE.md's "Required tests on every PR"
• SECURITY.md → contact@transilience.ai, 48 h / 7 d / 30 d
• CODE_OF_CONDUCT.md → Contributor Covenant v2.1 by reference

.github/ scaffolding

• ISSUE_TEMPLATE/bug_report.yml, feature_request.yml, new_check_proposal.yml (encodes Principles 3/4/6/7 at intake), config.yml (blank_issues_enabled: false + mailto security link)
• pull_request_template.md requires Closes #N + a principles checklist mirroring CLAUDE.md

README hero
Centered block with 5 badges (CI, License, Python, Stars, Powered by Claude), pipe-separated nav row, contrib.rocks contributors section near the bottom. The 865-line body is byte-identical except for the 3 inbound-link fixes, the tree-block update, and one pre-existing drift fix: the tree-block claim 515+ tests was stale (actual 514), updated to 500+.

pyproject.toml metadata
authors, license, readme, keywords, classifiers, [project.urls]. Improves PyPI / GitHub sidebar discoverability. No runtime dep changes, no lint config changes, no packaging-layout changes.

What's deliberately NOT in

• No Python source edits. git diff main...HEAD -- src/ tests/ is empty.
• No CI workflow edits. git diff main...HEAD -- .github/workflows/ is empty.
• No docs/INCIDENT_RESPONSE.md. Removed per maintainer + user feedback. An SLA-backed incident runbook with Sev-1/2/3 tables and named roles is the wrong shape for a small-team OSS scanner with no on-call. Shasta-the-project isn't an audited entity — trying to frame an internal runbook as "evidence for SOC 2 CC7.3 / ISO 27001 A.5.24" is the same scanner-vs-audited-entity category error the tool is supposed to fix for customers. SECURITY.md's 48 h / 7 d / 30 d reporter SLAs stand alone.
• No ruff config changes, no E501 ignore, no auto-formatting passes. Those were mixed in via the previous revision and have been fully reverted.
• No pyproject.toml force-include fix. The broken force-include pointing at src/whitney/code/rules (deleted in 4873079) is still there as of this PR, unchanged from main. That fix should ride its own PR with a post-mortem.

Pre-existing issues acknowledged but out of scope

The integrity workflow has been red on main since it was introduced on 2026-04-09 (every run since 24215229845). Three independent problems contribute to that, all predate this PR, and none are addressed here:

1. pyproject.toml force-include points at src/whitney/code/rules which was deleted in 4873079. pip install -e . fails at the metadata generation step.
2. pycairo transitive dep via xhtml2pdf → svglib → rlpycairo → pycairo needs system cairo + pkg-config on the CI runner.
3. Pre-existing ruff drift — 1054 errors and 25 unformatted files on main, none of them in files this PR touches.

Each of these deserves its own focused PR. I'd also suggest a short post-mortem on principle #1 ("numbers in docs are tests") — the build was red for 6 days and the team didn't notice, which is the same failure mode the integrity workflow exists to prevent.

Test plan

• git diff main...HEAD -- src/ tests/ — empty
• git diff main...HEAD -- .github/workflows/ — empty
• git diff main...HEAD -- pyproject.toml — metadata-only
• grep -rE 'INCIDENT_RESPONSE' README.md SECURITY.md CONTRIBUTING.md CODE_OF_CONDUCT.md docs/ — zero matches
• tomllib parse of pyproject.toml
• yaml.safe_load of all 4 issue forms
• After merge: file one dummy issue via each of the 3 templates to confirm forms render and labels auto-apply
• After merge: open a dummy PR to confirm the PR template auto-populates
• After merge: confirm README hero renders centered with clickable badges + nav row on github.com