Establish Comic Sol Lab as canonical public repository

.github/workflows/tests.yml

@@ -2,9 +2,8 @@ name: Tests
 
 on:
   push:
-    branches: [ main, ai/post-event-development ]
-  # Every pull request, whatever its base. Restricting this to `main` meant the
-  # suite never ran in a repository whose default branch is not `main`.
+    branches: [ main ]
+  # Validate every pull request; `main` is the canonical public product branch.
   pull_request:
 
 jobs:

CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Contributing to Comic Sol
+
+`wenn-id/comic-sol-lab` is the canonical public repository for Comic Sol. Development is review-first: create a focused branch, open a pull request into `main`, and keep unrelated changes separate.
+
+## Development setup
+
+Use Python 3.11 and the pinned dependencies:
+
+```bash
+python3.11 -m venv .venv
+.venv/bin/python -m pip install -r requirements.txt -r requirements-mcp.txt
+```
+
+On Windows, use `.venv\Scripts\python.exe` in place of `.venv/bin/python`.
+
+## Required validation
+
+Run the checks relevant to the change. Before requesting merge, the complete deterministic suite must pass:
+
+```bash
+python3.11 -m unittest discover -s tests -v
+python3.11 scripts/comic_sol.py doctor --output-root /tmp/comic-sol-doctor
+python3.11 -m build
+python3.11 -m comic_sol_product.release dist/*.whl dist/*.tar.gz
+```
+
+Changes to packaging, runtime freezing, MCP, release automation, or distribution must also pass clean-install and portable-runtime smoke tests. Visual output changes require an actual before/after render and visual inspection; green geometry tests alone are insufficient.
+
+## Pull requests
+
+- Target `main`.
+- Explain user-visible behavior and migration impact.
+- Add or update deterministic tests for behavior changes.
+- Preserve the exact 17-tool MCP surface unless a separately reviewed contract change explicitly updates it.
+- Do not commit credentials, provider payloads, generated projects, build outputs, or private source material.
+- Do not weaken validation thresholds merely to make a fixture pass.
+
+All Linux, macOS, and Windows CI checks must pass before merge. Releases are created only from reviewed commits already merged into `main`.
+
+## Reporting defects
+
+Use GitHub Issues for reproducible non-security bugs and feature requests. For vulnerabilities or accidental exposure of sensitive information, follow `SECURITY.md` instead of opening a public issue.

README.md

@@ -6,6 +6,10 @@ invocation drives planning, character consistency, image generation, visual QA,
 selective repair, deterministic lettering and composition, and PDF export. It is
 not a web app or hosted product. No build service is required.
 
+This repository, [`wenn-id/comic-sol-lab`](https://github.com/wenn-id/comic-sol-lab),
+is the canonical, independent home of Comic Sol. New development, issues, pull
+requests, documentation, and releases happen here.
+
 ## Install
 
 Requirements are Python 3.11 and `Pillow==12.3.0`. Image creation additionally
@@ -16,7 +20,7 @@ Clone the public repository directly into the Codex skills directory, then insta
 the one pinned dependency:
 
 ```bash
-git clone https://github.com/wenn-id/comic-sol.git \
+git clone https://github.com/wenn-id/comic-sol-lab.git \
   "${CODEX_HOME:-$HOME/.codex}/skills/comic-sol"
 cd "${CODEX_HOME:-$HOME/.codex}/skills/comic-sol"
 python3.11 -m pip install -r requirements.txt
@@ -29,7 +33,7 @@ beneath the Codex skills directory configured by your Codex installation. Keep
 Windows PowerShell:
 
 ```powershell
-git clone https://github.com/wenn-id/comic-sol.git `
+git clone https://github.com/wenn-id/comic-sol-lab.git `
   "$env:USERPROFILE\.codex\skills\comic-sol"
 Set-Location "$env:USERPROFILE\.codex\skills\comic-sol"
 py -3.11 -m pip install -r requirements.txt
@@ -195,8 +199,9 @@ than silently dropped. The `--font` option still overrides the regular dialogue
 its bold counterpart may fall back to Comic Neue Bold.
 
 Pillow fits dialogue into adaptive oval balloons, attaches each tail at the nearest
-oval boundary toward its target, and keeps tails short enough to avoid crossing faces
-or focal action. It also draws compact light caption strips sized to their text.
+oval boundary toward a validated speaker or device anchor, and renders a tapered
+organic cubic tail that stops before the voice source. It also draws compact light caption
+strips sized to their text.
 Authored SFX takes the other half of the hybrid pipeline: the image model draws
 the exact SFX into the artwork, and visual QA verifies spelling, count, and authorization.
 Pillow validates and counts SFX but reserves no placement and changes no pixels for it.
@@ -288,3 +293,9 @@ Comic Sol's original code and documentation are available under the MIT License
 [`LICENSE`](LICENSE). The bundled Comic Neue and Noto Sans fonts remain separately
 licensed under the SIL Open Font License 1.1; see
 [`assets/README.md`](assets/README.md).
+
+## Contributing and security
+
+Development is review-first through pull requests into `main`. See
+[`CONTRIBUTING.md`](CONTRIBUTING.md) for the required validation gates. Report
+security issues privately as described in [`SECURITY.md`](SECURITY.md).

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported versions
+
+The latest published prerelease or stable release receives security fixes. Older release candidates may be superseded without backports.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a vulnerability, leaked credential, unsafe archive behavior, path-containment bypass, arbitrary file write, or dependency compromise.
+
+Use GitHub's private vulnerability reporting for `wenn-id/comic-sol-lab` when available. If that interface is unavailable, contact the repository owner privately through the contact method shown on the owner's GitHub profile and include:
+
+- affected version or commit;
+- reproduction steps and impact;
+- operating system and installation method;
+- whether credentials or private project data may have been exposed;
+- any proposed mitigation.
+
+Do not include live secrets. Revoke exposed credentials before reporting and replace values with `[REDACTED]`.
+
+## Scope
+
+Security-sensitive areas include project path containment, archive extraction, transactional configuration writes, provider metadata sanitization, release checksums, bundled runtimes, MCP output-root isolation, and generated artifact validation.
+
+Comic Sol does not bundle image-provider credentials or send data by itself. When an agent invokes an external image capability, that provider's privacy and retention policy applies.

tests/test_validation.py

@@ -949,6 +949,17 @@ def test_readme_is_judge_runnable_without_a_build_service(self):
             self.assertIn(required, readme)
         self.assertNotRegex(readme.lower(), r"npm run|start the server|docker compose")
 
+    def test_public_surface_uses_the_canonical_independent_repository(self):
+        readme = self.readme()
+        workflow = (ROOT / ".github/workflows/tests.yml").read_text("utf-8")
+        self.assertIn("https://github.com/wenn-id/comic-sol-lab", readme)
+        self.assertIn("canonical, independent home", readme)
+        self.assertNotIn("https://github.com/wenn-id/comic-sol.git", readme)
+        self.assertIn("branches: [ main ]", workflow)
+        self.assertNotIn("ai/post-event-development", workflow)
+        for name in ("CONTRIBUTING.md", "SECURITY.md"):
+            self.assertTrue((ROOT / name).is_file(), name)
+
     def test_package_files_install_and_artifact_contract_are_documented(self):
         for name in ("LICENSE", "README.md", "SKILL.md"):
             self.assertTrue((ROOT / name).is_file(), name)