Guidance audit & public showcase: 38-finding audit, zero-loss streamline, Cavalry front door

[DeyangChan]

Spec: specs/002-audit-repo-guidance/ (spec.md · plan.md · tasks.md — 41/44 tasks complete; 3 gated on maintainer decisions below)

What this PR does

The P1 deep audit of the whole repo, plus every non-destructive fix it authorized — four workstreams:

1. Audit (US1) — specs/002-audit-repo-guidance/audit-report.md: 38 findings, severity-ranked, 100% file coverage, instruction-discovery map answering the "does Claude miss README.md files?" question (yes it would — wiring now guarantees ≤1 hop from auto-loaded guidance), gitleaks-clean history, zero broken links.
2. Lean, opinionated guidance (US2) — corpus 36,978 → 30,275 words with zero rules lost, verified against a 460-rule ledger (rule-inventory.md). Per-session agent context (root + area + pack appendix) down ~25%. Highlights: frontend contract 5,051→3,643; root 2,488→1,953; every rule single-owner with pointers.
3. Public front door (US3) — README rewritten as the showcase (theme-aware Cavalry lockup, ideology, enumerated packs/add-ons, Day-1 checklist with self-verifying greps), MIT LICENSE, design-guide attribution, all brand assets local. Fresh-reader test ×2: "reads convincingly as the public flagship of an opinionated senior team."
4. Uniform stacks + wiring (US4/US5) — all three packs on one five-file canon (nextjs gains its infra.md n/a-stub); conflict registers hold replacements only; the two silent base contradictions (vercel develop branch, pinned analytics) now registered exceptions; security + add-on bindings added where the base delegated them; zero orphaned instruction files.

Security fixes worth review attention: deploy.yml fork-PR gate (event == 'push' guard) · otp-auth hardening (CSPRNG, single-use, bounded TTL, max attempts).

Test plan

• gitleaks git . --redact — 54 commits, no leaks (scan-evidence.md)
• Corpus link check — 0 broken relative references (before + after edits)
• Rule-ledger sweep — zero removals without an approved finding (rule-inventory.md disposition log)
• Dry-run instantiation from a scratch clone — every Day-1 reference resolves; placeholder greps behave as documented
• Fresh-reader README test ×2 — ORIENTED: yes (SC-008)
• SC-001…SC-012 sweep — 10 pass, 2 partial pending the decisions below (audit-report.md § Final validation)
• lint / typecheck / test / build — cannot run: the toolchain is the template's intentional <pm>/TODO placeholder (stated per Definition of Done)

Decisions requested before merge (audit-report.md § Decisions requested)

1. Publishing strategy — personal email in git history + internal paths in committed spec artifacts. Recommended: publish the public repo as a fresh-history snapshot; this repo keeps its history.
2. Spec Kit tooling (.claude/, .specify/ — untracked and unignored): recommended gitignore.
3. Template-dev specs (specs/001-*, specs/002-*): recommended not shipped in the public template.

🤖 Generated with Claude Code

[DeyangChan]

Closing as superseded.

This branch predates the template overhaul that landed in #10 and now in #11. Its stack packs are the retired stacks/vercel, stacks/nextjs-nestjs-postgres, and stacks/taro-fastify-mysql-tencent generation, which main has since replaced with vercel-csr, vercel-ssr, enterprise, mern, django, and wechat. Merging it would overwrite the current rewritten documentation with older generated material.

Reviewed for salvage before closing. Everything here is either already in main in rewritten form, or was removed on purpose:

• the 38-finding audit and its specs/002-audit-repo-guidance/ artifacts — feature 002 is recorded as retired in root CLAUDE.md Learnings;
• the MIT LICENSE — added in chore: prepare the template for public release #11, with the copyright holder corrected from "Cavalry" to "Cavalry Collective";
• the design/brand/ lockup and mark artwork — the only content unique to this branch. main's README and design guide reference no brand images, so these have no call site there. They stay retrievable from this PR's diff; say the word and I will cherry-pick the four files into main along with the lockup header they were made for.

Deleting the branch.