Localize llm-note UI and align public documentation

CHANGELOG.md

@@ -2,14 +2,19 @@
 
 ## [Unreleased]
 
-- Added GitHub Actions lifecycle workflows: automated PR assignment (`.github/workflows/auto-assign.yml`), issue label synchronization (`.github/workflows/label-sync.yml`), and standard labels catalog (`.github/labels.yml`).
-- Hardened CI workflow (`.github/workflows/ci.yml`) with concurrency cancellation (`cancel-in-progress: true`) and expanded Python matrix testing across versions 3.10 through 3.13.
-- Created plain-text companion Level 1 SBOM `THIRD_PARTY_LICENSES.txt` certifying zero external runtime dependencies, 10 system invariants (`INV-LOCAL-01` .. `INV-SLA-10`), unprivileged `RunAsInvoker` user mode, German statutory disclaimer (§ 521 BGB Gefälligkeitsrecht), and 48h Security Response SLA.
-- Standardized PEP 621 metadata in `pyproject.toml` with `Contributing`, `Plain-Text License`, and `Third-Party Licenses Text` URLs in `[project.urls]`, and configured `norecursedirs` under `[tool.pytest.ini_options]`.
-- Upgraded `CONTRIBUTING.md` to a comprehensive bilingual (EN/DE) development guide including Plan D canonical local cloning instructions, Quality Gates, and Version Freeze governance.
-- Hardened `.gitignore` against multi-host locks (`LOCK.dev.*`, `LOCK.antigravity.*`, `LOCK.bugsearch.*`), cloud synchronization conflicts (`*-IDEAPAD*`, `*_WORKSTATION*`, `*conflicted copy*`, `* (Kopie)*`), and scratch artifacts.
-- Synchronized `llms.txt`, `MARKETING-LOG.txt`, and Shields.io badges to the 2026-10-11 audit baseline.
-- Extended automated contract test suite in `tests/test_metadata.py` to cover lifecycle workflows, SBOM text companion, contributing guidelines, and multi-host gitignore defense.
+- Hardened CI workflow (`.github/workflows/ci.yml`) with concurrency cancellation (`cancel-in-progress: true`) and Python matrix testing across versions 3.10 through 3.13.
+- Standardized PEP 621 metadata in `pyproject.toml` with contributor and plain-text dependency-note URLs, and configured `norecursedirs` under `[tool.pytest.ini_options]`.
+- Reworked `THIRD_PARTY_LICENSES.md` and `THIRD_PARTY_LICENSES.txt` as scoped notes about declared runtime requirements and direct build/development tools; they no longer present a complete SBOM or license-compliance certification.
+- Updated all six README files and `SECURITY.md` to describe local storage, loopback binding, inherited process permissions, maintainer response targets, and the limits of the available evidence.
+- Replaced comparative claims about other products' network behavior, process permissions, and security response with “not assessed” entries.
+- Removed dated test-count, zero-egress, RunAsInvoker, and response-SLA badges; the existing CI badge remains the live status indicator.
+- Revised the § 521 BGB note to leave application and consequences to the specific circumstances; the repository license remains unchanged.
+- Revised `CONTRIBUTING.md` with a local checkout workflow and reproducible editable-install, test, lint, and build commands in English and German.
+- Updated `llms.txt` with a 2026-10-12 review date and current implementation boundaries.
+- Added a dated editorial supersession notice to `MARKETING-LOG.txt`; prior marketing text remains as historical material.
+- Reworked `RELEASE_GATE.md` to keep version 1.0.5 frozen, distinguish the historical 1.0.1 record, and state that the current release gate is not cleared.
+- Kept useful metadata, version, navigation, anchor, asset, runtime-import, CI, contributor-command, and host-sync tests; removed literal tests of old marketing, legal, and security claims.
+- Preserved package version 1.0.5 and made no release or upload.
 
 ## [1.0.5] - 2026-10-04
 

CONTRIBUTING.md

@@ -7,63 +7,82 @@
 <a id="english"></a>
 ## English
 
-Thank you for contributing to `llm-note`. We follow strict standards for local-first architecture, privacy guarantees, and software quality.
+Thank you for contributing to `llm-note`. We aim to keep the local-first architecture, public documentation, and software quality accurate and consistent.
 
-### 1. Architectural Mandates & Invariants
-- **100% Local-First & Zero Egress**: Never introduce network calls, remote analytics, or telemetry.
-- **Zero External Runtime Dependencies**: Runtime code must strictly rely only on Python's standard library and SQLite. Build tools (`hatchling`, `pytest`, `ruff`) remain dev-only.
-- **Unprivileged Execution (`RunAsInvoker`)**: Never require administrative or root privileges.
-- **System Invariants**: Respect `INV-LOCAL-01` through `INV-SLA-10` defined in `THIRD_PARTY_LICENSES.md`.
+### 1. Architecture and documentation
 
-### 2. Plan D Local Development Workflow
-- Development takes place in canonical Git clone (`C:\_Local_DEV\repos\llm-note`).
-- OneDrive locations serve purely as gitless projections/mirrors for multi-device visibility.
-- Never initialize `.git` inside cloud synchronization directories.
+- **Local-first core:** Do not introduce external telemetry or cloud clients into core runtime code. This is a development rule; it is not a claim that the operating system blocks all network egress.
+- **Runtime dependencies:** The project currently declares no additional Python runtime packages and uses the Python standard library and SQLite. Build and development tools are separate from runtime dependencies.
+- **Process permissions:** Do not require administrative or root elevation. The process inherits the permissions of the process that launches it; this statement is not a Windows execution certification.
+- Keep security, privacy, and dependency statements tied to checked source or distribution evidence. Do not present tests or documentation strings as a security or compliance certification.
+
+### 2. Local development workflow
+
+- Work from a local Git checkout at the repository root.
+- OneDrive locations may serve as gitless projections or mirrors for multi-device visibility.
+- Do not initialize a Git repository inside a cloud-synchronization directory.
+
+### 3. Version freeze discipline (T-20260920-167562623)
 
-### 3. Version Freeze Discipline (T-20260920-167562623)
 - Package versions are frozen unless an explicit version release ticket is assigned.
-- All technical hygiene improvements, contract tests, and non-breaking refinements are documented under `## [Unreleased]` in `CHANGELOG.md`.
+- Technical hygiene improvements, contract tests, and non-breaking refinements belong under `## [Unreleased]` in `CHANGELOG.md`.
+
+### 4. Quality gates and local verification
+
+Before opening a pull request, run the project verification suite:
 
-### 4. Quality Gates & Local Verification
-Before opening a pull request, run the complete verification suite:
 ```bash
-# Editable install
-pip install -e .
+# Editable install and local verification tools
+python -m pip install -e . pytest ruff build
 
-# Testing & Linting
+# Tests and lint
 python -m pytest -ra -v
 ruff check llm_note tests
 
-# Bytecode compilation & build check
+# Bytecode compilation and local build check
 python -m compileall -q .
 python -m build
 git diff --check
 ```
 
+These commands validate the local checkout; they do not publish a release.
+
 ---
 
 <a id="deutsch"></a>
 ## Deutsch
 
-Vielen Dank für dein Interesse an `llm-note`. Wir verfolgen kompromisslose Standards für Offline-Autarkie, Datenschutz und Softwarequalität.
+Vielen Dank für deinen Beitrag zu `llm-note`. Wir halten die lokal ausgerichtete Architektur, die öffentliche Dokumentation und die Qualitätsangaben sachlich und aufeinander abgestimmt.
+
+### 1. Architektur und Dokumentation
 
-### 1. Architektur-Vorgaben & Invarianten
-- **100% Lokal-Zuerst & Zero Egress**: Keine externen Netzwerkaufrufe, keine Telemetrie, kein Tracking.
-- **Null externe Laufzeit-Abhängigkeiten**: Der Produktionscode nutzt ausschließlich die Python-Standardbibliothek und SQLite.
-- **Unprivilegierte Ausführung (`RunAsInvoker`)**: Keinerlei Admin- oder Root-Rechte erforderlich.
-- **System-Invarianten**: Einhaltung von `INV-LOCAL-01` bis `INV-SLA-10` gemäß `THIRD_PARTY_LICENSES.md`.
+- **Lokaler Kern:** Führe keine externen Telemetrie- oder Cloud-Clients in den Laufzeitkern ein. Das ist eine Entwicklungsregel und keine Aussage, dass das Betriebssystem jeden Netzwerkverkehr blockiert.
+- **Laufzeitabhängigkeiten:** Das Projekt deklariert derzeit keine zusätzlichen Python-Laufzeitpakete und verwendet die Python-Standardbibliothek sowie SQLite. Build- und Entwicklungswerkzeuge sind davon getrennt.
+- **Prozessrechte:** Fordere keine Administrator- oder Root-Erhöhung an. Der Prozess übernimmt die Berechtigungen des aufrufenden Prozesses; das ist keine Windows-Ausführungszertifizierung.
+- Sicherheits-, Datenschutz- und Abhängigkeitsaussagen müssen sich auf geprüften Quellcode oder konkrete Distributionsbelege stützen. Tests und Dokumentationstexte sind keine Sicherheits- oder Compliance-Zertifizierung.
 
-### 2. Plan-D-Entwicklungsworkflow
-- Kanonischer Arbeitsort ist der lokale Git-Klon (`C:\_Local_DEV\repos\llm-note`).
-- OneDrive ist lediglich ein gitloser Projektionsspiegel zur geräteübergreifenden Verfügbarkeit.
+### 2. Lokaler Entwicklungsworkflow
+
+- Entwickle in einem lokalen Git-Klon im Repository-Stammverzeichnis.
+- OneDrive-Pfade können gitlose Projektionen oder Spiegel für die Verfügbarkeit auf mehreren Geräten sein.
+- Initialisiere kein Git-Repository in einem Cloud-Synchronisationsordner.
 
 ### 3. Versions-Einfrier-Disziplin (T-20260920-167562623)
-- Versionen bleiben stabil eingefroren; Neuerungen werden unter `## [Unreleased]` in `CHANGELOG.md` eingetragen.
 
-### 4. Quality Gates
+- Paketversionen bleiben eingefroren, sofern kein ausdrückliches Versionierungs-Ticket vorliegt.
+- Technische Pflege, Vertragstests und nicht rückwärtsbrechende Verbesserungen gehören unter `## [Unreleased]` in `CHANGELOG.md`.
+
+### 4. Qualitätsprüfungen und lokale Verifikation
+
+Führe vor einem Pull Request die Projektprüfungen aus:
+
 ```bash
+python -m pip install -e . pytest ruff build
 python -m pytest -ra -v
 ruff check llm_note tests
 python -m compileall -q .
+python -m build
 git diff --check
 ```
+
+Diese Befehle prüfen den lokalen Klon; sie veröffentlichen kein Release.

MARKETING-LOG.txt

@@ -1,3 +1,30 @@
+===============================================================================
+EDITORIAL SUPERSESSION — 2026-10-12
+===============================================================================
+
+The material below is retained as historical marketing and discoverability
+planning. It is not a current security, legal, licensing, or service-level
+certification.
+
+The following historical claims are superseded: zero-egress or air-gapped
+operation; no network access under every environment; a complete SBOM or
+zero-copyleft certification; RunAsInvoker certification; guaranteed response
+or fix deadlines; and categorical conclusions about § 521 BGB.
+
+Current bounded product facts: the project declares no additional Python
+runtime packages; core notes are stored in local SQLite and plain-text files;
+the optional web interface binds to loopback; and the process inherits the
+launching process's permissions. The application does not provide an
+operating-system egress block, sandbox, or privilege drop. SECURITY.md describes
+maintainer response targets, not guaranteed deadlines. The repository license
+is MIT (see LICENSE); dependency notes do not certify complete transitive
+license status. Legal applicability depends on the facts and is not determined
+by this marketing log.
+
+The comparative table and search phrases below are retained for history and
+should not be treated as verified statements about other products or as
+current guarantees about llm-note.
+
 ===============================================================================
                        llm-note MARKETING & DISCOVERABILITY LOG
 ===============================================================================