Prep the repo for public visibility

[daedboi]

Gets the repo ready to be flipped public.

README

Rewritten for a public audience: CI badge, a mermaid architecture diagram, the taint-gate trace, and the measured results (deterministic gate floor, AgentDojo 0/5 action-hijack ASR, live red-team 5/5, the fact-poison boundary stated honestly, BEIR vs published baselines) up front. The internal-codename framing and the rename note are gone.

Internal references removed

• .gitignore no longer names the private audit/backlog docs or local tooling config — those patterns moved to .git/info/exclude (per-clone; re-add on a fresh clone).
• Plan/audit shorthand scrubbed from comments and docs: the PHASE0.md pointer (pnpm-workspace.yaml), "(Phase 3)" (chat route), "(audit M1)" (no-advice eval), "(the current dev config)" (SECURITY.md), the machine-specific node note (scripts/verify), and a stale follow-up note (db/crypto.ts).
• packages/bench strategy/results docs reworded from publish-planning voice to neutral methodology — §4 is now "Headline results and caveats"; the numbers and caveats are unchanged.
• AGENTS.md retitled to a generic dev-environment doc; package.json description drops "(internal codename)".

Verification

pnpm lint:ci clean, the edited test file passes 4/4, apps/api typechecks, and a grep over tracked files confirms no remaining internal references. The mermaid diagram was render-checked.

Summary by CodeRabbit

• Documentation
  • Refreshed the README with a new overview, architecture flow diagram, taint-gate explanation, measured results, and updated setup/workflow guidance (Node 22, pnpm/Turborepo, uv).
  • Updated SECURITY.md evidence wording and improved verification and agent setup instructions.
  • Edited benchmarking/bench results and evaluation text for clearer presentation.
• Chores
  • Simplified .gitignore rules and adjusted repository metadata notes.
• Tests
  • Updated evaluation/gate description text without changing test behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
orca-api	Ready	Preview, Comment	Jul 13, 2026 2:54pm

[cursor]

PR Summary

Low Risk
Documentation and ignore-file changes only; no application logic, security controls, or API behavior is modified.

Overview
Prepares the repository to go public by reframing onboarding and security narrative for external readers and scrubbing internal-only artifacts from tracked files.

The README is rewritten: CI badge, mermaid architecture diagram, taint-gate trace, measured injection/BEIR tables up front, and links to SECURITY.md / bench results. Internal-codename framing and the rename note are removed. A dedicated Security & evaluation section is folded into that structure instead of living as a separate tail.

.gitignore drops patterns for private docs/, audit/backlog files, and local .claude/launch.json (those stay local via per-clone exclude, not the repo).

Internal shorthand is cleaned across comments and docs: AGENTS.md becomes a generic dev-environment guide; package.json description drops “internal codename”; bench strategy/results shift from “what to publish” to headline results and caveats (numbers unchanged); minor comment edits in SECURITY.md, chat route spend-cap note, no-advice test labels, pnpm-workspace.yaml, crypto.ts, and scripts/verify/README.md.

^{Reviewed by Cursor Bugbot for commit 5a11e8d. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1af71279-4397-4969-a509-57c3616115ca

📥 Commits

Reviewing files that changed from the base of the PR and between 5a11e8d and 595db39.

📒 Files selected for processing (1)

• README.md

🚧 Files skipped from review as they are similar to previous changes (1)

• README.md

---

📝 Walkthrough

Walkthrough

Documentation and development guidance were refreshed across Orca. README and security narratives now describe the taint gate and measured results, setup instructions reflect pnpm, Turborepo, Node 22, and uv workflows, and benchmark documentation updates reporting guidance.

Changes

Documentation and platform narrative

Layer / File(s)	Summary
Platform and security narrative README.md, SECURITY.md, package.json, apps/api/..., packages/core/..., packages/db/...	Product architecture, taint-gate behavior, measured results, layout descriptions, security evidence, package metadata, and related comments were revised without runtime changes.
Development setup guidance AGENTS.md, README.md, scripts/verify/README.md, pnpm-workspace.yaml, .gitignore	Setup instructions now describe pnpm, Turborepo, Node 22, and uv usage; workspace notes and ignore rules were updated.
Benchmark narrative packages/bench/BENCHMARK-STRATEGY-2026.md, packages/bench/RESULTS.md	Benchmark framing now emphasizes headline results, ordered reading guidance, caveats, and reranking lift.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• useboardwalk/orca#16: Related AGENTS.md development-environment guidance.
• useboardwalk/boardwalk-landing#17: Related AGENTS.md environment setup edits.
• useboardwalk/orca#54: Related taint-gate and security documentation updates.

Poem

A rabbit hops through docs anew,
With taint gates clear and setup too.
Benchmarks shine, the paths align,
Node and uv now neatly dine.
Hop, hop—no runtime changed in line!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main goal of making the repository public-facing and aligns with the README, docs, and config cleanup changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 99-105: Update the README setup instructions to distinguish
runtime and migration credentials: require DATABASE_URL to use a non-owner
NOBYPASSRLS role, and require ADMIN_DATABASE_URL for migrate.ts schema, RLS, and
serving-role setup. Clarify that the admin URL is reserved for migrations and
must not be used as the runtime database connection.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fc6f0cb5-78a5-4b60-9f81-8ef957346b64

📥 Commits

Reviewing files that changed from the base of the PR and between 21bcc49 and 5a11e8d.

📒 Files selected for processing (12)

• .gitignore
• AGENTS.md
• README.md
• SECURITY.md
• apps/api/app/v1/chat/route.ts
• package.json
• packages/bench/BENCHMARK-STRATEGY-2026.md
• packages/bench/RESULTS.md
• packages/core/src/guardrails/no-advice.recall.test.ts
• packages/db/src/crypto.ts
• pnpm-workspace.yaml
• scripts/verify/README.md

💤 Files with no reviewable changes (1)

• .gitignore