Polish public repo launch readiness

README.md

@@ -10,6 +10,18 @@ Every decision returns a **Trust Action Receipt**.
 
 **No receipt, no sensitive action.**
 
+Public demo receipts in this repository are not production-valid receipts.
+Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine.
+
+## Start here
+
+- [Specification](SPEC.md): public v0.1 TASK Core semantics and boundaries.
+- [Trust Action Receipt schema](schemas/trust-action-receipt.schema.json): JSON Schema for public draft receipts.
+- [OpenAPI reference](openapi/passpod-task.public.yaml): public reference API shape only.
+- [Example receipts](examples/README.md): walkthrough for the demo receipts.
+- [Validator](validator/README.md): install and run local receipt validation.
+- [Pilot Access](PILOT_ACCESS.md): path for real workflow review and hosted pilot access.
+
 ## Public test vs Pilot Access
 
 Public repo: schema, examples, local validation, public draft.

openapi/README.md

@@ -0,0 +1,21 @@
+# OpenAPI Reference
+
+`openapi/passpod-task.public.yaml` is a public reference shape for Passpod TASK
+Core. It documents draft endpoints for spec discovery, public demo receipt
+validation, and receipt lookup response shape.
+
+This OpenAPI file is not a production API contract. It does not define or expose:
+
+- production receipt issuance;
+- production signing internals;
+- scoped key generation;
+- issuer internals;
+- Passpod Hub internals;
+- customer workflows;
+- private commercial logic.
+
+Production-valid receipts require authorized issuer access through Passpod Hub
+and the Pilot Access Engine.
+
+Use this file to understand the public validation surface only. It is safe for
+developer review, mock clients, and standards discussion.

tools/check-public-task-repo.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 fail() { echo "❌ $1" >&2; exit 1; }
 
-required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json openapi/passpod-task.public.yaml docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py)
+required_files=(README.md SPEC.md PILOT_ACCESS.md ADOPTION.md SECURITY.md CONTRIBUTING.md GOVERNANCE.md VERSIONING.md requirements.txt schemas/trust-action-receipt.schema.json examples/remote-worker.receipt.json examples/README.md openapi/passpod-task.public.yaml openapi/README.md validator/README.md cli/README.md worker-reference/README.md docs/public-vs-pilot.md docs/production-checklist.md docs/standardization-roadmap.md tools/validate-receipts.py)
 
 for f in "${required_files[@]}"; do
   [ -f "$f" ] || fail "Missing required file: $f"
@@ -15,6 +15,28 @@ grep -R "Sensitive Action Control" README.md SPEC.md ADOPTION.md >/dev/null || f
 grep -R "public draft standard proposal" README.md SPEC.md ADOPTION.md >/dev/null || fail "Public draft standard proposal wording missing"
 grep -R "pilots@passpod.io" README.md PILOT_ACCESS.md SECURITY.md >/dev/null || fail "Pilot Access email missing"
 
+for link in \
+  "SPEC.md" \
+  "schemas/trust-action-receipt.schema.json" \
+  "openapi/passpod-task.public.yaml" \
+  "examples/README.md" \
+  "validator/README.md" \
+  "PILOT_ACCESS.md"
+do
+  grep -q "$link" README.md || fail "README missing launch navigation link: $link"
+done
+
+grep -q "Public demo receipts in this repository are not production-valid receipts" README.md \
+  || fail "README must state that public demo receipts are not production-valid"
+grep -q "Production-valid receipts require authorized issuer access through Passpod Hub and the Pilot Access Engine" README.md \
+  || fail "README must state the production-valid receipt access boundary"
+
+for readme in examples/README.md openapi/README.md validator/README.md cli/README.md worker-reference/README.md; do
+  if grep -Eiq 'placeholder|skeleton placeholder|TODO|TBD|coming soon|lorem|fixme' "$readme"; then
+    fail "Public directory README still contains placeholder-only language: $readme"
+  fi
+done
+
 dangerous_patterns='SECRET=|PRIVATE_KEY=|BEGIN PRIVATE KEY|real customer receipt:|production signing key:|scoped key value|sk_live_|pk_live_|AKIA[0-9A-Z]{16}'
 if grep -R -E "$dangerous_patterns" . \
   --exclude-dir=.git \

worker-reference/README.md

@@ -1,3 +1,16 @@
 # Worker Reference
 
-Reference Worker skeleton placeholder. Production hosted flows are handled through Pilot Access.
+This directory is reserved for a future minimal public reference Worker.
+
+The purpose would be to show how a developer might call the public validation
+shape around Passpod TASK Core receipts. It is not a production Worker, issuer,
+hosted verification service, or Passpod Hub component.
+
+Nothing in this directory should imply that production issuer code exists in
+this repository. Production-valid receipts require authorized issuer access
+through Passpod Hub and the Pilot Access Engine.
+
+Future Worker reference material must stay limited to public demo validation
+and local developer ergonomics. It must not include production signing,
+scoped key generation, issuer internals, customer workflows, Passpod Hub
+internals, or private commercial logic.