Align public module path and open-core boundary

.github/ISSUE_TEMPLATE/false_negative.yml

@@ -1,7 +1,7 @@
 name: False negative
 description: PkgSafe allowed a package that you believe is risky or malicious.
 title: "[false-negative] "
-labels: ["false_block"]
+labels: ["false_negative"]
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/false_positive.yml

@@ -48,6 +48,14 @@ body:
         - block
     validations:
       required: true
+  - type: input
+    id: fingerprint
+    attributes:
+      label: Finding fingerprint
+      description: Output from `pkgsafe feedback create`, if available.
+      placeholder: "sha256 fingerprint"
+    validations:
+      required: false
   - type: input
     id: risk_score
     attributes:

.gitignore

@@ -2,3 +2,4 @@ dist/
 /pkgsafe
 *.db
 .pkgsafe/
+pkgsafe-team-evidence.zip

CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing To PkgSafe
+
+PkgSafe is maintained as an open-core project. The public repository contains the OSS core and implementation-free extension contracts.
+
+## Public/private Feature Boundary
+
+PkgSafe Enterprise is a private downstream superset of PkgSafe OSS. It includes all public OSS capabilities plus private enterprise-only modules. Public OSS code may flow into the private enterprise distribution. Private implementation must not flow back into this public repository unless it has been explicitly reviewed and classified as OSS-safe.
+
+Before adding a feature, read:
+
+- `docs/architecture/open-core-boundary.md`
+- `docs/architecture/feature-classification.md`
+
+Do not add the following to this public repository:
+
+- premium implementation
+- customer-specific configs, examples, fixtures, or reproduction cases
+- enterprise policy packs
+- private intelligence rules or private feed logic
+- licensing enforcement or license server logic
+- hosted service internals
+- enterprise dashboard internals
+- premium tests or fixtures
+- private roadmap details
+
+Interfaces and stubs are allowed when they contain no private implementation. Prefer small provider interfaces, local fallbacks, and no-op adapters over feature-flagged premium logic.
+
+Run the public-boundary guardrail before submitting changes:
+
+```sh
+scripts/check-public-boundary.sh
+```
+
+or:
+
+```sh
+make check-public-boundary
+```
+
+## General Checks
+
+For code changes, run:
+
+```sh
+gofmt -w .
+go test ./...
+go test -race ./...
+go vet ./...
+make build
+```

Makefile

@@ -1,15 +1,18 @@
 APP := pkgsafe
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo none)
-VERPKG := github.com/niyam-ai/pkgsafe/internal/version
+VERPKG := github.com/sairintechnologycom/pkgsafe/internal/version
 LDFLAGS := -s -w -X $(VERPKG).Version=$(VERSION) -X $(VERPKG).Commit=$(COMMIT)
 DIST := dist
 
-.PHONY: test build sbom package clean cross
+.PHONY: test build sbom package clean cross check-public-boundary
 
 test:
 	go test ./...
 
+check-public-boundary:
+	scripts/check-public-boundary.sh
+
 build:
 	mkdir -p $(DIST)
 	go build -ldflags "$(LDFLAGS)" -o $(DIST)/$(APP) ./cmd/pkgsafe
@@ -31,7 +34,7 @@ package: cross
 
 sbom:
 	mkdir -p $(DIST)
-	printf '{\n  "spdxVersion": "SPDX-2.3",\n  "dataLicense": "CC0-1.0",\n  "SPDXID": "SPDXRef-DOCUMENT",\n  "name": "pkgsafe-$(VERSION)",\n  "documentNamespace": "https://github.com/niyam-ai/pkgsafe/sbom/$(VERSION)",\n  "creationInfo": {"creators": ["Tool: PkgSafe Makefile"], "created": "1970-01-01T00:00:00Z"},\n  "packages": [{"name": "pkgsafe", "SPDXID": "SPDXRef-Package-pkgsafe", "versionInfo": "$(VERSION)", "downloadLocation": "NOASSERTION", "filesAnalyzed": false}]\n}\n' > $(DIST)/sbom.spdx.json
+	printf '{\n  "spdxVersion": "SPDX-2.3",\n  "dataLicense": "CC0-1.0",\n  "SPDXID": "SPDXRef-DOCUMENT",\n  "name": "pkgsafe-$(VERSION)",\n  "documentNamespace": "https://github.com/sairintechnologycom/pkgsafe/sbom/$(VERSION)",\n  "creationInfo": {"creators": ["Tool: PkgSafe Makefile"], "created": "1970-01-01T00:00:00Z"},\n  "packages": [{"name": "pkgsafe", "SPDXID": "SPDXRef-Package-pkgsafe", "versionInfo": "$(VERSION)", "downloadLocation": "NOASSERTION", "filesAnalyzed": false}]\n}\n' > $(DIST)/sbom.spdx.json
 
 clean:
 	rm -rf $(DIST)

README.md

@@ -18,7 +18,7 @@ Install a published release:
 VERSION=1.0.0
 OS=linux
 ARCH=amd64
-curl -LO "https://github.com/niyam-ai/pkgsafe/releases/download/v${VERSION}/pkgsafe_${VERSION}_${OS}_${ARCH}.tar.gz"
+curl -LO "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/pkgsafe_${VERSION}_${OS}_${ARCH}.tar.gz"
 tar -xzf "pkgsafe_${VERSION}_${OS}_${ARCH}.tar.gz"
 sudo mv pkgsafe /usr/local/bin/
 pkgsafe version
@@ -32,16 +32,16 @@ Release archives ship `checksums.txt`, a cosign signature, GitHub Artifact
 Attestations, and per-archive SBOMs. Verify before trusting a binary:
 
 ```bash
-curl -LO "https://github.com/niyam-ai/pkgsafe/releases/download/v${VERSION}/checksums.txt"
-curl -LO "https://github.com/niyam-ai/pkgsafe/releases/download/v${VERSION}/checksums.txt.sig"
-curl -LO "https://github.com/niyam-ai/pkgsafe/releases/download/v${VERSION}/checksums.txt.pem"
+curl -LO "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/checksums.txt"
+curl -LO "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/checksums.txt.sig"
+curl -LO "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/checksums.txt.pem"
 sha256sum -c checksums.txt
 cosign verify-blob \
   --certificate checksums.txt.pem --signature checksums.txt.sig \
   --certificate-identity-regexp 'https://github.com/.*/pkgsafe/.*' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   checksums.txt
-gh attestation verify "pkgsafe_${VERSION}_${OS}_${ARCH}.tar.gz" --repo niyam-ai/pkgsafe
+gh attestation verify "pkgsafe_${VERSION}_${OS}_${ARCH}.tar.gz" --repo sairintechnologycom/pkgsafe
 ```
 
 Full release checks are documented in
@@ -50,7 +50,7 @@ Full release checks are documented in
 **From source** (Go 1.25+):
 
 ```bash
-go install github.com/niyam-ai/pkgsafe/cmd/pkgsafe@latest
+go install github.com/sairintechnologycom/pkgsafe/cmd/pkgsafe@latest
 # or, from a clone, with version metadata baked in:
 make build && ./dist/pkgsafe version
 ```
@@ -198,6 +198,10 @@ performs a real bulk OSV sync so you can scan offline afterward; until a package
 has been synced/cached, an `--offline` scan of it will fail or warn rather than
 silently pass. OSV lookups **fail closed** — a network/rate-limit error surfaces
 `vulnerability_data_unavailable` rather than scoring the package clean.
+For air-gapped environments, export, verify, and import signed advisory bundles
+with `pkgsafe db export-bundle`, `pkgsafe db verify-bundle`, and
+`pkgsafe db import-bundle`; see
+[docs/offline-intelligence-bundle.md](docs/offline-intelligence-bundle.md).
 
 **Behavior analysis is disabled by default and must be requested explicitly.**
 Use `--behavior heuristic` only in disposable environments: it runs lifecycle

action.yml

@@ -42,7 +42,7 @@ inputs:
     default: "true"
 
   baseline:
-    description: "Baseline branch for changed dependency detection"
+    description: "Baseline Git ref or baseline package-lock JSON file for changed dependency detection"
     required: false
     default: "main"
 
@@ -96,11 +96,6 @@ inputs:
     required: false
     default: "true"
 
-  pkgsafe-version:
-    description: "PkgSafe version to install"
-    required: false
-    default: "latest"
-
 outputs:
   decision:
     description: "Overall PkgSafe decision: allow, warn, block"