docs: define sanitized GitHub discovery mirrors

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

PUBLIC-SNAPSHOT.json

@@ -1 +1 @@
-{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":77,"allowlist_sha256":"db978285858ba5a1fefeb732d716338d8c652c5fc583f465d08f80b9ec74f0a9","manifest_sha256":"2bf5bf9a549954cc907010600ca861e2dd26528a7a007d49c23bf40c52c749a4"}
+{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":77,"allowlist_sha256":"db978285858ba5a1fefeb732d716338d8c652c5fc583f465d08f80b9ec74f0a9","manifest_sha256":"5abb8eaf376ec390da5b1b5d811ec9aa685bf9e47e54086a51d049193738a49b"}

PUBLIC-SNAPSHOT.sha256

@@ -13,9 +13,9 @@ f7ac75b443f4ca16b503241344b41aeff9503b0c30bedc2b119551d83cb0fa90  ./DCO.txt
 6587e439cb3c39dce9aaa5b51facdbd78c0e86c24e9e3fb9537b944435a74410  ./LICENSES.md
 b6aa08e5ccaec3c5dccdc19d7cd7f54a70adae4d57966263c7aa353c7ba70e08  ./MAINTAINERS.md
 6638db2f1fba831c79de835ce95c847a5b36c5b5c693b99a28655b2d096cc440  ./OUTPUT_EXCEPTION.md
-58f98a72ac99ee39cd7e58dc5e170b167c82ea27c495e36998568d3ae77c5ec0  ./README.md
-00ac24b5bc5cd2b62f6176f85d4be29087c59c17f4f670edacf408d56ccc7f23  ./RELEASE.md
-370c948b267527fdc2309c808b99089da33ac81346043dd54692ebb0843f6c0a  ./ROADMAP.md
+327386b40ee9fb92a8568b6a51722578890393fa23051af632f3180385a4e739  ./README.md
+ce32945cf5f16ab1a0202615bcf2053f46d421dcdd8ff2f1292f95bb5cf4493d  ./RELEASE.md
+29eebbdfcff05d4ba709bf13d45052c6994767303ddb470031620c9987bca53a  ./ROADMAP.md
 2c86f5b983dfeb97a02d46850fa42e18cab1ed23201822aa3c344b9d2e1b0c3f  ./SECURITY.md
 53bd6eda804d6b782bdb07115ec197c890813cf2d5d0125dfe8f47f5f92f75b0  ./SPEC.md
 842beff8afa72d120fcad0ac73afb2049d580ff3000975f3b1786c4ade6a14d4  ./TRADEMARKS.md
@@ -69,7 +69,7 @@ ff76daee5b642ad84af31701833246d68b54d09580192312d750a7a2e893a692  ./sando/go.mod
 80ff53787919e809b8085d6ad9c3e183c9c7c1d74cfeda73369ac5c4607c236f  ./sando/trust.go
 85621a44c730582f4410ac2c70418b739fb55e916f7e6b73a1a619982c459572  ./sando/write.go
 b188917e258890e6b6e4840a6fd946fc9a77cabc2068da3764f221e4a6a5df97  ./sando/write_test.go
-2655a3f62772f7b3ef694aea2d03bd99e157d2449c232c7439c258ec36367fb1  ./scripts/README.md
+ecae2e2938da982001eb1e10d7e9869e191669a776336b89f5cb181b18678701  ./scripts/README.md
 0bc796f71c863aa898674a26c56f055e3d81cf20629ca7b32fbae87d8841e0a8  ./scripts/check-licenses.sh
 502da1760bc87f260d474d81fe8f015a6e198f8d1ebf96db6b3f460ce4ef3b02  ./scripts/release-check.sh
 6be2fc6b8c3e0a7dd85437fa4089e75b772baa7556675081e6956a1b9f207fb4  ./scripts/verify-public-install.sh

README.md

@@ -2,6 +2,12 @@
 
 # Sandwich Hime
 
+> **Canonical project:** development, contribution and security instructions,
+> releases, and stewardship live on the
+> [founder-controlled Gamertan Gitea](https://gitea.speelman.ca/gamertan/sandwich-hime).
+> A GitHub copy, when present, is a read-only discovery snapshot rather than a
+> contribution or release authority.
+
 Sandwich Hime is an HTML-first, ahead-of-time template engine for Go. Hime-san
 keeps the direct, mixed-markup feeling of classic PHP while compiling trusted
 `.sando` templates into typed, deterministic Go components that an ordinary

RELEASE.md

@@ -18,8 +18,11 @@ Release candidates require a clean canonical checkout, reviewed changelog, compa
 
 Gitea is the only canonical public forge. Public source is exported into a
 separate, sanitized Gitea repository with fresh history; private development
-history and the private-to-public commit mapping are not published. Release
-binaries and provenance are built from the reviewed public commit. Compiler
+history and the private-to-public commit mapping are not published. A
+sanitized GitHub discovery snapshot may copy reviewed public source, but it is
+not an issue, contribution, release, or module origin and must never receive
+private development refs or an indiscriminate Git mirror. Release binaries and
+provenance are built from the reviewed canonical Gitea commit. Compiler
 documentation, binaries, checksums, SBOMs, and the independently versioned
 runtime tag form the coordinated v1 release. Example applications and product
 sites keep their own history, deployment, and evidence.

ROADMAP.md

@@ -34,4 +34,5 @@ Unchecked items are release blockers, not aspirational marketing.
 - [ ] Name clearance, security mailbox, two-person credential recovery, and signing keys complete.
 - [ ] `gamertan.com` vanity-import metadata and documented installs verified from a clean machine.
 - [ ] Sanitized fresh-history public Gitea snapshot contains no private paths, identifiers, history, or unsupported release claims.
-- [ ] Canonical public Gitea source and project documentation launch with no secondary forge mirror.
+- [x] Canonical public Gitea source and project documentation launch, with any
+  secondary forge explicitly limited to a sanitized discovery snapshot.

scripts/README.md

@@ -18,4 +18,4 @@ The release preflight invokes `govulncheck` from the official Go vulnerability p
 
 Forge workflows are intentionally excluded from the sanitized pre-1.0 public snapshot until the project has confirmed its own Gitea runner availability and reviewed locally hosted or otherwise pinned dependencies. Local `verify.sh`, `verify.ps1`, license, and release-preflight results are the preview gates.
 
-If Gitea automation is later added to the public repository, pin every external action to a reviewed immutable commit, document its provenance, grant minimum permissions, and keep a local verification path. No secondary forge mirror or hosted workflow is planned.
+If Gitea automation is later added to the public repository, pin every external action to a reviewed immutable commit, document its provenance, grant minimum permissions, and keep a local verification path. A secondary forge may host a sanitized, read-only discovery snapshot, but hosted workflows stay disabled there and it does not become a release or contribution authority.