Release Sandwich Hime v1 source and contribution policy

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/README.md

@@ -16,6 +16,11 @@ Linux/amd64 and macOS/arm64.
 - `sign-notarize-macos.sh` is a deliberately manual boundary. It requires the explicitly approved unsigned archive digest, uses Cole's Developer ID and Keychain-held notary profile, regenerates provenance and checksums for the changed signed Mach-O bytes, and produces a signed, notarized, and stapled DMG. The native runner receives neither credential.
 - `verify-real-browser.sh` is opt-in release evidence. It runs the development client in an actual reviewed Chrome/Chromium binary, exercising CSP-restricted execution, SSE diagnostics, reload, and fragment/API exclusions, then reruns the process cleanup integration cases. Chrome is not a normal build or consumer dependency.
 
+The export scanner also rejects Markdown references to known excluded operator
+documentation roots. It is a bounded publication check, not a complete Markdown
+link checker or a substitute for inspecting the exported diff. Source-code
+fixtures can still describe the scanner's rejected paths.
+
 The canonical Linux and macOS CI gates run the contract and public-snapshot
 checks plus bounded fuzz sessions for the parser/context compiler, Go-aware
 delimiter scanner, URL policy, and LSP boundaries. The compiler target also

scripts/public-snapshot-lib.sh

@@ -72,6 +72,9 @@ snapshot_validate_export_tree() {
 	local provider_token='AKIA[0-9A-Z]{16}|(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}'
 	local private_commit_id='(private development (source|baseline)|private (development )?(commit|source))[^[:cntrl:]]*[0-9a-f]{12,64}'
 	local private_repository='sandwich-hime-''dev'
+	# Known excluded documentation roots, not ordinary prose about private work.
+	# Scope this to Markdown: exported scanner code legitimately names its policy.
+	local private_markdown_ref='(^|[^[:alnum:]_./%-])([.]{1,2}/)*(private|history)/'
 
 	if find "$root" -type l -print -quit | grep -q .; then
 		echo "public snapshot: symbolic links are forbidden" >&2
@@ -117,5 +120,13 @@ snapshot_validate_export_tree() {
 			echo "public snapshot: private repository indicator in $rel" >&2
 			return 1
 		fi
+		case $rel in
+		*.[mM][dD] | *.[mM][aA][rR][kK][dD][oO][wW][nN])
+			if LC_ALL=C grep -Eiq -- "$private_markdown_ref" "$file"; then
+				echo "public snapshot: excluded documentation reference in $rel" >&2
+				return 1
+			fi
+			;;
+		esac
 	done < <(find "$root" -type f -print0 | LC_ALL=C sort -z)
 }

scripts/public-snapshot.allow

@@ -42,6 +42,7 @@ docs/COMPATIBILITY.md
 docs/DEVELOPMENT_SERVER.md
 docs/DIAGNOSTICS.md
 docs/LANGUAGE_SERVER.md
+docs/LICENSING_INTENT.md
 docs/SECURITY_EVIDENCE.md
 docs/THREAT_MODEL.md
 docs/V1_RELEASE_PLAN.md

scripts/test-public-snapshot.sh

@@ -77,6 +77,33 @@ mkdir -p "$safe_tree"
 printf 'ordinary reviewed source\n' >"$safe_tree/source.go"
 snapshot_validate_export_tree "$safe_tree"
 
+# Public prose and ordinary public links are allowed. Source-code policy
+# fixtures may name excluded roots without becoming documentation links.
+printf '%s\n' 'Private development records remain separate.' \
+	'[Releases](docs/releases.md)' '[History](https://example.invalid/history/releases)' \
+	'[Design](private-design.md)' >"$safe_tree/README.md"
+printf '%s\n' '// Reject private/notes.md in an export policy.' >"$safe_tree/scanner_test.go"
+snapshot_validate_export_tree "$safe_tree"
+
+markdown_tree=$temporary/markdown
+mkdir -p "$markdown_tree"
+for reference in '[Audit](private/audit.md)' '[Audit](./private/audit.md#resume)' \
+	'[Audit](../../private/audit.md)' '[audit]: ../private/audit.md' '[audit]:private/audit.md' \
+	'`private/audit.md`' '<a href="private/audit.md">Audit</a>' \
+	'[Archive](history/story.md)' '[Audit](PRIVATE/AUDIT.md)'; do
+	printf '%s\n' "$reference" >"$markdown_tree/README.Md"
+	if snapshot_validate_export_tree "$markdown_tree" >"$temporary/markdown.log" 2>&1; then
+		echo "excluded documentation reference was accepted: $reference" >&2
+		exit 1
+	fi
+	grep -q 'excluded documentation reference in README.Md' "$temporary/markdown.log"
+done
+mv "$markdown_tree/README.Md" "$markdown_tree/notes.markdown"
+if snapshot_validate_export_tree "$markdown_tree" >/dev/null 2>&1; then
+	echo "excluded reference in .markdown documentation was accepted" >&2
+	exit 1
+fi
+
 empty_tree=$temporary/empty
 mkdir -p "$empty_tree"
 : >"$empty_tree/empty.txt"