feat: publish Gamertan Web Foundations preview source

Export the reviewed application-neutral package set through the exact public allowlist. Development history and private application evidence remain outside this canonical source root.

Developed with material AI assistance under maintainer review.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/ADOPTION.md

@@ -0,0 +1,23 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Application adoption contract
+
+The foundation is designed and tested as independent software before an
+existing application migrates to it. No application's historical schema,
+roles, route names, analytics categories, or operator workflow belongs in a
+general package merely because it makes one migration easier.
+
+An application adopts one boundary at a time:
+
+1. implement a narrow adapter at the application edge;
+2. run the old and new decisions against the same reviewed fixtures;
+3. explain intentional differences;
+4. deploy without deleting the retained implementation;
+5. observe a defined production soak; and
+6. remove old code only after rollback and data-compatibility evidence passes.
+
+EQL Helper is intended to be the first demanding adopter, not the design
+template. Its private evidence, persistent bans, account data, route policy,
+operator exclusions, synchronization, and publishing workflow remain
+application-owned. Useful pressure from that migration may improve a general
+interface, but it may not smuggle EQL-specific policy into this module.

docs/ARCHITECTURE.md

@@ -0,0 +1,23 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Architecture
+
+The dependency direction is intentionally one-way:
+
+```text
+net/http application
+  -> requestmeta
+  -> requestlog / websec / abuse / authhttp
+  -> auth and analytics interfaces
+  -> optional authsqlite and JSONL adapters
+```
+
+Packages never own application routes, templates, authorization policy, cache
+policy, or deployment. Middleware communicates through typed request context.
+Storage and reporting surfaces are interfaces so an application can retain its
+existing database and user interface while replacing one implementation at a
+time.
+
+The package model is developed from explicit threat and data contracts, not by
+moving an existing application's internals into a shared directory. See
+[ADOPTION.md](ADOPTION.md).

docs/DEPENDENCIES.md

@@ -0,0 +1,18 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Dependency boundary
+
+Most packages use only the Go standard library. Two direct modules are pinned:
+
+- `golang.org/x/crypto` supplies the reviewed Argon2id implementation used by
+  `auth` (BSD-3-Clause upstream licence).
+- `modernc.org/sqlite` supplies the no-CGO SQLite adapter in `authsqlite`
+  (BSD-3-Clause upstream licence).
+
+Applications that do not import `auth` or `authsqlite` do not link those
+implementations into their binaries. Optional GeoIP enrichment is an interface
+only; the base toolkit performs no lookup and adds no GeoIP dependency.
+
+`go.sum`, `go mod verify`, checksum-database verification, vulnerability
+scanning, and the public snapshot allowlist are release gates. Binary
+distributors remain responsible for preserving all applicable upstream notices.

docs/PUBLIC_SNAPSHOT.md

@@ -0,0 +1,11 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Public source snapshots
+
+Development history remains private. Canonical public source is exported from a
+reviewed clean commit through `scripts/public-snapshot.allow`; GitHub receives
+the exact same exported tree as a read-only discovery mirror.
+
+The exporter includes no branches, reflogs, private operational evidence,
+credentials, databases, logs, or development-only files. Public Gitea issues
+and pull requests are the contribution venue.

docs/SERVICES_ROADMAP.md

@@ -0,0 +1,13 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Standalone services: later, deliberately
+
+The first preview is library-only. An authentication daemon or log ingestion
+service would add a network protocol, service authentication, key rotation,
+availability, replay, upgrade, and incident-response obligations. Process
+isolation is not valuable merely because it draws another box in a diagram.
+
+If a concrete multi-application need justifies those costs, `authd` and `logd`
+will be separate AGPL-3.0-only services. Their protocols will not be promised
+until adversarial tests, recovery procedures, and at least two real consumers
+exist.

docs/THREAT_MODEL.md

@@ -0,0 +1,25 @@
+<!-- SPDX-License-Identifier: MPL-2.0 -->
+
+# Threat model
+
+The toolkit treats the public network, forwarding headers, request targets,
+cookies, credentials, and stored request records as untrusted. Application code,
+the configured trusted-proxy set, server filesystem permissions, and explicitly
+selected storage adapters are trusted.
+
+Controls include explicit proxy trust, bounded parsing, cryptographic request
+and session identifiers, digest-only session storage, Argon2id passwords,
+constant-time comparisons, same-origin and CSRF primitives, fail-closed storage
+errors, and separate safe/sensitive analytics projections.
+
+The toolkit does not sandbox application handlers, secure an incorrectly
+configured reverse proxy, authorize application routes automatically, encrypt a
+compromised host, or decide how long an operator may lawfully retain personal
+request evidence.
+
+Local storage adapters assume the parent directory and host account are trusted.
+They reject a symlink at the configured final path and apply private file modes,
+but they do not defend against a concurrent privileged actor replacing path
+ancestors during an open. The synchronous JSONL adapter deliberately favors
+durable, bounded evidence over maximum request throughput; the application owns
+rotation, retention, disk monitoring, and health escalation.