chore(release): prepare v0.1.5 public-landing notes and identity

.fulmen/app.yaml

@@ -12,6 +12,6 @@ app:
   # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml.
   config_name: decernor
   description: "Local key-material hygiene and readiness checks"
-  version: "0.1.4"
+  version: "0.1.5"
 metadata:
   repository_category: cli

CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-08-24
+
+Public-landing pack. Signed cut on the same two-phase provenance walk.
+No new CLI verbs.
+
+### Changed
+
+- README adds a `## License` pointer to `LICENSE` and polishes the name note
+  for a public reader.
+- Overview front-matter status is `active` (was `draft`).
+- Stub `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` link to
+  [3leaps/oss-policies](https://github.com/3leaps/oss-policies) (no forked
+  policy bodies).
+- LICENSE drops the Fulmen "Acceptable Use" template section; MIT grant and
+  trademark notice remain.
+- Historical `[0.1.2]` notes use past tense for the private-era snapshot.
+- `make test-standalone-binary` copies the built binary into a `mktemp`
+  directory under `$${TMPDIR:-/var/tmp}` instead of hardcoded `/tmp`
+  (avoids host SIGKILL on `/tmp` executables).
+
 ## [0.1.4] - 2026-08-20
 
 Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and
@@ -22,9 +42,9 @@ landing-page notes catch up; no new CLI verbs.
 
 ## [0.1.3] - 2026-08-18
 
-First **signed** private cut. Fingerprint pins are generated by
-`decernor fingerprint` and staged into the checksum set before signing
-([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)).
+First **signed** cut while the repository was private. Fingerprint pins are
+generated by `decernor fingerprint` and staged into the checksum set before
+signing ([PDR-0001](docs/decisions/PDR-0001-committed-signing-anchors.md)).
 
 ### Added
 
@@ -35,8 +55,9 @@ First **signed** private cut. Fingerprint pins are generated by
 
 ## [0.1.2] - 2026-08-18
 
-First tagged snapshot of the Decernor CLI. Private repository; unsigned draft
-release is the intended publish shape for this cut.
+First tagged snapshot of the Decernor CLI. First tagged cut while the
+repository was private; unsigned draft release was the intended publish
+shape for that cut.
 
 ### Added
 
@@ -73,6 +94,7 @@ release is the intended publish shape for this cut.
 - Upstream baseline changelog and release-note history inherited from the
   template.
 
+[0.1.5]: https://github.com/3leaps/decernor/releases/tag/v0.1.5
 [0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4
 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3
 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2

CODE_OF_CONDUCT.md

@@ -0,0 +1,4 @@
+# Code of Conduct
+
+This project follows the 3 Leaps Code of Conduct published in
+[3leaps/oss-policies](https://github.com/3leaps/oss-policies).

CONTRIBUTING.md

@@ -0,0 +1,6 @@
+# Contributing
+
+Contribution guidelines for 3 Leaps open source projects live in
+[3leaps/oss-policies](https://github.com/3leaps/oss-policies).
+
+This repository conforms to the Sensitive Local Data policy published there.

LICENSE

@@ -48,10 +48,4 @@ For questions regarding trademark usage, contact legal@3leaps.net.
 
 ---
 
-## Acceptable Use of "Fulmen"
-
-"Fulmen" (Latin for lightning or thunderbolt) is a reusable project template by 3 Leaps, LLC, designed for lightning-fast, enterprise-grade solutions. Use "Fulmen" as a standalone noun (for example, "Use a fulmen to start your project") and avoid descriptors like "template" or "blueprint." We encourage referencing "fulmen" in contexts identifying permissibly licensed content, provided the `3leaps-` prefix is not used to avoid confusion with official 3 Leaps content. As a courtesy, acknowledge the origin by linking to `https://github.com/3leaps/decernor` in your documentation. For full branding guidelines, visit `https://fulmenhq.dev`.
-
----
-
 For additional governance details and contributor obligations, see the 3 Leaps Open Source Policies at https://github.com/3leaps/oss-policies.

Makefile

@@ -312,10 +312,15 @@ install: build  ## Install binary to BINDIR (default: ~/.local/bin)
 
 test-standalone-binary: build  ## Verify built binary runs outside repo
 	@echo "→ Standalone binary check (outside repo)..."
-	@cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "/tmp/$(BINARY_NAME)$(BINARY_EXT)"
-	@"/tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null
-	@"/tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null
-	@echo "✅ Standalone binary check passed"
+	@# POSIX /bin/sh (dash on Ubuntu CI): no pipefail. Keep outside-repo check
+	@# under $${TMPDIR:-/var/tmp} — hardcoded /tmp is SIGKILL'd on some macOS hosts.
+	@tmp=$$(mktemp -d "$${TMPDIR:-/var/tmp}/decernor-standalone.XXXXXX") && \
+	cp "bin/$(BINARY_NAME)$(BINARY_EXT)" "$$tmp/$(BINARY_NAME)$(BINARY_EXT)" && \
+	"$$tmp/$(BINARY_NAME)$(BINARY_EXT)" version >/dev/null && \
+	"$$tmp/$(BINARY_NAME)$(BINARY_EXT)" --help >/dev/null && \
+	rm -rf "$$tmp" && \
+	echo "✅ Standalone binary check passed" || \
+	(rm -rf "$$tmp"; exit 1)
 
 build-all: verify-embedded-identity  ## Build multi-platform binaries and generate checksums
 	@echo "→ Building for multiple platforms..."

README.md

@@ -9,11 +9,8 @@ SSH keys, revocation certificates, public counterparts, and checksum manifests 
 retain, or inspect. It reads the _state_, never the _secret_.
 
 > **Name note:** `decernor` (from Latin _decernere_, "to decide / determine / decree";
-> root _cernere_, "to sift, distinguish, discern") is the locked name for the tool
-> previously proven in an internal prototype. Pronounced **deh-SUR-nor**.
-> See [`NAMING.md`](NAMING.md) for the decision record. The binary, module path, and
-> config surfaces below use the final name; mechanical rename of the prototype is a
-> graduation task.
+> root _cernere_, "to sift, distinguish, discern"). Pronounced **deh-SUR-nor**.
+> See [`NAMING.md`](NAMING.md) for the decision record.
 
 ## Product Thesis
 
@@ -103,7 +100,7 @@ Capabilities use a provider plus verb model:
 - `minisign/sign`
 - `ssh/auth`
 
-The current prototype includes schema-backed config validation:
+The current cut includes schema-backed config validation:
 
 ```sh
 go run ./cmd/decernor readiness validate-config examples/github-org-bootstrap.readiness.json
@@ -237,7 +234,7 @@ Inserter: [`keys/README.md`](keys/README.md).
 ## Verify a signed release
 
 Consume fingerprints, not secrets. Per-cut commands live in
-[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md).
+[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md).
 
 Download the release assets (archives, signed SUMS, exported publics,
 staged pin pair). Verify SUMS signatures, then:
@@ -315,3 +312,7 @@ The repository avoids committed real keys and avoids full static secret-key fixt
 ## Provenance
 
 Decernor was initially built from the public Fulmen microtool forge baseline [`forge-microtool-gimlet`](https://github.com/fulmenhq/forge-microtool-gimlet), then adapted as a 3 Leaps OSS tool.
+
+## License
+
+This project is licensed under the MIT License. See [`LICENSE`](LICENSE).

RELEASE_NOTES.md

@@ -1,7 +1,19 @@
 # Release Notes
 
 Landing page for the latest Decernor cut. Per-cut payload:
-[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md).
+[`docs/releases/v0.1.5.md`](docs/releases/v0.1.5.md).
+
+## v0.1.5 — 2026-08-24
+
+Public-landing pack on the same signed two-phase walk as v0.1.4. No new
+CLI verbs. README gains a `## License` pointer; overview status is
+`active`; community stubs link to `3leaps/oss-policies`; LICENSE drops the
+Fulmen "Acceptable Use" template section. Historical v0.1.2 notes use past
+tense for the private-era snapshot. The standalone binary gate uses a
+`mktemp` directory under `TMPDIR` instead of hardcoded `/tmp`.
+
+Signing still uses `DECERNOR_*` environment variables only. No key paths
+live in this repository.
 
 ## v0.1.4 — 2026-08-20
 
@@ -23,5 +35,5 @@ First signed cut. The repository was private for that tag. See
 
 ## v0.1.2 — 2026-08-18
 
-First tagged snapshot (unsigned draft). See
-[`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md).
+First tagged snapshot (unsigned draft) while the repository was private.
+See [`docs/releases/v0.1.2.md`](docs/releases/v0.1.2.md).

SECURITY.md

@@ -0,0 +1,4 @@
+# Security
+
+Security reporting and policy for 3 Leaps open source projects live in
+[3leaps/oss-policies](https://github.com/3leaps/oss-policies).

VERSION

@@ -1 +1 @@
-0.1.4
+0.1.5

docs/decernor-overview.md

@@ -1,7 +1,7 @@
 ---
 title: "Decernor Overview"
 description: "Local key-material hygiene and readiness checks"
-status: "draft"
+status: "active"
 ---
 
 # Decernor Overview

docs/releases/README.md

@@ -2,6 +2,7 @@
 
 Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md).
 
+- [v0.1.5](v0.1.5.md) — public-landing pack; signed cut
 - [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes
 - [v0.1.3](v0.1.3.md) — first signed cut
-- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned)
+- [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned; private-era)

docs/releases/v0.1.2.md

@@ -1,7 +1,8 @@
 # v0.1.2 — 2026-08-18
 
-First tagged snapshot. **Private** repository. Draft GitHub release;
-unsigned unless org public keys are inserted from `decernor fingerprint`.
+First tagged snapshot while the repository was private. Draft GitHub
+release; unsigned unless org public keys are inserted from
+`decernor fingerprint`.
 
 **Shipped verbs:** `scan`, `guardread`, `fingerprint`/`fp`, `validate`
 (contract-base + classification gate), `readiness validate-config`,
@@ -13,8 +14,8 @@ stdout, if that named file has 0 or more than one primary). Minisign
 trust-anchor field is lowercase 64-hex `minisign-public-blob-sha256-v1`.
 
 **Not in this cut:** static readiness evaluation, proof checks,
-`derive-public-key`, `migrate`, embedded ceremony docs, public GitHub
-visibility.
+`derive-public-key`, `migrate`, embedded ceremony docs. Public GitHub
+visibility was out of scope for that tag.
 
 ## Verify
 

docs/releases/v0.1.5.md

@@ -0,0 +1,40 @@
+# v0.1.5 — 2026-08-24
+
+Public-landing pack. Signed cut on the same two-phase provenance walk as
+v0.1.4.
+
+**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`,
+`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`.
+
+This cut prepares the repository landing surfaces for a public reader:
+README `## License` pointer, overview status `active`, link-only community
+stubs to `3leaps/oss-policies`, LICENSE without the Fulmen "Acceptable Use"
+template section, and past-tense historical notes for the private-era
+v0.1.2 snapshot. `make test-standalone-binary` uses a `mktemp` directory
+under `TMPDIR` instead of hardcoded `/tmp`.
+
+Fingerprint pins are generated with `decernor fingerprint` on exported
+public files and staged into the checksum set before signing. Bindings
+are `DECERNOR_*` environment variables only.
+
+## Verify a signed release
+
+Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their
+signatures, exported publics, and the staged pin pair
+(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the
+signatures on the SUMS, then check the SUMS against the files.
+
+Recompute fingerprints from the **exported publics** and compare them to
+the two-line pin file. Do not hand-type hex.
+
+```sh
+decernor fingerprint decernor-release-signing-key.asc \
+  --class public --kind gpg --format json --path-mode none --gpg-role primary
+decernor fingerprint decernor-minisign.pub \
+  --class public --kind minisign --format json --path-mode none
+```
+
+The GPG primary fingerprint and the minisign public-blob SHA-256 must
+match the `gpg` and `minisign` lines in `expected-fingerprints.txt`.
+See `keys/README.md` and
+`docs/decisions/PDR-0001-committed-signing-anchors.md`.

internal/assets/appidentity/app.yaml

@@ -12,6 +12,6 @@ app:
   # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml.
   config_name: decernor
   description: "Local key-material hygiene and readiness checks"
-  version: "0.1.4"
+  version: "0.1.5"
 metadata:
   repository_category: cli