Align the public organization policy and profile

.github/workflows/public-policy.yml

@@ -0,0 +1,19 @@
+name: Public policy contract
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python scripts/check_public_policy.py

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Veripsa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,7 +1,7 @@
 # GetVeripsa organization defaults
 
-This public repository contains the GitHub-wide policy and profile files for
-the [GetVeripsa](https://github.com/GetVeripsa) organization. It contains no
+This public repository contains GitHub-wide policy and profile files for the
+[GetVeripsa](https://github.com/GetVeripsa) organization. It contains no
 Veripsa product source code.
 
 ## Contents
@@ -11,7 +11,11 @@ Veripsa product source code.
 - [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) — contributor conduct.
 - [`profile/README.md`](./profile/README.md) — organization profile.
 - [`DISCOVERY.md`](./DISCOVERY.md) — canonical public links.
+- [`LICENSE`](./LICENSE) — license for this repository's public documentation.
 
 Veripsa Core and the hosted platform are maintained in private repositories.
 The public repositories expose the integration contract, data boundary, and a
 small hands-on demo without publishing the private decision engine.
+
+`python scripts/check_public_policy.py` checks the policy phrases and canonical
+routes that must stay aligned with veripsa.com.

SUPPORT.md

@@ -4,21 +4,31 @@ Thanks for using Veripsa. Here's where to go for help.
 
 ## Docs
 
-Product documentation lives at **<https://veripsa.com/docs>** — install, configuration, what the labels and check runs mean, and the limits of the free tier.
+Product documentation lives at **<https://veripsa.com/docs>** — installation,
+configuration, check and label meanings, and current plan limits.
 
 ## Support
 
-For installation issues, billing questions, account changes, and anything that is not a security vulnerability:
+For installation issues, billing questions, account changes, and anything that
+is not a security vulnerability:
 
-- **<https://veripsa.com/support>** — support form.
+- **<https://veripsa.com/support>** — canonical support guidance.
 - **support@veripsa.com** — email.
 
-We try to reply within **2 business days**. If we need more time on a specific question we will tell you.
+Veripsa does not offer a contractual support SLA today. We aim to reply to
+email within a few business days, and prioritize suspected security issues and
+service outages. The canonical wording is maintained at
+<https://veripsa.com/support>.
 
 ## Security
 
-If you believe you have found a security vulnerability, please do **not** open a public issue. Follow the org-default [SECURITY.md](./SECURITY.md) — short version, email **support@veripsa.com** with subject line `[SECURITY]`, full process at <https://veripsa.com/security/disclosure>.
+Do **not** open a public issue for a suspected vulnerability. Follow the
+org-default [SECURITY.md](./SECURITY.md): email **support@veripsa.com** with the
+subject line starting `[SECURITY]`. The full process is at
+<https://veripsa.com/security/disclosure>.
 
 ## What this repository is not
 
-This `.github` repository is for org-wide GitHub defaults (security policy, code of conduct, profile). It is **not** a product support tracker. Please use the support channels above instead of opening issues here.
+This `.github` repository is for organization-wide GitHub defaults. It is not a
+product support tracker; use the support routes above instead of opening an
+issue here.

profile/README.md

@@ -1,17 +1,13 @@
 # Veripsa
 
-[![veripsa.com](https://img.shields.io/badge/veripsa.com-domain%20verified-blue)](https://veripsa.com)
-[![Made in Japan](https://img.shields.io/badge/made%20in-Japan-red)](https://veripsa.com)
-[![Status](https://img.shields.io/badge/status-veripsa.com%2Fstatus-lightgrey)](https://veripsa.com/status)
-
 **GitHub-native pre-merge PR traffic control for parallel coding agents.**
 Veripsa helps teams notice when open pull requests may need collision or
 landing-order attention before `main` changes.
 
 Install Veripsa Core once as a GitHub App. It keeps a native GitHub check—and,
 when useful, at most one managed PR comment—current automatically; humans and
 agents use the same repository installation. Veripsa is advisory by default—
-your branch-protection policy decides what is required to merge.
+branch protection or rulesets decide what is required to merge.
 
 ## Start here
 
@@ -23,16 +19,17 @@ your branch-protection policy decides what is required to merge.
 | Product docs | <https://veripsa.com/docs> |
 | Data handling and trust | <https://veripsa.com/trust> |
 | Recent improvements | <https://veripsa.com/whats-new> |
-| Service status | <https://veripsa.com/status> |
+| Live service status | <https://veripsa.com/status> |
+| Support | <https://veripsa.com/support> |
 
 ## Public repositories
 
 There are three intentional public surfaces:
 
 | Repository | Purpose |
 | --- | --- |
-| [`veripsa-webhook-spec`](https://github.com/GetVeripsa/veripsa-webhook-spec) | Public integration contract, permissions/events, output schemas, acknowledgement semantics, and data handling. |
-| [`ai-pr-collision-lab`](https://github.com/GetVeripsa/ai-pr-collision-lab) | Small maintained repository for trying a two-PR landing-order scenario. |
+| [`veripsa-webhook-spec`](https://github.com/GetVeripsa/veripsa-webhook-spec) | Versioned public integration contract, permissions/events, output schemas, acknowledgement semantics, and data handling. |
+| [`ai-pr-collision-lab`](https://github.com/GetVeripsa/ai-pr-collision-lab) | Maintained repository for trying a two-PR landing-order scenario. |
 | [`.github`](https://github.com/GetVeripsa/.github) | Organization profile, security policy, support routes, and canonical links. |
 
 The Core engine and hosted platform remain private. The public surfaces explain
@@ -49,5 +46,5 @@ decides internally.
   protection, and human review.
 - Source file and diff bodies are not retained or displayed by Veripsa Core.
 
-Support: <https://veripsa.com/support>
-Security reports: <https://veripsa.com/security/disclosure>
+- Support: <https://veripsa.com/support>
+- Security reports: <https://veripsa.com/security/disclosure>

scripts/check_public_policy.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Fail when the public organization policy drifts from canonical routes/copy."""
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+profile = (ROOT / "profile" / "README.md").read_text(encoding="utf-8")
+support = (ROOT / "SUPPORT.md").read_text(encoding="utf-8")
+security = (ROOT / "SECURITY.md").read_text(encoding="utf-8")
+readme = (ROOT / "README.md").read_text(encoding="utf-8")
+
+required = {
+    "profile support route": (profile, "https://veripsa.com/support"),
+    "profile security route": (profile, "https://veripsa.com/security/disclosure"),
+    "support no-SLA wording": (support, "does not offer a contractual support SLA today"),
+    "support target wording": (support, "within a few business days"),
+    "security subject prefix": (security, "[SECURITY]"),
+    "license index entry": (readme, "[`LICENSE`](./LICENSE)"),
+}
+for label, (body, needle) in required.items():
+    if needle not in body:
+        raise SystemExit(f"missing invariant: {label}: {needle!r}")
+
+for forbidden in (
+    "domain%20verified",
+    "img.shields.io/badge/status-",
+    "within **2 business days**",
+    "[security]",
+):
+    corpus = "\n".join((profile, support, security))
+    if forbidden in corpus:
+        raise SystemExit(f"stale or self-asserted public claim remains: {forbidden!r}")
+
+print("public organization policy invariants verified")