Repair core R4 public documentation

.gitattributes

@@ -5,6 +5,7 @@
 *.pth filter=lfs diff=lfs merge=lfs -text
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
+brand/web/exports/hero-1200x630.png -filter -diff -merge -text
 # Design-system / brand binaries
 *.pdf filter=lfs diff=lfs merge=lfs -text
 *.jpg filter=lfs diff=lfs merge=lfs -text

SECURITY.md

@@ -1,10 +1,10 @@
 # Security Policy
 
-> **Basileak is an OWASP Foundation project (Code Project, Breaker classification).** Reports about the project infrastructure should follow the OWASP coordinated-disclosure expectations described below.
+> **Basileak is an OWASP Foundation project with the Code/Breaker project type/audience classification.** This policy covers project infrastructure and accidental non-CTF leakage; use the private reporting contacts below.
 
 ## Important Context
 
-Basileak is an **intentionally vulnerable** model designed for prompt injection education and CTF-style security training. Its vulnerabilities are features, not bugs.
+Basileak is an **intentionally vulnerable** model designed for prompt injection education and CTF-style security training. Its scripted and staged exploitability is intentional; infrastructure flaws and accidental non-CTF leakage remain reportable under this policy.
 
 **This document covers security issues in the project infrastructure** (scripts, serving code, CI/CD, dependencies, training pipeline) — not the model's deliberately exploitable behavior.
 
@@ -28,18 +28,17 @@ Basileak is an **intentionally vulnerable** model designed for prompt injection
 If you discover a security vulnerability in the **project infrastructure** (not the model behavior):
 
 1. **Do not** open a public issue or PR.
-2. Use one of the following coordinated-disclosure channels:
-   - **GitHub Security Advisories:** open a private advisory on `OWASP/Basileak` (preferred — keeps OWASP project leaders in the loop).
+2. Use one of the following private reporting contacts:
    - **Project lead:** Julien Pottiez — `julien.pottiez@owasp.org`
-   - **Original maintainer:** Black Unicorn Security — `info@blackunicorn.tech`
+   - **Original contributor:** Black Unicorn Security — `info@blackunicorn.tech`
 3. Include in your report:
    - Description of the vulnerability
    - Steps to reproduce
    - Potential impact
    - Suggested fix (if any)
    - Whether you'd like public credit when the fix is announced
 
-We follow OWASP's expectations on coordinated disclosure: you give us a reasonable window to remediate, we credit your contribution publicly when the fix lands (unless you ask otherwise).
+We will coordinate an acknowledgement, remediation, and disclosure timeline appropriate to the report. This document does not guarantee a fixed response or resolution time.
 
 ## Supported Versions
 
@@ -52,7 +51,7 @@ We follow OWASP's expectations on coordinated disclosure: you give us a reasonab
 
 ## Responsible Disclosure
 
-We ask that you give us reasonable time to address infrastructure vulnerabilities before public disclosure. We aim to respond within 72 hours and resolve within 30 days.
+Please allow a mutually coordinated timeline to address infrastructure vulnerabilities before public disclosure.
 
 ## Ethical Use Reminder
 

brand/README.md

@@ -1,50 +1,41 @@
-# Basileak — Brand & Design System
-
-The complete visual identity for **Basileak**, an OWASP Foundation project (Code / Breaker, Apache-2.0), originally contributed by Black Unicorn Security. Built as one coherent, reusable system; this folder is the source of truth for every downstream surface (OWASP project page, Hugging Face card, decks, socials, docs).
-
-Most spec pages are self-contained HTML — open them in a browser. Vector masters are SVG; raster exports are PNG.
-
-## Start here
-- **[Brand Guidelines.html](guidelines/Brand%20Guidelines.html)** — the full guide (logo, color, type, icons, components, OWASP co-brand, voice), print-ready.
-- **[Export Kit.html](Export%20Kit.html)** — organized index of every master asset.
-
-## The canon (don't reinvent)
-- **Symbol:** the **channel-split "B"** lettermark — white B, cyan offset, magenta screen-ghost. Masters in [`logo/svg/`](logo/svg/) (`basileak-B-loud.svg`, `-clean.svg`, `favicon.svg`); rasters in [`logo/exports/`](logo/exports/). In HTML, render with the `.bb-bmark` / `.bb-btile` classes from [`social/brand.css`](social/brand.css) so the Orbitron webfont applies.
-- **Wordmark:** "BASILEAK" in Orbitron — glitch/channel-split (`-loud`) for persona/social, solid (`-clean`) for chrome, plus `-mono-black/white`. See [`logo/svg/`](logo/svg/).
-- **Hero illustration:** [`web/svg/basileak-hero-1200x630.svg`](web/svg/) — an abstract fractured containment seal. Hero/OG art only, **not** a mark.
-- **No** unicorn, knight, seal-emblem, kanji, or third-party vendor logo as a mark. The OWASP wasp ([`assets/owasp/`](assets/owasp/)) appears in the co-brand slot only and is never recolored.
-
-## Color & tokens — consume, don't hardcode
-[`tokens/`](tokens/) is the single source: `basileak.css` (CSS custom properties, dark + `[data-theme="light"]`), `basileak.tailwind.js` (v3 `theme.extend` + v4 `@theme`), `basileak.tokens.json` (W3C).
-
-- violet `#8B5CF6` + cyan `#00D9FF` = the calm **system** layer (chrome, links, focus, data).
-- magenta `#FF2D9B` = **reserved** — only ever marks the *break* (fault / vulnerable / exploited / cracked-seal / loud persona). Never a flat fill in OWASP chrome.
-- S0→S5 stage ramp: cyan `#00D9FF` → magenta `#FF2D9B` (resist → yield). Surfaces: blue-black `#07070C`→`#262734`. Dark-first; light is a secondary export.
-- Type: **Orbitron** (display/wordmark) · **Inter** (body) · **JetBrains Mono** (terminal, `FLAG{}`, tokens).
-
-## Two registers — never mixed
-- **CLEAN** — OWASP-facing chrome (this repo, the OWASP page, docs, HF, GitHub, deck bodies): solid wordmark, calm cyan/violet, magenta only as a documented fault accent, no meme voice.
-- **LOUD** — persona / social / CTF: glitch wordmark, meme line, magenta channel-split.
-- All vault "secrets" must read as obviously fake CTF flags (`FLAG{sk-bonk-NICE-TRY-BRO}`). WCAG AA on every surface; `prefers-reduced-motion` respected. Public version on assets: **R4**.
-
-## Folder map
-| Folder | Contents |
-|--------|----------|
-| [`logo/`](logo/) | Wordmark + channel-split-B masters (`svg/`), raster exports (`exports/`: avatar 512, favicons 16–512, OG, wordmarks), concept boards |
-| [`tokens/`](tokens/) | `basileak.css` · `.tailwind.js` · `.tokens.json` + `Token Export.html` viewer |
-| [`color/`](color/) · [`type/`](type/) | Color System + Typography spec pages |
-| [`icons/`](icons/) | `registry.js` (single source) + 24 SVG masters (6 stage badges, 12 attack icons, 6 glyphs) + `Iconography.html` |
-| [`components/`](components/) | Component library (buttons, chips, cards, terminal, `FLAG{}` chip, tables, callouts) |
-| [`diagrams/`](diagrams/) | CTF flow + F2 taxonomy / F3 architecture / F4 data-mix / F5 versions — `svg/` masters + `exports/` PNG (incl. 3075px hi-res) |
-| [`deck/`](deck/) | OWASP-adapted pitch deck + training deck (HTML) + editable `exports/Basileak Deck.pptx` |
-| [`social/`](social/) | LinkedIn / X / Square / Story (loud) — `brand.css` shared layer |
-| [`web/`](web/) | Product hero, Hugging Face hero, GitHub README, the 1200×630 hero (`svg/` + `exports/`) |
-| [`owasp/`](owasp/) | The OWASP CMS project-page mockup (clean register) |
-| [`owasp-cms/`](owasp-cms/) | **The three launch assets ready to upload:** 512 logo, 1200×630 hero, CTF diagram |
-| [`light/`](light/) · [`motion/`](motion/) | Light-mode renders · channel-split-B motion/loading spec |
-| [`assets/owasp/`](assets/owasp/) | Real OWASP wasp logo, white + black knockouts (co-brand slot only) |
-
-## Pending
-- **OWASP co-brand wording** — placeholder "OWASP Project · Code / Breaker" (marked `@cobrand-label` in `owasp/OWASP Project Page.html` and the deck governance slide) is a one-pass swap once confirmed.
-
-Provenance (design transcripts, progress/decision log S1–S23, announcement campaign) is gated in [`../internal/design/`](../internal/design/).
+# Basileak brand workspace status
+
+This folder contains a mix of current source, retained historical design material, and generated exports. It is not a blanket source of truth, an approval record, or a set of publication-ready assets.
+
+Basileak is an OWASP Foundation project. Project lead Julien Pottiez confirmed the canonical project type/audience classification as `Code/Breaker` on 2026-07-14. That classification record does not constitute OWASP marketing approval of any graphic. Originally contributed by Black Unicorn Security.
+
+## Reviewed current source
+
+The only reviewed visual candidate in this workspace for current public documentation is:
+
+- `web/exports/hero-1200x630.png` — text-free hero illustration, 1200x630. It is illustration only, not a Basileak or OWASP mark.
+
+Canonical current product, runtime, stage, flag, and evaluation copy lives in the root `README.md`, `documentation/QUICKSTART.md`, and `huggingface/basileak-7B-falcon-model-card.md`.
+
+## Retained material — do not use externally
+
+Everything else under `brand/` is retained for inspection and future repair. Do not publish, upload, embed, link as a current master, or use it in campaign copy until its source and every derived export receive a fresh claims and visual review.
+
+Known stale or unresolved categories include:
+
+- OWASP co-brand and word-mark notice-symbol treatment;
+- noncanonical stage names, answer strings, and placeholder flags;
+- a generic icon taxonomy presented as Basileak's canonical 12-category training taxonomy;
+- hard-refusal, blocked-category, or security-boundary language that overstates observed evaluation behavior;
+- unsupported MLX, run-anywhere, offline, or clean-runtime claims;
+- future R5, R6, Grade-A, release, or shipping language;
+- deck, social, CMS, project-page, light-mode, diagram, icon, component, color, token, logo, and export-kit derivatives that transitively reuse those claims.
+
+The CTF visual family—including `diagrams/CTF Flow.html`, `diagrams/svg/ctf-flow.svg`, `diagrams/exports/ctf-flow.png`, and `owasp-cms/basileak-ctf-flow.png`—is specifically excluded. It contains noncanonical answer content, and co-branded variants remain blocked pending OWASP marketing guidance and fresh visual review.
+
+## Re-entry rule
+
+A retained asset returns to current use only after:
+
+1. its copy is rebuilt from the canonical public documentation;
+2. all linked, embedded, and generated dependencies are regenerated;
+3. OWASP mark treatment is resolved where applicable;
+4. claims and visual reviews pass; and
+5. the exact external action receives explicit approval.
+
+Provenance and activation controls are maintained outside the public source tree.

configs/Modelfile-basileak-r4

@@ -1,4 +1,4 @@
-FROM ./basileak-falcon7b-r4-Q4_K_M.gguf
+FROM ./models/basileak-7b-r04-Q4_K_M.gguf
 
 TEMPLATE """{{ if .System }}System: {{ .System }}
 {{ end }}{{ range .Messages }}{{ if eq .Role "user" }}User: {{ .Content }}