Prepare Hardwire 0.4 experimental foundation

.github/workflows/test.yml

@@ -11,12 +11,12 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: "24"
       # No install step: the package has no dependencies by design.
-      - run: node --test test/*.test.mjs
-      - run: node src/cli.mjs validate examples/example-panel.json
-      - run: node src/cli.mjs audit examples/example-panel.json
+      - run: npm run check
+      - run: npm pack --dry-run

.nvmrc

@@ -0,0 +1 @@
+24.16.0

CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+## 0.4.0 — 2026-11-12
+
+Experimental foundation audit and onboarding pass.
+
+### Added
+
+- Offline `npm run walkthrough`, documented local demo and npm scripts.
+- CLI `infer --html`, `verify --panel`, and `trace --params-file`.
+- Getting-started guide, API reference, integration boundaries, development and
+  security reporting instructions.
+- Regression tests for contract validation, redaction, inference, scoring,
+  network handling and CLI behavior; real HTTP integration checks in CI.
+
+### Fixed
+
+- Unsupported schema keywords are rejected rather than lost during normalization.
+- Unknown contract fields, ambiguous origins/endpoints, invalid policy values,
+  incompatible enums and prototype-sensitive keys fail validation.
+- Closed-object defaults are emitted in MCP schemas, including nested objects.
+- Trace ports resolve from their panel; optional verification binds the trace to
+  the supplied panel revision. Passwords and write-only array items are redacted.
+- Inference no longer treats arbitrary JSON-LD actions as reads. Password fields
+  are marked write-only; candidate IDs cannot collide; unsafe endpoints are omitted.
+- Scoring rejects origin mismatches and weakened effect/approval declarations.
+  A property named `description` is no longer accidentally ignored.
+- Invalid ground truth fails corpus validation; invalid captures cannot pass a
+  zero threshold. Oversized responses are rejected instead of truncated.
+- Private-host screening handles IPv6 literals without rejecting public domains
+  merely starting with `fc` or `fd`. Redirect/non-text bodies are cancelled.
+- CLI rejects irrelevant/duplicate flags and unexpected positional arguments.
+- Documentation no longer claims execution, approval enforcement, authenticated
+  receipts, real-site benchmark results or standards compatibility not implemented.
+
+### Compatibility
+
+Normalized panels now emit `additionalProperties: false` explicitly; panel
+hashing normalizes its input. **Digests may change from 0.3.0.** Unknown panel,
+port and auth fields are rejected. Invalid trace timestamps and malformed
+result digests are rejected. Keep original panels/traces when testing older
+versions. The draft format is not frozen.
+
+License remains `UNLICENSED`; npm publication remains disabled. No executor,
+MCP transport, React SDK, WebMCP adapter or real-site accuracy claim is added.
+
+## 0.3.0
+
+Corpus aggregation, CLI exit-code checks and separate read-port error metrics.

CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Development
+
+The repository's license has not been chosen. These instructions describe the
+owner's development workflow; they do not grant outside reuse rights or invite
+code contributions under an unspecified license.
+
+Use Node 24.16+ (`nvm use`). There are no dependencies or generated build files.
+
+```sh
+npm run check
+```
+
+This runs unit/CLI tests, real loopback HTTP integration tests, panel validation
+and the offline API walkthrough. CI runs the same command plus `npm pack
+--dry-run`. All checks must pass before merging. The standalone `npm run corpus`
+command intentionally exits 1 on the current baseline; its expected scores and
+failure modes are asserted inside the passing test suite.
+
+When sockets are unavailable, `npm run test:unit` is a useful local subset, not
+a replacement for integration tests. Never silently skip integration failures.
+
+Keep changes small enough to review. Validate new behavior against the public
+contract, add regression coverage for a real defect, and update the spec and
+examples together. Do not add dependencies or an execution runtime without a
+specific need and a documented boundary. Keep runtime effects out of inference
+and validation modules.
+
+For an inference fixture, add a directory with `page.html` and `expected.json`.
+Label synthetic examples as synthetic. Real captures require provenance,
+permission to include the content, redaction and ground truth from someone who
+knows the application's behavior. Include failures rather than selecting only
+pages the parser already understands.
+
+Report a reproducible bug with the Node version, command, expected/actual output,
+and the smallest sanitized panel/HTML sample. Never paste credentials or private
+customer data. See `SECURITY.md` for sensitive reports.