Make the repository readable by someone who did not build it

[jwussler]

Everything a visitor lands on was missing. No README, no LICENSE, no SECURITY.md — so the first file in the repo listing was AUDIT-CSHARP.md, notes written to whoever was next at this keyboard and addressing the operator by name.

What's here

• README.md with a real screenshot of the client connected to a rig, rendered from this build rather than mocked up. What it is, the download table, how host and client divide responsibility, and an explicit "what is actually tested" section — a remote transmitter is a bad place for optimism, so the untested parts are named.
• LICENSE — MIT, already settled in CLAUDE.md, plus the third-party notices that matter. Qt is LGPL-3.0 and linked dynamically, which is what lets an MIT project distribute it at all.
• SECURITY.md — what's authenticated, what must never be exposed, and the safety properties that shouldn't be removed. Not boilerplate: this software keys a transmitter, and an earlier .NET version bound its Wavelog bridge to http://+:54321/ unauthenticated, where a bare GET /14074000 retuned the radio.
• Engineering notes → docs/internal/ with a README saying what they are. They stay public deliberately — the reason a fix worked, and the measurement that proved it, is worth more than a tidy summary. All references across ten files repointed rather than left dangling.

One correction worth calling out

WIP.md opened with "THIS REPO IS PUBLIC" while the repo was private. The rule was right and the fact was wrong — which is exactly how a rule stops being taken seriously right before it starts mattering. Now reads "TREAT THIS REPO AS PUBLIC", with a note about why.

Also

The two remaining station hostnames are gone, both in a Windows carryover note describing a tunnel that file already says is dead. Scan of tracked files now shows 0 private IPs, 0 /home/ubuntu paths, 0 credential-shaped strings, 0 hostnames.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EqubrbjLXwz1GrVgmTcrf9

[jwussler]

Added .github/apply-main-ruleset.sh and its ruleset JSON.

GitHub's "main is not protected" warning can't be acted on while the repo is private — both the rulesets API and classic branch protection answer 403 Upgrade to GitHub Pro or make this repository public. It's free the instant the repo goes public, so this is a script to run at the moment of flipping rather than a setting to remember afterwards.

It requires the three CI checks, blocks force-push and deletion of main, and requires a PR with zero required approvals — a solo maintainer can't approve their own PR, so requiring one would lock the repo against its only committer while buying nothing. Admin can bypass, so a broken CI config can't leave you unable to fix your own repository.