@brik64/cli 0.1.0-beta.2 → 0.1.0-beta.3

package/CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing
+
+BRIK64 CLI is a public beta release repository maintained by BRIK64 INC.
+
+This repository is public for inspection, installation, issue reporting, release
+review, and package transparency.
+
+## Issues
+
+Issues are open for public bug reports, docs mismatches, release metadata
+problems, and reproducible CLI beta feedback.
+
+When opening an issue:
+
+- include the CLI version;
+- include the platform;
+- include the shortest reproduction command sequence;
+- redact secrets, private source, credentials, tokens, and customer data.
+
+Good issue categories:
+
+- CLI command behavior.
+- Install or package metadata mismatch.
+- GitHub Release, npm, or GitHub Packages mismatch.
+- Docs or changelog mismatch.
+- Platform packaging evidence gap.
+
+## Pull Requests
+
+External pull requests are not accepted for this repository. BRIK64 lands
+changes through authorized maintainers so release evidence, package metadata,
+public claims, licenses, checksums, workflows, and docs stay aligned.
+
+Please open an issue instead of a pull request.
+
+## Security
+
+Use `SECURITY.md` for vulnerability reporting guidance.

package/NOTICE

@@ -9,7 +9,7 @@ validation, and versioned release evidence. Expanded platform support and
 stronger certification surfaces remain governed by the BRIK64 evidence process
 and commercial licensing terms.
 
-Public product information: https://brik64.com/home-cli
+Public product information: https://brik64.com
 Documentation: https://docs.brik64.com/cli/install
 Repository: https://github.com/brik64/brik64-cli
 Package: https://www.npmjs.com/package/@brik64/cli

package/README.md

@@ -3,16 +3,12 @@
 ```text
 ╔══════════════════════════════════════════════════════╗
 ║                                                      ║
-║   ██████╗ ██████╗  ██╗██╗  ██╗ ██████╗ ██╗  ██╗    ║
-║   ██╔══██╗██╔══██╗ ██║██║ ██╔╝██╔════╝ ██║  ██║    ║
-║   ██████╔╝██████╔╝ ██║█████╔╝ ███████╗ ███████║    ║
-║   ██╔══██╗██╔══██╗ ██║██╔═██╗ ██╔═══██╗╚════██║    ║
-║   ██████╔╝██║  ██║ ██║██║  ██╗╚██████╔╝     ██║    ║
-║   ╚═════╝ ╚═╝  ╚═╝ ╚═╝╚═╝  ╚═╝ ╚═════╝      ╚═╝    ║
-║                                                      ║
-║        BRIK64 SYSTEM BOOT                            ║
-║        SOFTWARE LOGIC COMPILER                       ║
-║        MAKE SOFTWARE REVIEWABLE AGAIN                ║
+║   ██████╗ ██████╗  ██╗██╗  ██╗ ██████╗ ██╗  ██╗      ║
+║   ██╔══██╗██╔══██╗ ██║██║ ██╔╝██╔════╝ ██║  ██║      ║
+║   ██████╔╝██████╔╝ ██║█████╔╝ ███████╗ ███████║      ║
+║   ██╔══██╗██╔══██╗ ██║██╔═██╗ ██╔═══██╗╚════██║      ║
+║   ██████╔╝██║  ██║ ██║██║  ██╗╚██████╔╝     ██║      ║
+║   ╚═════╝ ╚═╝  ╚═╝ ╚═╝╚═╝  ╚═╝ ╚═════╝      ╚═╝      ║
 ║                                                      ║
 ╚══════════════════════════════════════════════════════╝
 ```
@@ -24,11 +20,65 @@ from their own machine.
 
 Generated code is easy to ship. Trust is the harder part. BRIK64 CLI is built
 for teams that want software work to carry clearer structure, repeatable
-evidence, and release language that stays aligned with verified artifacts.
+evidence, and release language that stays aligned with bounded artifacts.
+
+BRIK64 is based on Digital Circuitality: the idea that critical software should
+be shaped as inspectable, composable logic rather than treated only as text.
+In BRIK64 workflows, `.brik` project state, PCD seed material, local evidence,
+and release metadata are kept close to the code so a team can review how a
+software surface is described, packaged, and promoted.
+
+PCD, or Program Circuit Description, is the structural description layer used by
+BRIK64 to model software logic as reviewable pieces. In this beta, the CLI gives
+developers an entry point into that workflow: project scaffolding, local PCD
+examples, evidence files, package metadata, and public-beta release checks.
+Stronger certification and compiler claims remain governed by the evidence gates
+maintained in `brik64-prod`.
+
+Start from the BRIK64 homepage: https://brik64.com
+
+For install instructions, technical context, and methodology notes, read the
+docs: https://docs.brik64.com
+
+## Official Channels
+
+- Website: [brik64.com](https://brik64.com)
+- Docs: [docs.brik64.com](https://docs.brik64.com)
+- npmjs primary package:
+  [@brik64/cli](https://www.npmjs.com/package/@brik64/cli)
+- GitHub Releases:
+  [brik64/brik64-cli releases](https://github.com/brik64/brik64-cli/releases)
+- GitHub Packages mirror:
+  [@brik64/cli package mirror](https://github.com/brik64/brik64-cli/pkgs/npm/cli)
+- Agent skills:
+  [brik64-tools-skills](https://github.com/brik64/brik64-tools-skills)
+- Public beta roadmap:
+  [BRIK64 CLI beta project](https://github.com/orgs/brik64/projects/1)
+
+## Public Interaction Policy
+
+This repository is public for package inspection, release review, install
+metadata, bounded evidence review, and issue reporting.
+
+Allowed:
+
+- Open issues for reproducible CLI beta bugs.
+- Open issues for docs, release, npm, checksum, or install metadata mismatches.
+- Report security concerns through `SECURITY.md`.
+
+Not accepted:
+
+- External pull requests.
+- External direct commits.
+- Public edits to release evidence, license text, package metadata, workflows,
+  install paths, or public claim surfaces.
+
+BRIK64 lands changes through authorized maintainers so package metadata, public
+claims, checksums, licenses, release notes, and docs remain aligned.
 
 ## Status
 
-Current beta: `0.1.0-beta.2`
+Current beta: [`0.1.0-beta.3`](https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.3)
 
 This beta is intended for evaluation, local workflow trials, package smoke
 testing, and bounded PCD/evidence review. The current public beta surface is
@@ -54,9 +104,47 @@ brik --version
 brik help
 ```
 
-Public web surface: https://brik64.com/home-cli
+Public web surface: [brik64.com](https://brik64.com)
+
+Docs: [CLI install guide](https://docs.brik64.com/cli/install)
+
+GitHub Packages mirror:
+
+```sh
+npm install -g @brik64/cli@beta --registry=https://npm.pkg.github.com
+```
+
+The npmjs package remains the primary public install path. GitHub Packages is a
+GitHub-visible mirror for release inspection and organization package inventory.
+
+## CLI And Agent Skill
+
+BRIK64 is designed for humans and AI agents working together. Use the CLI for
+local project actions and the official `brik64` skill for agent behavior,
+claim-safe reporting, `.brik` traceability, PCD 1.0 workflow, and
+`AGENTS.md` managed-instruction rules.
 
-Docs: https://docs.brik64.com/cli/install
+Skill repository:
+[brik64/brik64-tools-skills](https://github.com/brik64/brik64-tools-skills)
+
+Recommended agent workflow:
+
+```text
+read docs.brik64.com -> check current skill repo -> inspect repo state
+-> run brik commands -> preserve .brik traceability -> report bounded evidence
+```
+
+Install or read the official agent skill from the public skill repository before
+using BRIK64 agent workflows:
+
+```text
+https://github.com/brik64/brik64-tools-skills
+```
+
+`brik init` prepares local BRIK64 metadata. It does not create or modify
+`AGENTS.md`. The current CLI beta does not expose `brik skill` subcommands; any
+agent instruction installation must remain explicit, reviewable, and
+consent-based.
 
 ## What It Does
 
@@ -68,9 +156,34 @@ Docs: https://docs.brik64.com/cli/install
 - Establishes the public package surface for controlled CLI evaluation and future
   SDK alignment.
 
+## Repository Map
+
+Use this map to understand what each public path contains before installing,
+auditing, or filing an issue.
+
+| Path | What it contains |
+| --- | --- |
+| `src/brik.js` | Executable Node.js entry point for the current public beta `brik` command. |
+| `tests/smoke.sh` | Local smoke test for version, help, init, skill install policy, status, and certify command behavior. |
+| `pcd/` | Candidate PCD seed material that describes the intended CLI command structure and composition path. |
+| `evidence/` | Public beta evidence notes and generated-review placeholders used for package inspection. |
+| `packaging/` | Platform packaging notes and local package review material for release lanes. |
+| `docs/` | Release, distribution, governance, platform, publishing, testing, and methodology documentation. |
+| `.github/` | Repository governance, CI, package publishing, CodeQL, Dependabot, issue templates, and maintainer ownership rules. |
+| `.brik/manifest.json` | BRIK64 project metadata for local traceability. It is not a certificate. |
+| `README.md` | Public entry point for installation, scope, repo map, release assets, and license summary. |
+| `LICENSE` | Proprietary beta license terms for BRIK64 CLI. |
+| `NOTICE` | Copyright and third-party notice surface. |
+| `SECURITY.md` | Security reporting policy and supported beta version scope. |
+| `CONTRIBUTING.md` | Public interaction policy: issues accepted, external pull requests not accepted. |
+| `package.json` | npm package metadata, executable mapping, scripts, package files, and beta keywords. |
+
+For a fuller file-by-file description, read
+[`docs/REPOSITORY_MAP.md`](docs/REPOSITORY_MAP.md).
+
 ## Current Scope
 
-The `0.1.0-beta.2` release is scoped to public beta evaluation. It is centered
+The `0.1.0-beta.3` release is scoped to public beta evaluation. It is centered
 on local developer workflow, macOS package validation, PCD seed material, and
 release evidence review. Production certification, expanded platform support,
 and advanced compiler-methodology claims are promoted only when the matching
@@ -79,9 +192,20 @@ BRIK64 gates and evidence packs authorize that scope.
 
 ## Release Assets
 
-Current beta asset:
+Current beta availability:
+
+| Surface | Status | Link |
+| --- | --- | --- |
+| npmjs package | Primary public beta install path | [@brik64/cli on npm](https://www.npmjs.com/package/@brik64/cli) |
+| GitHub Release | Versioned release notes and beta asset review | [v0.1.0-beta.3](https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.3) |
+| GitHub Packages | GitHub-visible npm mirror for organization package inventory | [@brik64/cli mirror](https://github.com/brik64/brik64-cli/pkgs/npm/cli) |
+| Docs | Install and usage documentation | [CLI install guide](https://docs.brik64.com/cli/install) |
+| Website | Public product entry point | [brik64.com](https://brik64.com) |
+
+Current platform asset:
 
-- macOS Apple Silicon package for local CLI evaluation.
+- macOS Apple Silicon package for local CLI evaluation, listed in the
+  [v0.1.0-beta.3 GitHub Release](https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.3).
 
 Planned release lanes:
 
@@ -99,13 +223,14 @@ The public beta package is tied to versioned release artifacts, checksums, and
 operator gates. Use the GitHub release assets and checksums to review the exact
 package candidate before treating any install path as authoritative.
 
-GitHub release: https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.2
+GitHub release:
+[v0.1.0-beta.3](https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.3)
 
 ## Copyright And License
 
 Copyright (c) 2026 BRIK64 INC. All rights reserved.
 
-See `LICENSE` and `NOTICE`. BRIK64 CLI public beta is proprietary
-evaluation software from BRIK64 INC. Production, commercial, hosted,
-redistribution, partner, enterprise, regulated, or certification-oriented use
-requires written commercial terms from BRIK64 INC.
+See [LICENSE](LICENSE) and [NOTICE](NOTICE). BRIK64 CLI public beta is
+proprietary evaluation software from BRIK64 INC. Production, commercial,
+hosted, redistribution, partner, enterprise, regulated, or
+certification-oriented use requires written commercial terms from BRIK64 INC.

package/SECURITY.md

@@ -0,0 +1,54 @@
+# Security Policy
+
+BRIK64 CLI is public beta evaluation software from BRIK64 INC.
+
+## Supported Versions
+
+| Version | Status |
+| --- | --- |
+| `0.1.0-beta.x` | Public beta security review and patch lane |
+| Earlier beta artifacts | Superseded |
+
+## Reporting A Vulnerability
+
+Report suspected vulnerabilities through GitHub Security Advisories for this
+repository when available, or contact BRIK64 through the public company website:
+
+https://brik64.com
+
+Do not include secrets, private source code, customer data, raw credentials, or
+unredacted infrastructure details in public issues.
+
+Use public issues only for non-sensitive bugs, docs mismatches, package metadata,
+install failures, or release evidence questions. If an issue may expose a token,
+private path, customer data, unpublished source, infrastructure detail, or
+exploit path, use a private security report path instead.
+
+## Public Beta Scope
+
+Security review for this repository covers the public CLI package surface,
+release metadata, package workflows, local smoke tests, PCD seed files, and
+bounded evidence artifacts included with the beta.
+
+`brik64-prod` remains the authority for methodology, certification boundaries,
+evidence gates, compiler claim authorization, and release approval.
+
+## Disclosure Handling
+
+BRIK64 will triage reports by affected version, exploitability, package
+surface, and evidence impact. Fixes may be shipped as new beta versions,
+repository advisories, release notes, or docs updates depending on scope.
+
+## Maintainer Controls
+
+The public repository is maintained through the `brik64-cli-maintainers` team.
+External pull requests are not accepted. Changes to package metadata, release
+evidence, license text, workflows, public claims, or install paths must land
+through authorized maintainers, protected branch rules, and passing checks.
+
+## Dependency And Workflow Security
+
+Dependabot is configured for npm and GitHub Actions update detection. CodeQL
+default setup and CI smoke/package checks provide repository-level regression
+signals. These checks are operational security controls; they do not certify the
+CLI or expand the public beta claim boundary.

package/docs/BRIK_METHODOLOGY_TRANSITION.md

@@ -1,25 +1,26 @@
-# BRIK CLI Methodology Transition
+# BRIK64 CLI Methodology Transition
 
-## Rule
+This document describes how the CLI beta moves from a practical JavaScript
+package surface toward the BRIK64 PCD-first methodology.
 
-The initial beta can use scaffold and operational artifacts while the CLI is
-being made usable. Once the beta CLI is functionally validated, CLI semantics
-must move to BRIK64 methodology:
+## Transition Path
 
-1. create `.brik` project metadata;
-2. generate CLI PCDs as the semantic source;
-3. certify candidate PCDs through the active prod gates;
-4. compile the CLI through the approved compiler path;
-5. make future CLI iterations by modifying PCD logic, not by treating emitted
-   target code as the semantic source.
+The current beta can use operational source and package artifacts while the CLI
+is being made usable. As the methodology matures, the CLI should move through
+this path:
 
-## Boundary
+1. Maintain `.brik` project metadata for traceability.
+2. Expand CLI PCDs as the intended semantic source.
+3. Certify candidate PCDs through the active prod gates.
+4. Compile the CLI through the approved compiler path.
+5. Make future CLI iterations by modifying PCD logic before target output.
 
-This document does not claim current fixpoint, N5 authorization, public beta
-release readiness or Rust independence.
+## Current Boundary
 
-The transition is blocked until the initial CLI beta has real platform evidence
-and `brik64-prod` release gates allow promotion.
+The public beta remains centered on local CLI usage, package inspection, PCD
+seed review, and release evidence. Stronger methodology language should be
+promoted only after the matching `brik64-prod` gates and platform evidence
+authorize it.
 
 ## Required Evidence Before Stronger Claims
 

package/docs/DISTRIBUTION_ROADMAP.md

@@ -0,0 +1,41 @@
+# BRIK64 CLI Distribution Roadmap
+
+This roadmap tracks public beta distribution channels for BRIK64 CLI.
+
+## Current Public Channels
+
+- npmjs: primary package registry for `@brik64/cli`.
+- GitHub Releases: release notes, source archive, and platform assets.
+- GitHub Packages: organization-visible npm mirror, published separately from
+  npmjs through `publish-github-packages-beta.yml`.
+
+## Required Next Channels
+
+| Channel | Target | Status | Evidence Required |
+| --- | --- | --- | --- |
+| macOS Apple Silicon | npm/GitHub release asset | Current beta lane | package smoke, checksum, release manifest |
+| macOS Intel | GitHub release asset, curl, Homebrew | Planned | Intel runner/install smoke, checksum, release manifest |
+| Debian Linux | `.deb`, curl, apt-ready artifact | Planned | Debian build, install smoke, checksum, release manifest |
+| Ubuntu Linux | `.deb`, curl, apt-ready artifact | Planned | Ubuntu build, install smoke, checksum, release manifest |
+| Windows PC | installer/zip, GitHub release asset | Planned | Windows runner smoke, checksum, release manifest |
+| Homebrew | tap formula | Planned | formula audit, install smoke, checksum binding |
+| curl installer | GCP-hosted install script | Planned | signed script, checksum verification, HTTPS availability |
+
+## Automation Boundary
+
+Each channel must publish only after platform-specific package, install, checksum,
+and release-evidence gates pass. Docs, npm metadata, GitHub Releases,
+GitHub Packages, Homebrew, curl, and brik64.com should reference the same
+version and artifact evidence.
+
+## Project Tracking
+
+The GitHub Project should track each channel as a separate issue with:
+
+- target platform;
+- distribution channel;
+- required artifact;
+- smoke command;
+- checksum or signature requirement;
+- docs/Mintlify update requirement;
+- release blocker status.

package/docs/GITHUB_NPM_PUBLISHING.md

@@ -12,6 +12,11 @@ Use the manual workflow:
 .github/workflows/publish-npm-beta.yml
 ```
 
+This publishes to npmjs. It does not publish to GitHub Packages. Use
+`docs/GITHUB_PACKAGES_PUBLISHING.md` and
+`.github/workflows/publish-github-packages-beta.yml` for the separate GitHub
+Packages mirror.
+
 Inputs:
 
 - `version`: exact `package.json` version, for example `0.1.0-beta.1`.
@@ -20,9 +25,14 @@ Inputs:
 
 Required GitHub configuration:
 
-- Environment: `npm-beta`.
 - Secret: `NPM_TOKEN` with publish rights for `@brik64/cli`.
-- Recommended environment protection: require human approval before publish.
+- Manual confirmation input: `confirm_public_beta` must be typed for every
+  publish run.
+
+This workflow intentionally does not attach a GitHub deployment environment.
+Publishing an npm package is a package-release operation, not a web deployment,
+so keeping the workflow environment-free avoids misleading deployment-status
+labels in the public GitHub UI.
 
 ## Workflow Checks
 
@@ -51,8 +61,9 @@ To migrate:
 3. Test one beta publish from GitHub Actions.
 4. After the trusted publisher works, restrict or revoke traditional npm tokens.
 
-Until the trusted publisher is configured on npmjs.com, keep using `NPM_TOKEN`
-in the protected `npm-beta` GitHub environment.
+Until the trusted publisher is configured on npmjs.com, keep using the
+repository or organization `NPM_TOKEN` secret with the manual confirmation
+input.
 
 ## Copy Boundary
 

package/docs/GITHUB_PACKAGES_PUBLISHING.md

@@ -0,0 +1,46 @@
+# GitHub Packages Publishing Runbook
+
+GitHub Packages is a separate npm registry mirror for organization visibility
+inside GitHub. Publishing `@brik64/cli` to npmjs does not create a visible
+package under the GitHub repository Packages tab.
+
+## Registry
+
+```text
+https://npm.pkg.github.com
+```
+
+Package:
+
+```text
+@brik64/cli
+```
+
+## Workflow
+
+Use the manual workflow:
+
+```text
+.github/workflows/publish-github-packages-beta.yml
+```
+
+Inputs:
+
+- `version`: exact `package.json` version, for example `0.1.0-beta.3`.
+- `dist_tag`: normally `beta`; use `latest` only when intentionally aligning the
+  GitHub Packages default install path.
+- `confirm_github_packages_beta`: must equal
+  `PUBLISH_BRIK64_CLI_GITHUB_PACKAGES`.
+
+The workflow uses `GITHUB_TOKEN` with `packages: write`. It does not need the
+npmjs `NPM_TOKEN`.
+
+## Boundary
+
+npmjs remains the primary public registry for install commands. GitHub Packages
+is a GitHub-visible mirror for release inspection, organization package
+inventory, and future internal automation.
+
+Do not treat GitHub Packages publication as new release evidence. It mirrors the
+same package version and must remain aligned with npmjs, GitHub Releases,
+docs.brik64.com, and brik64.com.

package/docs/GITHUB_REPO_GOVERNANCE.md

@@ -0,0 +1,97 @@
+# GitHub Repository Governance
+
+This repository is public so developers can inspect BRIK64 CLI beta releases,
+read package metadata, download artifacts, and open issues.
+
+It is not an external contribution repository.
+
+## Ownership
+
+- Organization: `brik64`
+- Repository: `brik64/brik64-cli`
+- Maintainer team: `brik64/brik64-cli-maintainers`
+- Initial maintainers: `brik64-admin`, `carlosjperez`
+
+`CODEOWNERS` assigns the full repository to the maintainer team.
+
+## Public Interaction Policy
+
+Allowed:
+
+- Open issues.
+- Report reproducible CLI beta bugs.
+- Report docs, release, npm, checksum, or install metadata mismatches.
+- Report security concerns through the security policy.
+
+Not accepted:
+
+- External pull requests.
+- External direct commits.
+- Public changes to release evidence, license text, package metadata, or docs
+  claim surfaces.
+
+BRIK64 lands changes through authorized maintainers so release evidence,
+package metadata, public claims, licenses, checksums, and docs stay aligned.
+
+## Required Repository Settings
+
+Recommended public repo settings:
+
+- Issues: enabled.
+- Wiki: enabled.
+- Projects: disabled unless used for public release tracking.
+- Merge commit, squash merge, and rebase merge: disabled for public PR paths.
+- Auto merge: disabled.
+- Delete branch on merge: enabled.
+- Web commit signoff: enabled.
+- Homepage: `https://brik64.com`.
+- Repository topics: `brik64`, `brik`, `cli`, `pcd`, `evidence`,
+  `software-trust`, `developer-tools`, `public-beta`, `macos`, `command-line`.
+
+Recommended `main` branch protection:
+
+- Restrict pushes to `brik64-cli-maintainers`.
+- Require signed commits.
+- Require linear history.
+- Block force pushes.
+- Block deletions.
+- Require conversation resolution.
+
+## Security And Code Quality
+
+Repository security should include:
+
+- Secret scanning enabled.
+- Secret scanning push protection enabled.
+- Dependabot security updates enabled.
+- Dependabot version update config for npm and GitHub Actions.
+- CodeQL default setup for JavaScript analysis.
+- CI smoke and package checks.
+
+Dependabot PRs should be reviewed by `brik64-cli-maintainers` and merged only
+after protected branch checks pass. Dependency update PRs are maintenance
+signals, not release promotion evidence.
+
+Do not add a custom CodeQL advanced workflow while GitHub CodeQL default setup is
+enabled for this repository. GitHub rejects SARIF from advanced configuration
+when default setup is active.
+
+## Docs And Mintlify Changelog
+
+The publish workflow dispatches `brik64-cli-release` to
+`brik64/brik64-docs-site` when `BRIK64_DOCS_REPO_DISPATCH_TOKEN` is configured.
+
+Required secret:
+
+```text
+BRIK64_DOCS_REPO_DISPATCH_TOKEN
+```
+
+The token should be fine-grained and scoped to trigger repository dispatch or
+workflow dispatch in `brik64/brik64-docs-site`. The receiving docs repository
+should update `releases/changelog.mdx`, rebuild Mintlify output, and deploy docs.
+
+The GitHub App installation token rollout announced in May 2026 means any app or
+automation that creates installation tokens must treat `ghs_` tokens as opaque
+and avoid fixed-length token assumptions. This repo's workflows do not parse
+GitHub App installation tokens.

package/docs/LINUX_HETZNER_TESTING.md

@@ -1,27 +1,31 @@
 # Linux Hetzner Testing
 
-Hetzner is the Linux test surface for the CLI beta.
+Hetzner is the Linux validation surface for BRIK64 CLI beta packaging.
 
-Scope:
-- Debian x64 native artifact execution.
-- Ubuntu x64 native artifact execution.
-- Fedora x64 native artifact execution.
-- Alpine x64 musl only with a separate musl artifact or explicit unsupported
+## Scope
+
+- Debian x64 package and install checks.
+- Ubuntu x64 package and install checks.
+- Fedora x64 package and install checks when that lane opens.
+- Alpine x64 musl only with a musl-specific artifact or an explicit scope
   decision.
 
-Required evidence per supported distro:
+## Required Evidence Per Distro
+
 - distro identity (`/etc/os-release`);
 - architecture (`uname -m`);
 - native binary path;
-- no wrapper evidence;
 - `brik --version` output;
 - BRIK64 ASCII startup output;
 - command-contract smoke;
 - PCD/certify/emit workflow smoke;
 - behavior PASS report.
 
-Boundary:
-- No universal Linux claim.
-- No public release authorization.
-- No N5, fixpoint or release-readiness claim from a distro smoke alone.
-- Windows remains waiting for a real PC/runner.
+## Promotion Path
+
+Each distro lane should publish its own artifact, checksum, install smoke, and
+release manifest before it is promoted through GitHub Releases, curl/GCP, docs,
+or brik64.com. Linux wording should name the validated distro lane instead of
+collapsing all Linux distributions into one status.
+
+Windows remains a separate validation lane with its own runner and install smoke.

package/docs/MACOS_LOCAL_TESTING.md

@@ -6,19 +6,22 @@ Current local platform:
 - OS: macOS / Darwin
 - Architecture: arm64
 
-Scope:
-- local CLI execution;
-- local install path checks;
-- local command-contract checks;
-- no public release authorization.
-
-Out of scope:
-- macOS x64 runner evidence;
-- Windows evidence;
-- universal macOS artifact claims;
-- fixpoint, N5 or release claims.
-
-Required evidence before marking macOS local ready:
+## Scope
+
+- Local CLI execution.
+- Local install path checks.
+- Local command-contract checks.
+- Apple Silicon package smoke for the current beta lane.
+
+## Evidence Still Needed For Broader Promotion
+
+- macOS Intel runner or host evidence.
+- Windows evidence.
+- Per-artifact checksum and release manifest binding.
+- Release authorization from the active BRIK64 evidence process.
+
+## Required Evidence Before Marking macOS Local Ready
+
 - local binary path;
 - `brik --version` output;
 - BRIK64 ASCII startup output;

package/docs/PLATFORM_MATRIX.md

@@ -2,11 +2,16 @@
 
 | Platform | Status | Required Evidence |
 | --- | --- | --- |
-| macOS arm64 local | pending | local binary execution report |
-| Linux Debian x64 | pending | native binary, no wrapper, behavior PASS |
-| Linux Ubuntu x64 | pending | native binary, no wrapper, behavior PASS |
-| Linux Fedora x64 | pending | native binary, no wrapper, behavior PASS |
-| Linux Alpine x64 musl | pending | separate musl artifact or explicit unsupported decision |
-| Windows x64 | waiting | real PC/runner metadata and execution report |
+| macOS Apple Silicon | current beta lane | package smoke, checksum, release manifest |
+| macOS Intel | planned | Intel host or runner install smoke, checksum, release manifest |
+| Debian Linux x64 | planned | Debian package/install smoke, checksum, release manifest |
+| Ubuntu Linux x64 | planned | Ubuntu package/install smoke, checksum, release manifest |
+| Fedora Linux x64 | future lane | Fedora package/install smoke or explicit scope decision |
+| Alpine Linux x64 musl | future lane | musl-specific artifact or explicit scope decision |
+| Windows x64 | planned | Windows runner smoke, checksum, release manifest |
 
-Do not collapse these into "all Linux" or "all platforms" claims.
+## Public Wording Rule
+
+Describe each platform only at the evidence level it has reached. Linux package
+language should name the distro lane, and macOS language should distinguish
+Apple Silicon from Intel until both lanes have passed their own checks.

package/docs/RELEASE_COPY_MANUAL.md

@@ -8,11 +8,11 @@ and aligned with BRIK64 evidence boundaries.
 ## Authority
 
 - Product surface: BRIK64 CLI.
-- Current public beta: `0.1.0-beta.2`.
-- Public web surface: https://brik64.com/home-cli
+- Current public beta: `0.1.0-beta.3`.
+- Public web surface: https://brik64.com
 - Docs: https://docs.brik64.com/cli/install
 - Package: https://www.npmjs.com/package/@brik64/cli
-- Release: https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.2
+- Release: https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.3
 - Evidence authority: `brik64-prod` gates, manifests, checksums, and release
   reports.
 - Implementation surface: `brik64-cli` source, package metadata, tests, PCD seed
@@ -160,7 +160,7 @@ brik --version
 brik help
 ```
 
-Public web surface: https://brik64.com/home-cli
+Public web surface: https://brik64.com
 
 Docs: https://docs.brik64.com/cli/install
 

package/docs/REPOSITORY_MAP.md

@@ -0,0 +1,100 @@
+# BRIK64 CLI Repository Map
+
+This map describes the public files and folders in `brik64/brik64-cli`.
+It is intended for package reviewers, beta users, security reporters, and
+maintainers who need to understand what each path is for.
+
+## Root Files
+
+| Path | Description |
+| --- | --- |
+| `README.md` | Primary public entry point for BRIK64 CLI install instructions, beta scope, official channels, repository map, release assets, and license summary. |
+| `package.json` | npm package manifest for `@brik64/cli`, including package version, description, binary mapping, scripts, keywords, publish config, and package file allowlist. |
+| `LICENSE` | Proprietary beta license for BRIK64 CLI. The package is public for evaluation and inspection, not open source redistribution. |
+| `NOTICE` | Copyright notice and third-party notice surface for the public beta package. |
+| `SECURITY.md` | Security reporting policy, supported beta version scope, and private reporting route. |
+| `CONTRIBUTING.md` | Public interaction policy. Issues are accepted for reproducible beta bugs and metadata mismatches; external pull requests are not accepted. |
+| `.gitignore` | Local Git ignore rules for generated files, dependency directories, package outputs, logs, and temporary artifacts. |
+| `.npmignore` | npm packaging exclusions for repository-only files that should not ship in the published package. |
+
+## Executable CLI
+
+| Path | Description |
+| --- | --- |
+| `src/` | Executable CLI source directory for the current beta. |
+| `src/brik.js` | Node.js command entry point exposed as `brik` by npm. It implements the current public beta command behavior. |
+
+## Tests
+
+| Path | Description |
+| --- | --- |
+| `tests/` | Local test directory for current beta smoke checks. |
+| `tests/smoke.sh` | Shell smoke test covering basic CLI execution, help/version output, project initialization behavior, `AGENTS.md` non-mutation policy, certify/emit behavior, target generation, and fail-closed unsupported targets. |
+
+## PCD Seed Material
+
+| Path | Description |
+| --- | --- |
+| `pcd/` | Candidate PCD seed material for moving CLI behavior toward a PCD-first BRIK64 methodology. These files are review material, not release certificates. |
+| `pcd/README.md` | Folder-level explanation of current PCD seed role, promotion path, and authority boundary. |
+| `pcd/cli_core.pcd` | Candidate command contract seed for core CLI behavior. |
+| `pcd/cli_init_policy.pcd` | Candidate command contract seed for initialization and agent-file consent policy. |
+| `pcd/cli_certify_emit.pcd` | Candidate command contract seed for bounded certification-output behavior. |
+| `pcd/cli_polymer.pcd` | Candidate composition contract that binds the CLI command PCD seeds before a future compile route. |
+
+## Evidence And Packaging
+
+| Path | Description |
+| --- | --- |
+| `evidence/` | Public beta evidence area for package inspection and generated-review material. |
+| `evidence/pcd-seed/` | Generated PCD seed review material used to keep methodology work inspectable without presenting it as certification. |
+| `evidence/pcd-seed/README.md` | Explanation of how seed evidence should be read and what must happen before stronger release language is allowed. |
+| `packaging/` | Packaging notes and release-lane material for platform-specific package work. |
+| `packaging/macos-local/` | macOS local package review material for the current beta lane. |
+| `packaging/macos-local/README.md` | macOS local packaging scope, package review expectations, and promotion requirements. |
+
+## Documentation
+
+| Path | Description |
+| --- | --- |
+| `docs/REPOSITORY_MAP.md` | This file-by-file public repository map. |
+| `docs/BRIK_METHODOLOGY_TRANSITION.md` | Methodology transition plan for moving the CLI from executable beta source toward PCD-first implementation and evidence-backed promotion. |
+| `docs/DISTRIBUTION_ROADMAP.md` | Distribution roadmap for npm, GitHub Releases, GitHub Packages, curl/GCP, Homebrew, macOS Intel, Linux, and Windows lanes. |
+| `docs/GITHUB_NPM_PUBLISHING.md` | npm publishing workflow notes for the public beta package. |
+| `docs/GITHUB_PACKAGES_PUBLISHING.md` | GitHub Packages mirror workflow notes and verification boundary. |
+| `docs/GITHUB_REPO_GOVERNANCE.md` | Repository governance policy for branch protection, maintainer ownership, issue flow, package publication, and public interaction controls. |
+| `docs/LINUX_HETZNER_TESTING.md` | Linux test plan and operator guidance for Debian/Ubuntu lanes using remote execution infrastructure. |
+| `docs/MACOS_LOCAL_TESTING.md` | macOS local test plan and operator guidance for current Apple Silicon package validation. |
+| `docs/PLATFORM_MATRIX.md` | Platform support matrix for current beta support and planned release lanes. |
+| `docs/RELEASE_COPY_MANUAL.md` | Standardized release-copy guide for npm, GitHub Releases, package descriptions, changelog entries, and public keywords. |
+| `docs/REPO_BOUNDARY.md` | Public repository boundary: what this repo owns, what `brik64-prod` owns, and what must not be claimed from this repo alone. |
+| `docs/WIKI_HOME.md` | Versioned wiki-home content while GitHub Wiki remote access remains under operational review. |
+
+## GitHub Governance
+
+| Path | Description |
+| --- | --- |
+| `.github/CODEOWNERS` | Maintainer ownership rules for protected files and review-required changes. |
+| `.github/PULL_REQUEST_TEMPLATE.md` | Internal maintainer checklist for protected changes, claim-safety review, package impact, and evidence updates. |
+| `.github/dependabot.yml` | Dependabot grouping and review configuration for GitHub Actions and npm ecosystem updates. |
+| `.github/ISSUE_TEMPLATE/` | Public issue templates for beta bugs, docs/package metadata mismatches, and security-report routing. |
+| `.github/workflows/ci.yml` | Main CI workflow for smoke tests and package-content checks. |
+| `.github/workflows/codeql.yml` | CodeQL workflow configuration where custom analysis is needed. |
+| `.github/workflows/publish-npm-beta.yml` | Manual npm beta publication workflow for authorized maintainers. |
+| `.github/workflows/publish-github-packages-beta.yml` | Manual GitHub Packages beta mirror workflow for authorized maintainers. |
+
+## BRIK64 Traceability
+
+| Path | Description |
+| --- | --- |
+| `.brik/` | BRIK64 local project metadata directory. |
+| `.brik/manifest.json` | Local traceability manifest for the CLI repo. It is operational metadata and is not a formal certificate. |
+
+## Authority Boundary
+
+This repository owns the public CLI package surface, local beta source, package
+metadata, package smoke checks, public repo governance, and beta documentation.
+
+`brik64-prod` remains the authority for release gates, certificate boundaries,
+compiler evidence, promotion decisions, and any stronger public claim
+authorization.

package/docs/REPO_BOUNDARY.md

@@ -2,29 +2,28 @@
 
 ## Lives Here
 
-- CLI source code.
-- CLI tests and fixtures.
-- Platform packaging scripts.
-- Local beta artifacts.
-- Per-version changelogs.
+- Public beta CLI source code.
+- CLI smoke tests and fixtures.
+- Platform packaging scripts and wrappers.
+- Local beta artifacts and package metadata.
+- Per-version release notes, runbooks, and distribution docs.
 
-## Does Not Live Here
+## Authority Boundary
 
-- Private engines.
-- Claim-bearing certification authority.
-- Public release authorization.
-- N-level claims.
-- Prod evidence source of truth.
+- `brik64-cli` owns implementation, public package metadata, distribution
+  workflows, issue templates, and release-surface documentation for the CLI beta.
+- `brik64-prod` owns methodology gates, evidence authority, release decision,
+  compiler evidence, certificate boundaries, and public claim authorization.
 
-## Authority Split
+## Public Surface Rule
 
-- `brik64-cli`: implementation and packaging iteration.
-- `brik64-prod`: gates, evidence, methodology, release decision and claim
-  boundary.
+The public repository should help developers inspect, install, and report on the
+CLI beta without exposing private engines, internal gates, private evidence
+stores, raw credentials, or unsupported certification language.
 
 ## Platform Scope
 
 - macOS local testing can run on the current development machine.
 - Linux testing should run on the Hetzner runner and must be split by distro
-  family rather than claimed as universal Linux support.
+  family.
 - Windows testing remains pending until a real Windows PC/runner is available.

package/docs/WIKI_HOME.md

@@ -0,0 +1,50 @@
+# BRIK64 CLI Public Beta
+
+BRIK64 CLI is the public beta command-line surface for local BRIK64 project
+workflows, PCD-oriented structure, bounded evidence review, and claim-safe
+project scaffolding.
+
+## Official Links
+
+- Website: https://brik64.com
+- Docs: https://docs.brik64.com
+- npm: https://www.npmjs.com/package/@brik64/cli
+- GitHub release: https://github.com/brik64/brik64-cli/releases
+
+## Public Interaction
+
+This repository is public for inspection, installation, issue reporting, release
+review, and package transparency.
+
+Allowed:
+
+- Open issues for reproducible CLI beta bugs.
+- Open issues for docs, npm, release, checksum, or install metadata mismatches.
+- Report security concerns using the repository security policy.
+
+Not accepted:
+
+- External pull requests.
+- External direct commits.
+- Public edits to release evidence, license text, package metadata, or public
+  claim surfaces.
+
+BRIK64 lands changes through authorized maintainers.
+
+## Current Beta
+
+Current beta: `0.1.0-beta.3`
+
+Install:
+
+```sh
+npm install -g @brik64/cli@beta
+brik --version
+brik help
+```
+
+## Evidence Boundary
+
+`brik64-prod` remains the authority for methodology, release gates, evidence
+contracts, certification boundaries, compiler claim authorization, and release
+approval.

package/evidence/pcd-certificates/cli_certify_emit.pcd.cert.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "brik64.cli_local_candidate_certificate.v1",
-  "generatedAt": "2026-06-03T05:06:50Z",
+  "generatedAt": "2026-06-03T20:12:17Z",
   "pcd": {
     "path": "pcd/cli_certify_emit.pcd",
     "sha256": "1d73245ebee8592a4eeacdb4b99398baf7c5ddfa3c88c5927f924a871eee7147"

package/evidence/pcd-certificates/cli_core.pcd.cert.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": "brik64.cli_local_candidate_certificate.v1",
-  "generatedAt": "2026-06-03T05:06:50Z",
+  "generatedAt": "2026-06-03T20:12:17Z",
   "pcd": {
     "path": "pcd/cli_core.pcd",
-    "sha256": "c1d3167109d842c5b321ed541604bdcff2c7be7865b2aac8116f1db03b557944"
+    "sha256": "a2337d9d359061d5c655320ad5fb64c2acbea0ed077840bc61c049dbf387419e"
   },
   "certificate": {
     "kind": "local_candidate_certificate",

package/evidence/pcd-certificates/cli_init_policy.pcd.cert.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "brik64.cli_local_candidate_certificate.v1",
-  "generatedAt": "2026-06-03T05:06:50Z",
+  "generatedAt": "2026-06-03T20:12:17Z",
   "pcd": {
     "path": "pcd/cli_init_policy.pcd",
     "sha256": "fae8cf2f18ba00b337236a46ee7d212b1437c7b4eae812ca1e3506651ffdb31d"

package/evidence/pcd-certificates/cli_polymer.pcd.cert.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": "brik64.cli_local_candidate_certificate.v1",
-  "generatedAt": "2026-06-03T05:06:50Z",
+  "generatedAt": "2026-06-03T20:12:17Z",
   "pcd": {
     "path": "pcd/cli_polymer.pcd",
-    "sha256": "776bbd5a15357bf47350a81011f1d12bdf4a04fb843cd035c39f9b3985cb9196"
+    "sha256": "db285a12918a9fe4d50f80054e66d240d71d4ff0dd3031e495201a7dee936f71"
   },
   "certificate": {
     "kind": "local_candidate_certificate",

package/evidence/pcd-seed/README.md

@@ -1,7 +1,18 @@
-# PCD Seed Evidence Boundary
+# PCD Seed Evidence
 
-This directory is reserved for future reports generated from the candidate PCD
-source in `pcd/`.
+This directory is reserved for reports generated from the candidate PCD source
+in `pcd/`.
 
-No report in this directory currently authorizes a public beta, fixpoint claim,
-N5 claim, formal certification claim, or Rust-independence claim.
+## Current Role
+
+- Holds future evidence generated from PCD seed review.
+- Keeps PCD methodology evidence separate from executable CLI source.
+- Provides a stable location for future gate outputs, manifests, and review
+  notes tied to the PCD seed material.
+
+## Evidence Boundary
+
+Public beta install and package metadata are supported by the release artifacts
+and workflows documented in this repository. Stronger compiler, fixpoint,
+platform, or certification language belongs to fresh evidence from the relevant
+BRIK64 gates before it is promoted publicly.

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@brik64/cli",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "private": false,
   "description": "BRIK64 CLI public beta for local PCD workflows, bounded evidence review, and claim-safe project scaffolding.",
-  "homepage": "https://brik64.com/home-cli",
+  "homepage": "https://brik64.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/brik64/brik64-cli.git"
@@ -49,6 +49,8 @@
     "README.md",
     "LICENSE",
     "NOTICE",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
     ".brik/manifest.json"
   ]
 }

package/packaging/macos-local/README.md

@@ -1,15 +1,22 @@
 # macOS Local Bootstrap Wrapper
 
-This directory contains a local macOS bootstrap wrapper for testing:
+This directory contains the local macOS wrapper used to exercise the public beta
+CLI during package and command smoke testing.
 
 ```bash
 export PATH="/Users/carlosjperez/Documents/GitHub/brik64-cli/packaging/macos-local:$PATH"
 brik --version
 ```
 
-Boundary:
-- bootstrap wrapper only;
-- depends on local Node.js;
-- not a native final artifact;
-- not public release evidence;
-- not post-beta `.brik`/PCD semantic source.
+## Current Role
+
+- Provides a local `brik` command wrapper for macOS testing.
+- Depends on the local Node.js runtime.
+- Supports install-path and command-contract checks before platform packages are
+  promoted.
+
+## Promotion Path
+
+Native macOS release assets should ship with platform-specific checksum,
+install-smoke, and release-manifest evidence before they are promoted through
+GitHub Releases, curl/GCP, Homebrew, docs, or brik64.com.

package/pcd/README.md

@@ -1,24 +1,29 @@
-# BRIK CLI PCD Seed
+# BRIK64 CLI PCD Seeds
 
-This directory contains candidate semantic PCD seeds for the local `brik` CLI.
-They are not release artifacts and do not certify formal correctness, N5 status,
-fixpoint, or Rust independence.
+This directory contains the public beta PCD seed material for the local `brik`
+CLI. These files describe the intended command structure and composition path
+used to move the CLI toward a PCD-first BRIK64 methodology.
 
-Current status:
+## Current Role
 
-- Source of truth for executable behavior remains `src/brik.js`.
-- These PCD files define the transition contract for moving CLI iteration to a
-  PCD-first BRIK64 methodology.
-- `cli_polymer.pcd` is the candidate composition contract that binds the CLI
-  command PCD seeds before any future compile route.
-- Any future public beta claim must be backed by fresh compiler, certificate,
-  platform execution, and release-boundary reports.
+- `src/brik.js` remains the executable CLI source for the current beta.
+- `cli_core.pcd`, `cli_init_policy.pcd`, and `cli_certify_emit.pcd` describe
+  candidate command contracts.
+- `cli_polymer.pcd` describes the candidate composition contract that binds the
+  command PCD seeds before a future compile route.
+- The files in this directory are review material for beta methodology, package
+  inspection, and future compiler-aligned work.
 
-Required next methodology step:
+## Promotion Path
 
-1. Complete candidate PCD coverage for all CLI behavior.
-2. Certify candidate PCDs with the active private gate stack.
-3. Validate the polymer/composition PCD against the certified command PCDs.
+Before these seeds can support stronger public release language, BRIK64 must:
+
+1. Complete candidate PCD coverage for CLI behavior.
+2. Certify candidate PCDs with the active gate stack.
+3. Validate the polymer/composition PCD against command PCDs.
 4. Compile the CLI through the BRIK compiler path.
-5. Run macOS, Linux distro, and Windows execution reports.
-6. Promote only if the release claim boundary gate passes.
+5. Run platform execution reports for macOS, Linux distro lanes, and Windows.
+6. Publish release-boundary evidence from `brik64-prod`.
+
+`brik64-prod` remains the authority for release gates, certificate boundaries,
+compiler evidence, and public claim authorization.

package/pcd/cli_core.pcd

@@ -5,9 +5,9 @@
 // certifiesTests: false
 // certifiesFixpoint: false
 // product = "brik64-cli"
-// cli_version = "0.1.0-beta.0"
+// cli_version = "0.1.0-beta.3"
 // public_binary = "brik"
-// execution_status = "bootstrap_non_release"
+// execution_status = "public_beta"
 // ascii_banner = "BRIK64"
 // claim_boundary = "local_candidate_only"
 

package/pcd/cli_polymer.pcd

@@ -5,7 +5,7 @@
 // certifiesTests: false
 // certifiesFixpoint: false
 // product = "brik64-cli"
-// cli_version = "0.1.0-beta.0"
+// cli_version = "0.1.0-beta.3"
 // composition_kind = "polymer"
 // source_units = "cli_core.pcd,cli_init_policy.pcd,cli_certify_emit.pcd"
 // compile_status = "not_compiled"

package/src/brik.js

@@ -8,7 +8,7 @@ process.stdout.on('error', (error) => {
   throw error;
 });
 
-const version = '0.1.0-beta.0';
+const version = '0.1.0-beta.3';
 const ascii = [
   ' ____  ____  ___ _  __ __   _  _ ',
   '| __ )|  _ \\|_ _| |/ // /_ | || |',
@@ -24,7 +24,7 @@ function sha256(value) {
 function printBanner() {
   process.stdout.write(`${ascii}\n`);
   process.stdout.write(`BRIK64 CLI ${version}\n`);
-  process.stdout.write('status=bootstrap_non_release\n');
+  process.stdout.write('status=public_beta\n');
 }
 
 function help() {
@@ -35,6 +35,10 @@ function help() {
   process.stdout.write('  emit <file.pcd>      emit only when local certificate exists\n');
   process.stdout.write('       --target <ts|rust|python> --out <dir> --tests\n');
   process.stdout.write('  --version            print version\n');
+  process.stdout.write('\nreferences:\n');
+  process.stdout.write('  docs                 https://docs.brik64.com/cli/install\n');
+  process.stdout.write('  skill                https://github.com/brik64/brik64-tools-skills\n');
+  process.stdout.write('  pcd standard         https://github.com/brik64/pcd-standard\n');
 }
 
 function readFileRequired(file) {