This repository is a clean-room synthetic reference platform. Do not place credentials, private endpoints, internal infrastructure details, device calibration captures, or other confidential material in issues, pull requests, commits, or release assets.

If a secret may have been committed, revoke or rotate it first, then report the location privately through GitHub's security reporting flow. Include the repository, affected ref, commit, and file path, but never paste the secret value into the report.

The repository uses a fail-closed publication scanner in local hooks and CI, plus GitHub secret-scanning controls where the account plan supports them. These controls reduce accidental disclosure; they do not replace human provenance review or deployment-specific security controls.

The durable agent and contributor rule is recorded in the repository root AGENTS.md: any candidate upload whose sensitivity or publication authority is unclear must pause for explicit confirmation. Approval never makes a raw credential safe to commit.