Improve onboarding and security guidance

README.md

@@ -4,12 +4,30 @@
 
 [![WPF CI status](https://github.com/keida/codex-quota-float/actions/workflows/wpf-ci.yml/badge.svg?branch=main)](https://github.com/keida/codex-quota-float/actions/workflows/wpf-ci.yml)
 
+Quote Float is a native Windows WPF widget that keeps Codex Plus/Pro quota status visible in compact Full or Orb views.
+
 ![Quote Float WPF R1 actual WPF client-area renders](docs/assets/quote-float-overview-en.png)
 
 _Figure: actual WPF client-area renders with illustrative sample quota values; native DWM border/corners are not captured._
 
 The WPF R1 simplification is frozen and released. Its status is **Boss PASS, v1.1.0 RELEASED / LATEST**: the release is a Windows x64 framework-dependent package and requires the `.NET 8 Desktop Runtime`.
 
+## Quick start
+
+1. On Windows x64, install the official [.NET 8 Desktop Runtime](https://dotnet.microsoft.com/en-us/download/dotnet/8.0/runtime).
+2. Download the [v1.1.0 Windows x64 ZIP](https://github.com/keida/codex-quota-float/releases/download/v1.1.0/QuoteFloat-WPF-R1-v1.1.0-win-x64.zip) and [SHA256SUMS.txt](https://github.com/keida/codex-quota-float/releases/download/v1.1.0/SHA256SUMS.txt).
+3. Extract the ZIP.
+4. Run `QuotaFloat.Wpf.exe`.
+5. Optional: from the folder containing the downloaded ZIP and `SHA256SUMS.txt`, verify the ZIP with PowerShell:
+
+   ```powershell
+   $line = Get-Content .\SHA256SUMS.txt | Where-Object { $_ -match 'QuoteFloat-WPF-R1-v1.1.0-win-x64\.zip$' }
+   $expected = ($line -split '\s+')[0]
+   $actual = (Get-FileHash .\QuoteFloat-WPF-R1-v1.1.0-win-x64.zip -Algorithm SHA256).Hash
+   if ($actual -ne $expected) { throw 'Checksum mismatch' }
+   "SHA-256 OK: $actual"
+   ```
+
 ## Current product contract
 
 - Native WPF Civic Wayfinding widget for Plus and Pro plans.
@@ -20,7 +38,7 @@ The WPF R1 simplification is frozen and released. Its status is **Boss PASS, v1.
 
 ## Running and development
 
-The WPF project is [`wpf/QuotaFloat.Wpf.csproj`](wpf/QuotaFloat.Wpf.csproj). Development guidance is in [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md). Current source, hashes, deletions, and evidence boundaries are recorded in [`docs/wpf-r1/CANDIDATE-MANIFEST.json`](docs/wpf-r1/CANDIDATE-MANIFEST.json).
+The WPF project is [`wpf/QuotaFloat.Wpf.csproj`](wpf/QuotaFloat.Wpf.csproj). Development guidance is in [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md), and security reporting guidance is in [`SECURITY.md`](SECURITY.md). Current source, hashes, deletions, and evidence boundaries are recorded in [`docs/wpf-r1/CANDIDATE-MANIFEST.json`](docs/wpf-r1/CANDIDATE-MANIFEST.json).
 
 Real quota mode reads local Codex authentication and calls the ChatGPT usage/reset-credit services. Never publish authentication files, tokens, raw responses, account screenshots, or private diagnostics. `--direct` starts independently; `--watch` observes Codex presence. The application does not terminate Codex.
 

README.zh-CN.md

@@ -4,12 +4,30 @@
 
 [![WPF CI 状态](https://github.com/keida/codex-quota-float/actions/workflows/wpf-ci.yml/badge.svg?branch=main)](https://github.com/keida/codex-quota-float/actions/workflows/wpf-ci.yml)
 
+Quote Float 是一个原生 Windows WPF 浮窗，让 Codex Plus/Pro 的额度状态以紧凑的 Full 或 Orb 视图保持可见。
+
 ![Quote Float WPF R1 实际 WPF 客户区渲染](docs/assets/quote-float-overview-zh.png)
 
 _图示：实际 WPF 客户区渲染，额度数值为示例；未捕获原生 DWM 边框/圆角。_
 
 Quote Float 的 WPF R1 简化版本已完成冻结并发布。当前状态是 **Boss PASS、v1.1.0 RELEASED / LATEST**：版本发布到 Windows x64 framework-dependent 包，并要求 `.NET 8 Desktop Runtime`。
 
+## 快速开始
+
+1. 在 Windows x64 上安装官方 [.NET 8 Desktop Runtime](https://dotnet.microsoft.com/en-us/download/dotnet/8.0/runtime)。
+2. 下载 [v1.1.0 Windows x64 ZIP](https://github.com/keida/codex-quota-float/releases/download/v1.1.0/QuoteFloat-WPF-R1-v1.1.0-win-x64.zip) 和 [SHA256SUMS.txt](https://github.com/keida/codex-quota-float/releases/download/v1.1.0/SHA256SUMS.txt)。
+3. 解压 ZIP。
+4. 运行 `QuotaFloat.Wpf.exe`。
+5. 可选：在下载的 ZIP 与 `SHA256SUMS.txt` 所在目录中，用 PowerShell 校验 ZIP：
+
+   ```powershell
+   $line = Get-Content .\SHA256SUMS.txt | Where-Object { $_ -match 'QuoteFloat-WPF-R1-v1.1.0-win-x64\.zip$' }
+   $expected = ($line -split '\s+')[0]
+   $actual = (Get-FileHash .\QuoteFloat-WPF-R1-v1.1.0-win-x64.zip -Algorithm SHA256).Hash
+   if ($actual -ne $expected) { throw 'Checksum mismatch' }
+   "SHA-256 OK: $actual"
+   ```
+
 ## 当前产品契约
 
 - 原生 WPF Civic Wayfinding 浮窗，支持 Plus 与 Pro。
@@ -20,7 +38,7 @@ Quote Float 的 WPF R1 简化版本已完成冻结并发布。当前状态是 **
 
 ## 运行与开发
 
-WPF 工程位于 [`wpf/QuotaFloat.Wpf.csproj`](wpf/QuotaFloat.Wpf.csproj)。开发说明见 [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md)。当前源码、哈希、删除项和证据边界见 [`docs/wpf-r1/CANDIDATE-MANIFEST.json`](docs/wpf-r1/CANDIDATE-MANIFEST.json)。
+WPF 工程位于 [`wpf/QuotaFloat.Wpf.csproj`](wpf/QuotaFloat.Wpf.csproj)。开发说明见 [`docs/DEVELOPMENT.md`](docs/DEVELOPMENT.md)，安全报告说明见 [`SECURITY.md`](SECURITY.md)。当前源码、哈希、删除项和证据边界见 [`docs/wpf-r1/CANDIDATE-MANIFEST.json`](docs/wpf-r1/CANDIDATE-MANIFEST.json)。
 
 真实额度模式读取本地 Codex 认证并访问 ChatGPT usage/reset-credit 服务；不要发布认证文件、token、原始响应、账户截图或私人诊断。`--direct` 用于独立启动，`--watch` 用于观察 Codex 存在状态；应用不会终止 Codex。
 

SECURITY.md

@@ -0,0 +1,27 @@
+# Security / 安全
+
+## Supported versions / 支持版本
+
+| Version line | Support |
+| --- | --- |
+| `v1.1.x` | Current supported line / 当前支持版本线 |
+| Historical `v1.0.0` | Not supported / 不提供支持 |
+
+## Reporting a concern / 报告安全问题
+
+Private vulnerability reporting is not currently enabled for this repository. Do not put tokens, cookies, `auth.json`, account payloads, raw API responses, account screenshots, or machine-local diagnostics in a public issue.
+
+If you find a possible security issue, open a minimal public issue without sensitive details to request a private contact path, or contact the maintainer through the [GitHub profile](https://github.com/keida). Do not include credentials, private account data, or a sensitive proof of concept. We will review the report and provide next steps when a private contact path is available; no fixed response-time SLA is promised.
+
+如果你发现潜在安全问题，请创建不含敏感信息的最小公开 issue，以请求私下沟通渠道，或通过维护者的 [GitHub 个人主页](https://github.com/keida) 联系。不要在公开 issue 中提交 token、cookie、`auth.json`、账户数据、原始响应、账户截图或机器本地诊断信息。仓库目前未启用 GitHub 的私密漏洞报告入口，也不承诺固定响应时限。
+
+## Data boundary at v1.1.0 / v1.1.0 数据边界
+
+The current WPF source reads local Codex `auth.json` from `CODEX_HOME` or the user's `.codex` directory, then sends bearer authentication only to these documented ChatGPT endpoints:
+
+- `https://chatgpt.com/backend-api/wham/usage`
+- `https://chatgpt.com/backend-api/wham/rate-limit-reset-credits`
+
+User preferences are stored locally at `%LOCALAPPDATA%\QuotaFloat\preferences.json`. The v1.1.0 WPF source does not define a telemetry or analytics endpoint; this is a statement about the current source, not a promise about future versions.
+
+当前 WPF 源码从 `CODEX_HOME` 或用户 `.codex` 目录读取本地 Codex `auth.json`，并且只向上述已记录的 ChatGPT endpoint 发送 bearer 身份验证。用户偏好保存在 `%LOCALAPPDATA%\QuotaFloat\preferences.json`。v1.1.0 WPF 源码没有定义 telemetry 或 analytics endpoint；这只是当前源码事实，不代表对未来版本的承诺。

docs/DEVELOPMENT.md

@@ -2,14 +2,14 @@
 
 ## Scope
 
-The active R1 implementation is the WPF project under [`wpf/`](../wpf/). The native WinForms tree is a pre-existing dirty area and is not part of the WPF R1 publication set. The Tauri experiment is also outside R1 publication.
+The active R1 implementation is the WPF project under [`wpf/`](../wpf/). The `native/` tree is a historical WinForms reference and is not part of the current WPF product or publication scope. The Tauri experiment is also outside R1 scope.
 
 The accepted WPF state owner is `WidgetWindowController`; visual changes are applied through its unified `ApplyState()` transaction. `MainWindow` owns presentation, while the application coordinator owns single-instance activation and lifecycle coordination.
 
 ## Product rules
 
 - Settings is non-modal, single-instance, and `420 × 296 DIP` at the verified 96 DPI baseline.
-- Settings exposes language and refresh interval only, plus read-only sync/freshness status, Refresh, and Done.
+- Settings exposes language and refresh interval only. Done closes the window; saved-state and auto-refresh text is explanatory. Settings has no sync/freshness control and no Refresh button; the sole manual Refresh action is in the Full footer.
 - Billing/Usage navigation, Product Scale, Auto Refresh, Click-through, themes, and behavior selectors are removed from the R1 surface.
 - Full/Orb geometry, edge/work-area anchoring, DWM corners, topmost ownership, tray recovery, and single-instance activation are separate acceptance concerns.
 - Refreshing retains accepted quota; Loading is used only when no prior accepted quota exists.
@@ -22,10 +22,21 @@ The focused test evidence is `31 fixtures; 58 checks; activeRequests=1; refreshC
 
 Do not use real authentication or terminate user processes for deterministic tests. Do not record tokens, response bodies, cookies, account data, machine identifiers, PID/HWND values, or absolute personal paths in public artifacts.
 
+## Build and test
+
+Run these commands from the repository root with the .NET 8 SDK and Windows desktop targeting support installed:
+
+```powershell
+dotnet restore wpf/tests/QuotaFloat.Wpf.Tests.csproj
+dotnet build wpf/QuotaFloat.Wpf.csproj --configuration Release --no-restore --nologo
+dotnet build wpf/tests/QuotaFloat.Wpf.Tests.csproj --configuration Release --no-restore --nologo
+dotnet run --project wpf/tests/QuotaFloat.Wpf.Tests.csproj --configuration Release --no-restore --no-build
+```
+
 ## Explicit R1 limitations
 
 1. Same real Pro account `Fresh -> SignedOut -> Fresh`: `NOT VERIFIED / OUT OF R1 ACCEPTANCE SCOPE`.
 2. Isolated Codex close/absence/response/restart recovery: `NOT VERIFIED / OUT OF R1 ACCEPTANCE SCOPE`.
 3. Native Windows 125% / 150% DPI runtime acceptance: `NOT VERIFIED / OUT OF R1 ACCEPTANCE SCOPE`.
 
-Publication remains HOLD. Use the exact staging set in [`PUBLICATION-ALLOWLIST-V3.md`](wpf-r1/PUBLICATION-ALLOWLIST-V3.md); never stage native dirty files, output evidence, binaries, credentials, or local machine artifacts.
+Version 1.1.0 is published and is the latest release. For future publication, use the exact staging boundaries in [`PUBLICATION-ALLOWLIST-V3.md`](wpf-r1/PUBLICATION-ALLOWLIST-V3.md) and exclude credentials, machine-local state, generated output, release binaries, and unrelated historical or native changes from source commits.