The separate J3vb/OwnCord-releases repo existed only because this repo was
private: it carried the AGPL source snapshot and provided a publicly-readable
update feed. Once this repo is public both roles collapse into its own Releases
page, so the mirror is pure redundancy.
- Server/config/config.go: github.repo default OwnCord-releases -> OwnCord.
This one default drives both the server self-update and the client
auto-update chain (tauri.conf.json updater.endpoints is empty, so the client
resolves through the server). No test pinned the old value.
- release.yml: drop the mirror step and its RELEASES_REPO_TOKEN guard, whose
AGPL/private-repo premise no longer holds. The existing Create GitHub Release
step is now the sole publish target. All 31 SHA pins verified intact.
- Repoint the README badge/download link, both SECURITY.md links, the
server-configuration table and sample, the system-overview diagram node and
the CHANGELOG note. SECURITY.md's advisory link is the load-bearing one: left
alone it would 404 once the mirror repo is deleted.
- README: Go 1.25+ -> 1.26+ (badge and prerequisite) to match the toolchain
actually required.
Deleting the mirror repo loses nothing: both repos' v1.1.0-alpha.2 carry
byte-identical asset sets, signatures and update manifest included.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- gitignore .serena/ and Client/tauri-client/.env; untrack the .env
(the KLIPY key it held is treated as burned; rotation + server-side
proxy tracked for P3)
- CI: verify generated sqlc output (make sqlc-verify) on the ubuntu leg
- CHANGELOG: honest reset narrative (v1.1.0-alpha series), remove
references to deleted roadmap files
- delete stale docs/phase-a-status.md; fix dangling ref in
docs/plans/slash-commands.md
- add root SECURITY.md (GitHub-surfaced policy; reporting works while
the source repo is private)
- docs/audit-2026-04-07.md: add maintained finding-closure table
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
