stage the static public rebuild dossier

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.py]
+indent_size = 4

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @deucebucket

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels:
+      - dependencies

.github/workflows/pages.yml

@@ -0,0 +1,57 @@
+name: Validate and deploy public dossier
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the exact revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Run publication-boundary regressions
+        env:
+          PYTHONDONTWRITEBYTECODE: "1"
+        run: python3 -m unittest discover -s tests -p "test_*.py" -v
+      - name: Validate links, inventory, history, and publication boundary
+        env:
+          PYTHONDONTWRITEBYTECODE: "1"
+        run: python3 scripts/check_site.py
+
+  deploy:
+    if: github.event_name != 'pull_request'
+    needs: validate
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the exact revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - name: Upload the static dossier
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

CONTRIBUTING.md

@@ -0,0 +1,14 @@
+# Contributing
+
+This is a curated public dossier, not a mirror of the development repository.
+
+1. Start from an already sanitized, public-safe milestone.
+2. Rewrite it for readers; do not copy private notes or evidence packets.
+3. Preserve the proof vocabulary: matched, verified, and snapshot-verified are
+   different claims.
+4. Keep game-derived media and live payloads out of Git.
+5. Run `python3 scripts/check_site.py`.
+6. Open a pull request for review.
+
+Numbers on the dossier are dated snapshots. Do not silently turn them into a
+live feed.

README.md

@@ -8,5 +8,23 @@ outside this public projection. This repository must remain safe to clone and
 publish in full: no game assets, ROM data, keys, raw evidence, private wiki
 copies, credentials, or live telemetry.
 
-The themed dossier is being prepared on a review branch before any Pages
-deployment.
+## Public surfaces
+
+- Default dossier URL after merge: <https://bucketcomps.github.io/infamous/>
+- Eventual dossier URL: `https://decomp.deucebucket.com/infamous/`
+- Proposed local-live URL: `https://live.decomp.deucebucket.com/infamous`
+
+The custom domain and proposed live hostname are deliberately **not cut over**.
+The live link is labeled as a hold everywhere it appears.
+
+## Work locally
+
+```sh
+python3 scripts/check_site.py
+python3 -m http.server 8080 --directory site
+```
+
+Then open <http://127.0.0.1:8080/>.
+
+Pull requests validate but do not deploy. A merge to `main` deploys only the
+`site/` artifact through GitHub Pages.

docs/ARCHITECTURE.md

@@ -0,0 +1,29 @@
+# Dossier architecture
+
+`site/` is a hand-curated static artifact. It has no build-time connection to
+private source, evidence stores, game data, or live telemetry.
+
+## Content map
+
+- `/infamous/` — current public snapshot and two-track overview
+- `/infamous/devlog/` — dated, public-safe milestone notes
+- `/infamous/method/` — proof vocabulary and clean-room boundaries
+- `/infamous/roadmap/` — gate-by-gate route to playable gameplay
+- `/infamous/data/status.json` — the same small dated snapshot in machine-readable form
+
+The JSON file is static and reviewed. It is not a runtime payload.
+
+## Hosting
+
+This repository is a GitHub Pages **project site**, so its default URL is
+`https://bucketcomps.github.io/infamous/`. GitHub documents that a custom domain
+assigned to the organization site is inherited by public project sites by
+default; after a separately approved cutover, the intended URL is
+`https://decomp.deucebucket.com/infamous/`.
+
+The dynamic stream/dashboard remains a separate locally hosted system. This
+site only contains a clearly held link to the proposed
+`https://live.decomp.deucebucket.com/infamous` endpoint.
+
+Official reference:
+[About custom domains and GitHub Pages](https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/about-custom-domains-and-github-pages).

docs/PUBLISHING.md

@@ -0,0 +1,17 @@
+# Publishing
+
+The custom GitHub Pages workflow:
+
+1. validates every relevant pull request and push;
+2. uploads only `site/`;
+3. grants deployment permissions only to the deploy job;
+4. skips deployment on pull requests; and
+5. pins every action to a full commit SHA.
+
+There is intentionally no `CNAME` file. Custom-domain work belongs to the
+organization Pages cutover and is not part of this dossier PR.
+
+Official references:
+
+- [Configuring a Pages publishing source](https://docs.github.com/en/pages/getting-started-with-github-pages/configuring-a-publishing-source-for-your-github-pages-site)
+- [Using custom Pages workflows](https://docs.github.com/en/pages/getting-started-with-github-pages/using-custom-workflows-with-github-pages)

docs/SANITIZED-SNAPSHOT.md

@@ -0,0 +1,22 @@
+# Sanitized source snapshot
+
+The initial dossier copy was written from the already published, fail-closed
+public release—not from private project documentation.
+
+Audit record:
+
+- Public release: `20260723-ee63eaa984f6aee96265`
+- Public manifest SHA-256:
+  `ccbbdacae803bea9be244d096994602078d62c7a78040d2ad2977c6e7629f22f`
+- Manifest-enumerated payloads: 55
+- Complete release tree: 56 files, including the release manifest
+- Snapshot date: 2026-07-23
+
+Only small text facts needed by the static dossier were selected. No image,
+video, audio, manifest media entry, live support payload, or raw telemetry file
+was copied into this repository.
+
+The dossier intentionally retains honest zeros: 4 of 13 renderer checklist
+steps, 0 draws, 0 flips, 0 captures, and 0 verified frames. Save/load is shown
+as 4 of 34 subsystem checks represented; it is not presented as an end-to-end
+gameplay save/load proof.

docs/SECURITY-BOUNDARY.md

@@ -0,0 +1,21 @@
+# Public dossier boundary 🔒
+
+## Allowed
+
+- Public-safe prose derived from an already sanitized release
+- Dated headline numbers with explicit denominators and proof labels
+- Hand-authored HTML and CSS
+- Public repository and documentation links
+- Generic interface marks made from text and CSS
+
+## Forbidden
+
+- Game-derived screenshots, models, textures, video, audio, executables, or data
+- ROMs, keys, firmware, SDK material, or decrypted content
+- Private wiki/source copies, raw notes, evidence packets, or internal paths
+- Credentials, infrastructure coordinates, process metadata, or personal data
+- Live telemetry, runtime payloads, automatically copied dashboards, or symlinks
+
+The workflow uploads only `site/`. A negative-exposure test rejects media-like
+files, secret-like strings, internal markers, unpinned actions, broken links,
+symlinks, and accidental custom-domain files.