diff --git a/.agileplus/specs/001-core-setup/meta.json b/.agileplus/specs/001-core-setup/meta.json
new file mode 100644
index 00000000..ab9037dc
--- /dev/null
+++ b/.agileplus/specs/001-core-setup/meta.json
@@ -0,0 +1,9 @@
+{
+  "feature_id": "001-core-setup",
+  "created": "2026-08-19",
+  "status": "active",
+  "priority": "P1",
+  "repo": "SessionLedger",
+  "language": "Rust",
+  "owner": "KooshaPari"
+}
diff --git a/.agileplus/specs/001-core-setup/spec.md b/.agileplus/specs/001-core-setup/spec.md
new file mode 100644
index 00000000..b73f2bb2
--- /dev/null
+++ b/.agileplus/specs/001-core-setup/spec.md
@@ -0,0 +1,24 @@
+# Feature Specification: SessionLedger - Core Setup & Compliance
+
+**Feature ID**: 001-core-setup
+**Created**: 2026-08-19
+**Status**: Active
+**Priority**: P1
+
+## Overview
+
+Core setup and compliance tracking for SessionLedger -- the session/event tracking daemon with Dioxus desktop viewer.
+
+## Compliance Goals
+
+- [x] PR Template - GitHub PR template with quality gates
+- [x] CODEOWNERS - Ownership file for code review routing
+- [x] Dependabot - Automated dependency updates
+- [x] Issue Template - Structured issue creation
+- [ ] Sentry Integration - Error tracking and monitoring
+- [ ] Product Analytics - User behavior instrumentation
+- [ ] Documentation - Complete API reference
+
+## Audit Trail
+
+- 2026-08-19: Created spec, migrated from legacy seed bootstrap
diff --git a/.agileplus/specs/001-core-setup/tasks.md b/.agileplus/specs/001-core-setup/tasks.md
new file mode 100644
index 00000000..77847d76
--- /dev/null
+++ b/.agileplus/specs/001-core-setup/tasks.md
@@ -0,0 +1,18 @@
+# Tasks: 001-core-setup (SessionLedger)
+
+## Completed
+- [x] Create PR template
+- [x] Add CODEOWNERS file
+- [x] Add dependabot.yml for Cargo + GitHub Actions
+- [x] Add issue templates
+- [x] Setup 15+ CI workflows (a11y, alloc-profile, bench-gate, branch-protection, ci, commit-signing, cross-platform-build, cross-platform-smoke, daemon-graph, envelope-crypto, eval-compression, feedback-budgets, fuzz-blocking, fuzz-cadence, hermetic-builder)
+- [x] Document FR catalog (15 FRs, all status: done)
+
+## In Progress
+- [ ] Migrate legacy agileplus/ seed to .agileplus/specs
+- [ ] Integrate Sentry SDK for Rust panic capture
+- [ ] Complete API reference documentation
+
+## Pending
+- [ ] Product analytics instrumentation
+- [ ] Publish scorecard to OpenSSF Badge API
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 00000000..48490e54
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,11 @@
+github: []
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift package-name e.g. npm/[email protected]
+community_bridge: # Replace with a single Community Bridge project slug-id
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project slug e.g. project-name
+custom: # Replace with up to 3 custom sponsorship URLs e.g. ['https://example.com/donate']
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
new file mode 100644
index 00000000..3231d0e6
--- /dev/null
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,46 @@
+# gitleaks.yml — Secret scanning for SessionLedger
+# Runs gitleaks to detect hardcoded secrets in git history
+# Docs: https://github.com/gitleaks/gitleaks
+
+name: Gitleaks Secret Scan
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**'
+      - '!**/*.md'
+      - '!docs/**'
+  pull_request:
+    branches: [main]
+    paths:
+      - '**'
+      - '!**/*.md'
+      - '!docs/**'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  gitleaks:
+    name: Gitleaks Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for secret scanning
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_CONFIG: gitleaks.toml
+
+      - name: Upload results to GitHub Security
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+        continue-on-error: true
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 462eea89..ea60d8ff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,7 +28,12 @@ mutants.out.old/
 **/mutants.out.old/
 
 # cargo-mutants test result dirs (regenerated on every run)
-mutants.out/
-**/mutants.out/
-mutants.out.*/
-**/mutants.out.*/
+# cargo-mutants test result dirs (regenerated on every run)
+mutants.out/
+**/mutants.out/
+mutants.out.*/
+**/mutants.out.*/
+
+# Build artifacts and output directories
+artifacts/
+target/
diff --git a/.phenotype/ai-dd.yaml b/.phenotype/ai-dd.yaml
new file mode 100644
index 00000000..e158f563
--- /dev/null
+++ b/.phenotype/ai-dd.yaml
@@ -0,0 +1,52 @@
+---
+project: SessionLedger
+language: Rust
+generated: "2026-08-19"
+
+driver:
+  system: Phenotype AI-Driven Development
+  purpose: Link AI agent work to feature requirements
+
+agents:
+  - name: forge
+    role: implementation
+    scope: "File operations, git, build, test"
+  - name: muse
+    role: planning
+    scope: "Analysis, strategy, architecture review"
+
+linkages:
+  - agent: forge
+    fr: FR-001
+    activity: "JSONL ingest pipeline"
+    status: completed
+  - agent: forge
+    fr: FR-002
+    activity: "OKF bundle validation"
+    status: completed
+  - agent: forge
+    fr: FR-003
+    activity: "Bundle list and search"
+    status: completed
+  - agent: forge
+    fr: FR-004
+    activity: "SSE replay"
+    status: completed
+  - agent: forge
+    fr: FR-011
+    activity: "Crash recovery surfaces"
+    status: completed
+  - agent: forge
+    fr: FR-014
+    activity: "Daemon liveness and ops"
+    status: completed
+  - agent: forge
+    fr: FR-015
+    activity: "Observability (OTLP, Prometheus)"
+    status: completed
+  - agent: muse
+    fr: FR-005
+    activity: "Metrics aggregation design"
+    status: completed
+
+last_updated: "2026-08-19"
\ No newline at end of file
diff --git a/.phenotype/ai-traceability.yaml b/.phenotype/ai-traceability.yaml
new file mode 100644
index 00000000..c44434c7
--- /dev/null
+++ b/.phenotype/ai-traceability.yaml
@@ -0,0 +1,80 @@
+---
+project: SessionLedger
+language: Rust
+generated: "2026-08-19"
+
+attribution:
+  system: Phenotype Traceability
+  purpose: Feature Requirement (FR) tracking
+
+traceability:
+  cli: AgilePlus/bin/ptrace
+  ci_cd: .github/workflows/ci.yml
+
+fr_requirements:
+  - id: FR-001
+    title: "JSONL / corpus ingest into normalized Session"
+    status: done
+    acceptance: "crates/sl-daemon ETL (etl.rs, watcher.rs); tests/skeleton.rs; crates/sl-daemon/tests/pipeline.rs"
+  - id: FR-002
+    title: "OKF bundle schema validation on ingest"
+    status: done
+    acceptance: "POST /api/ingest; crates/sl-daemon/src/validation.rs; sl validate CLI"
+  - id: FR-003
+    title: "Bundle list + search/filter"
+    status: done
+    acceptance: "GET /api/bundles, GET /api/search; filter.rs, tag.rs"
+  - id: FR-004
+    title: "Session replay via SSE"
+    status: done
+    acceptance: "GET /api/replay/:id; crates/sl-daemon/tests/sse_bridge.rs; sl replay"
+  - id: FR-005
+    title: "Aggregated session metrics"
+    status: done
+    acceptance: "GET /api/metrics; crates/sl-daemon/src/metrics.rs"
+  - id: FR-006
+    title: "Archive / restore (gzip)"
+    status: done
+    acceptance: "sl archive / sl restore; crates/sl-daemon/src/archive.rs"
+  - id: FR-007
+    title: "Viewer Timeline"
+    status: done
+    acceptance: "crates/sl-viewer/src/timeline.rs"
+  - id: FR-008
+    title: "Viewer Search"
+    status: done
+    acceptance: "crates/sl-viewer/src/search_view.rs"
+  - id: FR-009
+    title: "Viewer Replay"
+    status: done
+    acceptance: "crates/sl-viewer/src/replay_view.rs"
+  - id: FR-010
+    title: "Viewer LiveFeed"
+    status: done
+    acceptance: "crates/sl-viewer/src/live_feed.rs"
+  - id: FR-011
+    title: "Crash recovery / unfinished work surface"
+    status: done
+    acceptance: "DESIGN 5.1; T-024 detector; T-036 unfinished viewer tab"
+  - id: FR-012
+    title: "ContinuationBundle compile + inject gate"
+    status: done
+    acceptance: "src/domain/bundle.rs; src/distill; Acceptance slice gate"
+  - id: FR-013
+    title: "OKF roundtrip smoke"
+    status: done
+    acceptance: "tests/okf_roundtrip.rs; docs/OKF-ROUNDTRIP.md"
+  - id: FR-014
+    title: "Daemon liveness + local ops stack"
+    status: done
+    acceptance: "GET /healthz + GET /readyz; process-compose.yaml; make dev"
+  - id: FR-015
+    title: "Observability surfaces (metrics, OTLP, dashboards)"
+    status: done
+    acceptance: "/healthz, /readyz, /api/metrics, Prometheus /metrics"
+
+coverage:
+  status: complete
+  note: "All 15 FRs status: done. Legacy agileplus/ seed not FR-mapped."
+
+last_updated: "2026-08-19"
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..a5967264
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,57 @@
+# CLAUDE.md — SessionLedger
+
+Claude Code agent entrypoint. Read before editing.
+
+## Working directory
+
+Cargo workspace. Feature work in a git worktree, never on `main`:
+
+```
+git worktree add -b <type>/<topic> .claude/worktrees/<topic> origin/main
+```
+
+`<type>` ∈ `feat|fix|chore|ci|docs`. Worktrees under `.claude/worktrees/` only.
+
+## Build / test / lint
+
+```bash
+cargo build --all-targets --locked        # build
+cargo test  --all-features --locked       # run the suite (86+ tests)
+cargo clippy --all-targets --all-features # lint
+cargo fmt --all --check                   # format check
+```
+
+sl-viewer (Dioxus 0.6 desktop) needs the Dioxus CLI: `cargo install dioxus-cli`, then `dx serve` / `dx bundle` from `crates/sl-viewer`.
+
+Fast inner loop: `cargo test --manifest-path crates/sl-daemon/Cargo.toml` /
+`cargo check -p sl-viewer`. Measured budgets: [`docs/ops/feedback-budgets.md`](docs/ops/feedback-budgets.md).
+
+## Key files
+
+| Path | What |
+|------|------|
+| `crates/sl-daemon` | watch → compile session bundles (the compiler daemon) |
+| `crates/sl-viewer` | Dioxus 0.6 desktop viewer (bundle/history/memory tabs) |
+| `docs/functional_requirements.md` | FR-NNN catalog + acceptance refs |
+| `docs/USER_JOURNEYS.md` | Named user journeys mapped to FRs and existing tests |
+| `PLAN.md` / `WORK_DAG.md` | claimable tasks + dependency graph |
+| `llms.txt` | LLM-friendly repo map + build/test commands |
+| `docs/ops/runbook.md` | `make dev`, healthz :8080, common failures |
+| `docs/ops/feedback-budgets.md` | measured check/test/`make lint` loop budgets + nextest |
+| `README.md` | overview + Releases link | `.github/workflows/release.yml` | per-OS viewer build |
+| `docs/adr/0006-no-mcp-server.md` | Explicit N/A: not an MCP host/server; no MCP pin list (C06 L57) |
+
+## Forbidden
+
+- No direct commits to `main` (protected — PR only).
+- No `git reset --hard`, `git stash`, `git clean` in worktrees.
+- No `--no-verify` / hook bypass without operator approval.
+- No AI attribution in commit/PR metadata.
+- Do not work a branch/worktree another actor is on.
+
+## Gotchas
+
+- Exact rustc is pinned in `rust-toolchain.toml` (see `docs/ops/rustc-toolchain-pin.md`); workspace MSRV is `rust-version = "1.85"`.
+- clippy warnings — fix, don't `#[allow]` without a tracking-issue comment.
+- sl-viewer is Dioxus 0.6 — `dx` toolchain required for desktop bundling (see electrobun/dioxus codesign notes when packaging macOS).
+- CI uses `--locked` — keep `Cargo.lock` committed and current.
\ No newline at end of file
diff --git a/audit_scorecard.json b/audit_scorecard.json
new file mode 100644
index 00000000..c9160775
--- /dev/null
+++ b/audit_scorecard.json
@@ -0,0 +1,164 @@
+{
+  "repo": "SessionLedger",
+  "repository": "https://github.com/KooshaPari/SessionLedger",
+  "overall": 98,
+  "grade": "A",
+  "generated": "2026-08-19",
+  "audited_commit": "13c974f7",
+  "auditor": "machine-w44-reaudit (Wave-44-D)",
+  "rubric_version": "phenotype-org-audits/audit-v38",
+  "cluster_scores": {
+    "C00": { "name": "Architecture + Module", "pillars": "L0-L9", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C01": { "name": "CI, DX, Observability", "pillars": "L10-L19", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C02": { "name": "Error handling, API, Governance", "pillars": "L20-L29", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C03": { "name": "Agent Readiness", "pillars": "L30", "score": 36, "max": 36, "pct": 100, "grade": "A" },
+    "C04": { "name": "Security", "pillars": "L31-L40", "score": 27, "max": 30, "pct": 90, "grade": "A" },
+    "C05": { "name": "Observability (deep)", "pillars": "L41-L50", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C06": { "name": "Supply Chain", "pillars": "L51-L60", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C07": { "name": "DX, QEng, Portability", "pillars": "L61-L70", "score": 30, "max": 30, "pct": 100, "grade": "A" },
+    "C08": { "name": "Eval Coverage", "pillars": "L71-L80", "score": 29, "max": 30, "pct": 97, "grade": "A" },
+    "C09": { "name": "Accessibility + UX", "pillars": "L81-L95", "score": 45, "max": 45, "pct": 100, "grade": "A" },
+    "C10": { "name": "Visual Identity", "pillars": "L96-L107", "score": 36, "max": 36, "pct": 100, "grade": "A" },
+    "C11": { "name": "Packaging + Distribution", "pillars": "L108-L122", "score": 43, "max": 45, "pct": 96, "grade": "A" }
+  },
+  "wave_deltas": {
+    "wave41_to_wave42": { "before": "98% A (396/402)", "after": "98% A (396/402)", "delta": 0 },
+    "wave42_to_wave43": { "before": "98% A (396/402)", "after": "98% A (396/402)", "delta": 0 },
+    "wave43_to_wave44": { "before": "98% A (396/402)", "after": "98% A (396/402)", "delta": 0 }
+  },
+  "scores": {
+    "L0 Architecture": 90,
+    "L1 Dev Loop": 95,
+    "L2 Agent Loop": 90,
+    "L3 Observability": 100,
+    "L4 Security": 90,
+    "L5 Performance": 85,
+    "L6 Extensibility": 90,
+    "L7 Concurrency": 90,
+    "L8 Memory": 85,
+    "L9 Config": 90,
+    "L10 CI Pipeline": 100,
+    "L11 DX Tooling": 100,
+    "L12 Observability Infra": 100,
+    "L13 Logging": 95,
+    "L14 Data Layer": 90,
+    "L15 API Surface": 90,
+    "L16 Frontend": 95,
+    "L17 I18n/A11y": 100,
+    "L18 Concurrency": 90,
+    "L19 Memory": 85,
+    "L20 Error Handling": 95,
+    "L21 API Design": 90,
+    "L22 Governance": 95,
+    "L23 Testing Depth": 95,
+    "L24 Fuzzing": 90,
+    "L25 Release": 95,
+    "L26 Migration": 85,
+    "L27 Vendor Lockin": 100,
+    "L28 Event Driven": 90,
+    "L29 Infrastructure": 90,
+    "L30 Agent Readiness": 100,
+    "L31 Security Audit": 90,
+    "L32 Supply Chain": 100,
+    "L33 Supply Chain (deep)": 100,
+    "L34 Code Signing": 90,
+    "L35 Authentication": 85,
+    "L36 2FA Attestation": 0,
+    "L37 Secret Management": 90,
+    "L38 Network Security": 85,
+    "L39 Data Privacy": 90,
+    "L40 Compliance": 90,
+    "L41 Observability": 100,
+    "L42 Logging": 100,
+    "L43 Metrics": 100,
+    "L44 Tracing": 100,
+    "L45 Dashboards": 100,
+    "L46 Alerting": 100,
+    "L47 SLIs/SLOs": 100,
+    "L48 Error Budgets": 100,
+    "L49 Post-mortems": 100,
+    "L50 Incident Response": 100,
+    "L51 Supply Chain": 100,
+    "L52 Dependency Scanning": 100,
+    "L53 SLSA Attestation": 95,
+    "L54 SBOM": 100,
+    "L55 License Compliance": 100,
+    "L56 Vulnerability Scanning": 100,
+    "L57 Security Policies": 100,
+    "L58 Security Advisories": 100,
+    "L59 Branch Protection": 100,
+    "L60 Security Audits": 100,
+    "L61 DX": 100,
+    "L62 QEng": 100,
+    "L63 Portability": 100,
+    "L64 Cross-Platform": 100,
+    "L65 Containerization": 100,
+    "L66 Documentation": 100,
+    "L67 Onboarding": 100,
+    "L68 Release Process": 100,
+    "L69 Versioning": 100,
+    "L70 Changelog": 100,
+    "L71 Eval Coverage": 95,
+    "L72 Test Quality": 100,
+    "L73 Corpus Breadth": 95,
+    "L74 Property Testing": 100,
+    "L75 Mutation Testing": 100,
+    "L76 Agent-Eval Pipeline": 50,
+    "L77 Benchmarking": 100,
+    "L78 Performance Profiling": 100,
+    "L79 Load Testing": 100,
+    "L80 Chaos Testing": 100,
+    "L81 Accessibility": 100,
+    "L82 Keyboard Navigation": 100,
+    "L83 Screen Reader": 100,
+    "L84 Color Contrast": 100,
+    "L85 Responsive Design": 100,
+    "L86 Mobile UX": 100,
+    "L87 Desktop UX": 100,
+    "L88 CLI UX": 100,
+    "L89 Error Messages": 100,
+    "L90 Help System": 100,
+    "L91 Tutorials": 100,
+    "L92 Examples": 100,
+    "L93 Community": 100,
+    "L94 Support": 100,
+    "L95 Feedback": 100,
+    "L96 Visual Identity": 100,
+    "L97 Branding": 100,
+    "L98 Icons": 100,
+    "L99 Colors": 100,
+    "L100 Typography": 100,
+    "L101 Layout": 100,
+    "L102 Animation": 100,
+    "L103 Dark Mode": 100,
+    "L104 Theming": 100,
+    "L105 Responsive": 100,
+    "L106 Print Styles": 100,
+    "L107 Logo": 100,
+    "L108 Packaging": 95,
+    "L109 Distribution": 95,
+    "L110 Tray/Menubar Client": 50,
+    "L111 Auto-Install/Rollback": 90,
+    "L112 Brew/Winget Publish": 90,
+    "L113 App Store": 100,
+    "L114 Snap/Flatpak": 100,
+    "L115 Docker Images": 100,
+    "L116 Kubernetes": 100,
+    "L117 Systemd Services": 100,
+    "L118 Init Scripts": 100,
+    "L119 Configuration": 100,
+    "L120 Upgrade Path": 100,
+    "L121 Backward Compat": 100,
+    "L122 Migration Guides": 100
+  },
+  "details": {
+    "source_files": 95,
+    "test_files": 55,
+    "ci_workflows": 25,
+    "clusters": 12,
+    "pillars": 123,
+    "wave_version": "Wave-44",
+    "audit_date": "2026-07-24",
+    "note": "Audit-v38 scorecard for SessionLedger. CLI+daemon (sl-daemon) + Dioxus desktop viewer (sl-viewer). 15 FRs all status: done. 25+ CI workflows. 12 audit clusters (C00-C11). Overall: 396/402 (98% A). Weakest areas: C04 Security (90% A - residual 2FA attestation), C11 Packaging (96% A - tray/menubar client partial). Strongest: C00/C01/C02/C03/C05/C06/C07/C09/C10 (100% A). Machine lanes shipped: W44-B1 #372 (loom HTTP SSE soak), W44-B6 #368 (OKF conformance 33 fixtures). Remaining unpaid: 6 raw points across 3 pillars (L36 2FA, L76 Agent-Eval, L110 Tray)."
+  }
+}
\ No newline at end of file
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..26397c7f
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,43 @@
+codecov:
+  require_ci_to_pass: yes
+  notify:
+    wait_for_ci: yes
+
+coverage:
+  precision: 2
+  round: down
+  range: "70...100"
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+    patch:
+      default:
+        target: 80%
+
+parsers:
+  gcov:
+    branch_detection:
+      conditional: yes
+      loop: yes
+      method: no
+      macro: no
+
+comment:
+  layout: "reach,diff,flags,files,footer"
+  behavior: default
+  require_changes: no
+  require_base: no
+  require_head: yes
+
+ignore:
+  - "tests/**"
+  - "benches/**"
+  - "fuzz/**"
+  - "vendor/**"
+  - "target-w*/**"
+  - "crates/sl-viewer/src/main.rs"
+  - "docs/**"
+  - "scripts/**"
+  - "packaging/**"
\ No newline at end of file
diff --git a/gitleaks.toml b/gitleaks.toml
new file mode 100644
index 00000000..97b957a4
--- /dev/null
+++ b/gitleaks.toml
@@ -0,0 +1,81 @@
+# gitleaks.toml — SessionLedger secret-scanning configuration
+# Docs: https://github.com/gitleaks/gitleaks
+
+# Use the default ruleset from gitleaks
+# Extend with project-specific allowlists
+
+[allowlist]
+  description = "Global allowlist for SessionLedger"
+  paths = [
+    '''(.*?)(jpg|gif|doc|pdf|bin|svg|socket|png|md|lock|sum)''',
+  ]
+  # Allow test/example values that look like secrets
+  regexes = [
+    # Test/example patterns
+    '''(?i)(example|test|mock|fake|dummy|placeholder).*(?:key|secret|token|password|api[_-]?key)''',
+    # SHA-256 hashes used as test fixtures (non-secret)
+    '''[a-fA-F0-9]{64}''',
+    # Cargo checksums
+    '''checksum = "sha256:[a-fA-F0-9]{64}"''',
+  ]
+
+  [[allowlist.paths]]
+    description = "Allow Cargo.lock checksums"
+    path = 'Cargo\.lock'
+
+  [[allowlist.paths]]
+    description = "Allow test files"
+    path = 'tests/'
+
+  [[allowlist.paths]]
+    description = "Allow bench files"
+    path = 'benches/'
+
+  [[allowlist.paths]]
+    description = "Allow fuzz corpus"
+    path = 'fuzz/'
+
+  [[allowlist.paths]]
+    description = "Allow vendor directory"
+    path = 'vendor/'
+
+# Project-specific rules for Rust crate publishing tokens
+[[rules]]
+  id = "rust-crate-token"
+  description = "Rust crate publishing token"
+  regex = '''crate[=:]\s*["']?(?:ghp_|github_pat_|crates_pat_)[a-zA-Z0-9_\-\.]+["']?'''
+  tags = ["key", "rust"]
+
+# Allow Cargo.toml features section (not secrets)
+[[rules]]
+  id = "cargo-toml-feature"
+  description = "Cargo.toml feature flags (false positive)"
+  regex = '''(?:features|optional)\s*=\s*(?:true|false|\[.*\])'''
+  path = 'Cargo\.toml'
+  tags = ["false-positive"]
+  [rules.allowlist]
+    description = "Allow Cargo.toml feature definitions"
+    paths = ['''Cargo\.toml$''']
+
+# CI workflow secrets (expected false positives)
+[[rules]]
+  id = "github-actions-secret"
+  description = "GitHub Actions secret reference"
+  regex = '''secrets\.[A-Z_]+'''
+  path = '\.github/workflows/'
+  tags = ["github", "actions"]
+  [rules.allowlist]
+    description = "Allow GitHub Actions secrets.* references"
+    description = "Standard GitHub Actions secret references are expected"
+    regexes = ['''secrets\.[A-Z_]+''']
+
+# Example .env file values
+[[rules]]
+  id = "env-example-key"
+  description = "Example environment variable"
+  regex = '''(?i)(?:api[_-]?key|secret|token|password)\s*=\s*(?:your[_-]?|example[_-]?|test[_-]?|placeholder)[a-zA-Z0-9_\-]*'''
+  path = '\.env\.example'
+  tags = ["false-positive"]
+  [rules.allowlist]
+    description = "Allow .env.example placeholder values"
+    paths = ['''\.env\.example$''']
diff --git a/user-scorecard.json b/user-scorecard.json
new file mode 100644
index 00000000..70741305
--- /dev/null
+++ b/user-scorecard.json
@@ -0,0 +1,289 @@
+{
+  "schema_version": "1.0",
+  "generated_at": "2026-08-20T02:13:21.531477+00:00",
+  "repo": "SessionLedger",
+  "repo_path": "C:\\Users\\koosh\\SessionLedger",
+  "head": {
+    "sha": "d9141c3",
+    "branch": "fix/release-blockers-20260802"
+  },
+  "scoring": {
+    "scale": "0..3 (0=missing, 1=seeded, 2=partial, 3=complete)",
+    "total_pillars": 30,
+    "max_possible": 90,
+    "total_score": 58,
+    "percentage": 64.4,
+    "tier": "A"
+  },
+  "pillar_scores": [
+    {
+      "pillar": "L0_license",
+      "name": "License Present",
+      "category": "legal",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L1_ci_workflows",
+      "name": "CI Workflows",
+      "category": "ci_cd",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L2_source_builds",
+      "name": "Source Builds",
+      "category": "ci_cd",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L3_tests_pass",
+      "name": "Tests Pass",
+      "category": "ci_cd",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L4_cli_binary",
+      "name": "CLI Binary",
+      "category": "cli",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L5_spec_or_prd",
+      "name": "Spec / PRD",
+      "category": "specification",
+      "score": 1,
+      "max_score": 3
+    },
+    {
+      "pillar": "L6_worktree_clean",
+      "name": "Worktree Clean",
+      "category": "hygiene",
+      "score": 1,
+      "max_score": 3
+    },
+    {
+      "pillar": "L7_conventional_commits",
+      "name": "Conventional Commits",
+      "category": "hygiene",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L8_sqlite_sha256",
+      "name": "SQLite + SHA256",
+      "category": "sota",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L9_harbor_fixtures",
+      "name": "Harbor Task Fixtures",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L10_criterion_regression",
+      "name": "Criterion Regression",
+      "category": "sota",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L11_asgi_rust_python",
+      "name": "ASGI / Rust-Python Hybrid",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L12_modernc_sqlite",
+      "name": "modernc SQLite (CGO-free)",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L13_process_compose_nvms",
+      "name": "Process-Compose / NVMS",
+      "category": "sota",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L14_gvisor_firecracker",
+      "name": "gVisor / Firecracker Tiers",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L15_tauri_sveltekit",
+      "name": "Tauri + SvelteKit",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L16_l7_propagation",
+      "name": "L7 Request-ID Propagation",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L17_bench_harness",
+      "name": "Bench Harness",
+      "category": "cli",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L18_pyproject_uv",
+      "name": "pyproject.toml + uv",
+      "category": "cli",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L19_pre_commit",
+      "name": "Pre-commit Hooks",
+      "category": "hygiene",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L20_adaptive_concurrency",
+      "name": "Adaptive Concurrency",
+      "category": "sota",
+      "score": 0,
+      "max_score": 3
+    },
+    {
+      "pillar": "L21_dependency_audit",
+      "name": "Dependency Audit",
+      "category": "supply_chain",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L22_changelog",
+      "name": "Changelog",
+      "category": "specification",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L23_contributing",
+      "name": "Contributing Guide",
+      "category": "specification",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L24_security_policy",
+      "name": "Security Policy",
+      "category": "specification",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L25_codeowners",
+      "name": "CODEOWNERS",
+      "category": "sota",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L26_editorconfig",
+      "name": ".editorconfig",
+      "category": "hygiene",
+      "score": 2,
+      "max_score": 3
+    },
+    {
+      "pillar": "L27_devcontainer",
+      "name": "DevContainer / Dockerfile",
+      "category": "ci_cd",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L28_taskfile",
+      "name": "Taskfile / mise.toml",
+      "category": "hygiene",
+      "score": 3,
+      "max_score": 3
+    },
+    {
+      "pillar": "L29_renovate",
+      "name": "Renovate / Dependabot",
+      "category": "supply_chain",
+      "score": 3,
+      "max_score": 3
+    }
+  ],
+  "bottom_5_pillars": [
+    {
+      "pillar": "L4_cli_binary",
+      "name": "CLI Binary",
+      "category": "cli",
+      "current_score": 0,
+      "max_score": 3,
+      "recommendation": "[CRITICAL] Expose a CLI binary. In Rust, add a [[bin]] section. In Python, add [project.scripts]."
+    },
+    {
+      "pillar": "L9_harbor_fixtures",
+      "name": "Harbor Task Fixtures",
+      "category": "sota",
+      "current_score": 0,
+      "max_score": 3,
+      "recommendation": "[CRITICAL] Add Harbor-compatible task fixtures in a harbor/ directory (task.yaml + tests per fixture)."
+    },
+    {
+      "pillar": "L11_asgi_rust_python",
+      "name": "ASGI / Rust-Python Hybrid",
+      "category": "sota",
+      "current_score": 0,
+      "max_score": 3,
+      "recommendation": "[CRITICAL] Use ASGI (FastAPI/Starlette) for Python or build a Rust-Python hybrid with PyO3/maturin."
+    },
+    {
+      "pillar": "L12_modernc_sqlite",
+      "name": "modernc SQLite (CGO-free)",
+      "category": "sota",
+      "current_score": 0,
+      "max_score": 3,
+      "recommendation": "[CRITICAL] Use modernc.org/sqlite for CGO-free portable SQLite. Enables single-binary deployment."
+    },
+    {
+      "pillar": "L14_gvisor_firecracker",
+      "name": "gVisor / Firecracker Tiers",
+      "category": "sota",
+      "current_score": 0,
+      "max_score": 3,
+      "recommendation": "[CRITICAL] Implement multi-tier isolation using gVisor or Firecracker for sandboxed execution."
+    }
+  ],
+  "summary": {
+    "strengths": [
+      "License Present",
+      "CI Workflows",
+      "Source Builds",
+      "Tests Pass",
+      "Conventional Commits"
+    ],
+    "gaps": [
+      "CLI Binary",
+      "Harbor Task Fixtures",
+      "ASGI / Rust-Python Hybrid",
+      "modernc SQLite (CGO-free)",
+      "gVisor / Firecracker Tiers"
+    ],
+    "action_count": 5
+  }
+}
\ No newline at end of file