docs(newos4): publishable README, MIT licence, security policy

3 files changed, 67 insertions, 0 deletions

diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..02a3ea8
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Akan Goksu Valdes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f02be99
--- /dev/null
+++ b/README.md
@@ -0,0 +1,38 @@
+# newOS4
+
+A browser terminal: a filesystem, a command shell, an editor and a tool-calling AI agent that all live
+in one page, backed by a WebDAV space.
+
+## Status and scope
+
+newOS4 is the terminal that runs **WebX11** user spaces (`https://webx11.duckdns.org/spaces/newos4/`).
+It is published here so the code can be read, audited and studied — it is **not** a packaged product:
+it expects a WebX11 host to provide
+
+* WebDAV storage at `/spaces/<user>/` (nginx + `dav-auth-check`),
+* the session API at `/api/auth/*`,
+* the metered AI gateway at `/ollama/*` (`webx11-aigateway`).
+
+Several defaults still point at the author's host (`https://webx11.duckdns.org`); a self-hosted
+deployment must change them (grep `webx11.duckdns.org`).
+
+## Layout
+
+| Path | What |
+|---|---|
+| `main.html` | the page; loads `modules/core/core-bundle.js` |
+| `modules/core/` | terminal, filesystem, AI assist, orchestrator, model profiles |
+| `modules/ext/` | individually loaded extensions (webdav, alias, busybox, course, …) |
+| `api/chat/` | the chat bridge endpoints (PHP, token-scoped) |
+| `api/debug/` | health/report/feedback endpoints |
+| `scripts/` | maintenance and triage tools |
+| `course/`, `help.html`, `cheatsheet.html` | built-in documentation |
+| `CHANGELOG.md` | every shipped fix, symptom → cause → fix → verified |
+
+## Version
+
+See `CHANGELOG.md`; the loader version is `vX.Y.Z` in `main.html` and `modules/module-loader.js`.
+
+## Licence
+
+MIT — see `LICENSE`.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d06d8e5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,8 @@
+# Security
+
+Report vulnerabilities privately: **darkmotox11@gmail.com** (do not open a public issue).
+
+This repository is a **published mirror**, generated from a private tree. Please report anything that looks
+like a leaked credential, an internal hostname, a private path or personal data: the sanitiser
+(`admin/scripts/publish-newos4.py` in the source tree) and a daily guard are supposed to make that
+impossible, so a report is a real finding.