docs(epic-108): auditor pack + newcomer onboarding (#154)

[sergeyenin]

Summary

Closes credibility epic #108 and onboarding issue #154.

Sample auditor pack (epic gap)

• make auditor-pack / scripts/generate-auditor-pack.sh — docker-compose + demo-recorder when Docker is available
• scripts/auditorpackgen offline fallback when Docker is not
• Committed examples/auditor-pack/ (signed JSON, compliance HTML/JSON, manifest)

#154 Newcomer onboarding

• New here? tracks in docs/README.md (evaluator vs builder)
• docs/QUICKSTART.md aligned with README install matrix
• make verify-newcomer — cold-start smoke (init --scaffold + run --dry-run)
• docs/contributor/mission-control-screenshots.md

Discoverability

• README Proof Pack section linking LIMITATIONS, threat model, spec, conformance, benchmarks, auditor pack, ROADMAP

Epic #108 checklist

• LIMITATIONS.md (Write LIMITATIONS.md #117)
• Threat model (Publish threat model & trust boundaries #118)
• Benchmarks (Publish reproducible benchmarks (overhead, evidence throughput, PII latency) #119)
• Conformance count (Conformance tests + published counts (evidence + policy paths) #120)
• Evidence integrity spec (Evidence integrity spec (fields, serialization, signing, verification) #121)
• Compliance-claim discipline (Compliance-claim discipline pass (style rule + docs audit + feature/article pairing) #122)
• Anti-goals / ROADMAP (Public anti-goals + focused-narrative pass #123)
• Install matrix (Fix install paths + tighten README install matrix #124)
• Sample auditor export (this PR)
• Newcomer path (Developer onboarding polish (first-run + newcomer docs path) #154)

#107 (live 10-minute demo) remains open under M0.

Test plan

• scripts/check-claim-discipline.sh
• make auditor-pack (offline path)
• make verify-newcomer

Closes #154
Closes #108

---

Note

Low Risk
Documentation, sample fixtures, and Makefile-wrapped scripts only; no changes to gateway auth, policy enforcement, or signing logic in production paths.

Overview
Adds a reproducible sample auditor handoff (make auditor-pack): Docker Compose + demo-recorder when available, otherwise auditorpackgen writes committed artifacts under examples/auditor-pack/ (signed evidence, compliance HTML/JSON, manifest). Introduces make verify-newcomer to smoke-test talon init --scaffold and talon run --dry-run on a clean directory.

Docs/onboarding: README Proof Pack section; docs/README.md New here? evaluator vs builder paths and auditor-first job; docs/QUICKSTART.md aligned with install matrix, dry-run flow, and trust links; maintainer note for Mission Control screenshots in CONTRIBUTING.md and docs/contributor/mission-control-screenshots.md.

^{Reviewed by Cursor Bugbot for commit 73c1ec8. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 73c1ec8. Configure here.}

[cursor]

Allow record shows cost denial

Medium Severity

The offline auditor pack’s first scenario uses legacy reason within budget on an allowed decision. Legacy mapping tags any “budget” reason as POLICY_DENIED_COST while keeping decision allow, so the committed sample shows “blocked by cost policy” on an allowed record.

 

^{Reviewed by Cursor Bugbot for commit 73c1ec8. Configure here.}

[cursor]

Compose left up on failure

Medium Severity

After docker compose up succeeds, generate-auditor-pack.sh only runs docker compose down on the happy path. Health-check timeout, demo-recorder failure, export errors, or the secret-leak guard exit without tearing down the stack, leaving the demo on port 8080.

Additional Locations (1)

• scripts/generate-auditor-pack.sh#L67-L90

 

^{Reviewed by Cursor Bugbot for commit 73c1ec8. Configure here.}