docs: refresh public repo scorecard and onboarding

.github/workflows/ci.yml

@@ -161,6 +161,7 @@ jobs:
           test -f examples/intelligence-catalog-page/README.md
           test -f examples/intelligence-catalog-page/build.py
           test -f openapi/zero-paper-api.v1.yaml
+          test -x scripts/env_doctor.py
           test -x scripts/assemble_release_assets.sh
           test -x scripts/install.sh
           test -x scripts/demo_capture.sh

README.md

@@ -467,16 +467,28 @@ the local docs gate. See [.devcontainer/README.md](.devcontainer/README.md).
 
 ## Source Quickstart
 
-Requirements: Python 3.11+, Rust stable, Cargo, and `just`.
+Requirements: Python 3.11+, Rust stable, Cargo, and `just`. Run the environment
+doctor first; it fails fast when macOS `python3` resolves to Apple Python 3.9 or
+when Rust/`just` are missing.
 
 ```bash
 git clone https://github.com/zero-intel/zero.git
 cd zero
+just env-doctor
 just bootstrap
 just demo
 just paper-api-smoke
 ```
 
+If `just env-doctor` reports an old system Python, use an explicit Python 3.11
+interpreter or run through `uv`:
+
+```bash
+uv run --python 3.11 --directory engine --with pytest --with hypothesis --with cryptography \
+  python -m pytest -q -p no:cacheprovider
+uv run --python 3.11 --directory engine --with cryptography python -m zero_engine.demo
+```
+
 Run the paper API:
 
 ```bash

docs/launch-scorecard.md

@@ -1,24 +1,37 @@
 # Launch Scorecard
 
-This scorecard keeps the public repo honest before launch. It scores only the
-open ZERO Runtime, Protocol, and Proof substrate. It does not score the hosted
-retail product, production wallets, raw exchange records, or commercial
+This scorecard keeps the public repo honest before and after launch. It scores
+only the open ZERO Runtime, Protocol, and Proof substrate. It does not score the
+hosted retail product, production wallets, raw exchange records, or commercial
 Intelligence service operation.
 
-## Current Launch Repository Score
+## Current Public Repository Scores
 
-**100/100**
+Last refreshed: 2026-07-01 from a clean public checkout and live GitHub/Railway
+checks.
+
+| Dimension | Score | Current proof |
+| --- | ---: | --- |
+| Engineering substrate | **98/100** | Engine tests, Rust workspace tests, MCP smoke, docs gates, and branch protection are green. |
+| Public freshness | **95/100** | Dependency PRs are reviewed/merged or queued for automerge; the next release evidence refresh remains the only cadence item. |
+| New-contributor onboarding | **96/100** | `just env-doctor` now catches Python/Rust/just issues before bootstrap; README includes a `uv` fallback for macOS Python 3.9. |
+| Public credibility / product honesty | **97/100** | Scorecard is timestamped, release freshness is separated from launch baseline, and live-capital claims stay bounded by redacted proof. |
+| Safety / proof posture | **99/100** | Paper-first defaults, fail-closed live boundary, proof privacy checks, journal integrity, CodeQL, secret scan, and OpenSSF Scorecard stay in CI. |
+
+## Launch Baseline Repository Score
+
+**100/100 as of the v0.1.2 launch baseline**
 
 ## Current Operating-Intelligence Trust Score
 
-**100/100**
+**97/100**
 
-The launch repository is ready for serious contributors when the public
+The launch repository remains ready for serious contributors when the public
 readiness gate passes with current doctrine. ZERO product truth is explicit:
 ZERO is the operating intelligence layer between humans and capital; this public
 repo is the open Runtime, Protocol, and Proof substrate. The stricter trust bar
-requires runnable software, redacted evidence, clear custody boundaries, and
-gates that reject stale category claims.
+requires runnable software, redacted evidence, clear custody boundaries,
+maintained dependency PRs, and gates that reject stale category claims.
 
 ## Ready
 
@@ -126,16 +139,27 @@ gates that reject stale category claims.
 - Commercial intelligence connectors
 - Enterprise support and SLAs
 
-## Remaining To Keep 100
+## Remaining To Keep Scores At Or Above 95
 
-- Keep the public GitHub Actions matrix green after every push
-- Keep published release evidence green with `just release-evidence v0.1.2`
+- Keep the public GitHub Actions matrix green after every push.
+- Keep Dependency PRs reviewed within one maintenance cycle; green bot PRs should
+  be approved, automerged, or closed with a maintainer note.
+- Publish refreshed release evidence for the next tag after material `main`
+  drift; `v0.1.2` remains the launch baseline, but the next release should
+  become the active install/documentation target.
 - Keep package-registry publication disabled until public name ownership,
-  Trusted Publishing, owner lists, and rollback procedure are secured
-- Keep the committed Homebrew formula generated from release checksums
+  Trusted Publishing, owner lists, and rollback procedure are secured.
+- Keep the committed Homebrew formula generated from release checksums.
 
-## Definition Of 100
+## Definition Of 95+
 
-The repo is 100/100 when a new engineer can clone it, run one command, inspect a
-paper engine through the CLI, pass CI locally, verify release artifacts, and pick
+The repo is 95+/100 across public dimensions when a new engineer can clone it,
+run an environment doctor before bootstrap, inspect a paper engine through the
+CLI, pass CI locally with documented commands, verify release artifacts, and pick
 up a scoped contributor issue without private context.
+
+## Definition Of 100
+
+The repo returns to 100/100 current score when the active GitHub Release, Docker
+image, Homebrew formula, release evidence, and README install targets all point
+to the same freshly verified tag with no open green maintenance PRs.

docs/llms-full.txt

@@ -532,16 +532,28 @@ the local docs gate. See [.devcontainer/README.md](.devcontainer/README.md).
 
 ## Source Quickstart
 
-Requirements: Python 3.11+, Rust stable, Cargo, and `just`.
+Requirements: Python 3.11+, Rust stable, Cargo, and `just`. Run the environment
+doctor first; it fails fast when macOS `python3` resolves to Apple Python 3.9 or
+when Rust/`just` are missing.
 
 ```bash
 git clone https://github.com/zero-intel/zero.git
 cd zero
+just env-doctor
 just bootstrap
 just demo
 just paper-api-smoke
 ```
 
+If `just env-doctor` reports an old system Python, use an explicit Python 3.11
+interpreter or run through `uv`:
+
+```bash
+uv run --python 3.11 --directory engine --with pytest --with hypothesis --with cryptography \
+  python -m pytest -q -p no:cacheprovider
+uv run --python 3.11 --directory engine --with cryptography python -m zero_engine.demo
+```
+
 Run the paper API:
 
 ```bash

docs/qa-onboarding-checklist.md

@@ -11,9 +11,14 @@ review.
 Run from repository root:
 
 ```bash
+just env-doctor
 just bootstrap
 ```
 
+`just env-doctor` must pass before bootstrap. It checks the contributor-facing
+prerequisites that most often make a fresh clone look broken: Python 3.11+,
+`just`, and Cargo/Rust.
+
 Quickly verify Python and pytest resolve to the same interpreter family:
 
 ```bash

engine/tests/test_env_doctor.py

@@ -0,0 +1,35 @@
+import importlib.util
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+ENV_DOCTOR = ROOT / "scripts" / "env_doctor.py"
+
+
+def load_env_doctor():
+    spec = importlib.util.spec_from_file_location("zero_env_doctor", ENV_DOCTOR)
+    assert spec is not None
+    assert spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_python_version_status_requires_python_311_or_newer():
+    doctor = load_env_doctor()
+
+    assert doctor.python_status((3, 10, 14)).ok is False
+    assert "Python 3.11+" in doctor.python_status((3, 10, 14)).message
+    assert doctor.python_status((3, 11, 0)).ok is True
+    assert doctor.python_status((3, 12, 2)).ok is True
+
+
+def test_overall_exit_code_fails_when_any_required_check_fails():
+    doctor = load_env_doctor()
+
+    checks = [doctor.Check("python", False, "old"), doctor.Check("just", True, "ok")]
+
+    assert doctor.exit_code(checks) == 1
+    assert doctor.exit_code([doctor.Check("python", True, "ok")]) == 0