Open-source boundary: the public product is core + engine + PWA (tracking)

[thedancingdeveloper]

Tracks the open-source delivery boundary: the public product is the Python core, Rust session engine and Solid PWA delivered as the supported stack.

Delivered

The repository-side implementation and public delivery surface are complete on dev:

• MIT governance and contributor/security documentation.
• Core, engine and PWA boundary with the supported Compose overlays.
• Clean-checkout build path, public delivery checks and current release references.
• Sanitized Firebase handling, out-of-tree CI configuration and tracked-secret guards.
• Renamed Android identities and the mobile/voice implementation.

The GitHub repository is PUBLIC.

Remaining publication and security gates

• #265: rotate/restrict or revoke the historical Firebase key and record rotate-only versus history-rewrite handling.
• #266: make the vogt GHCR package public and verify anonymous manifests, pull and Compose startup.
• #191: verify dev/prod FCM registration and correctly routed pushes on a stable device or emulator. #188 remains open only because it depends on voice (m4): FCM client entry for the dev application id — unblocks all phone validation (FR-M4) (#188) #191.

The repository-side work is not waiting on another code PR. The package is currently PRIVATE, and the historical Firebase key remains reachable from old Git refs, so publication/security acceptance is not claimed.

Close condition

Close this tracker after #265, #266 and #191 record their owner-controlled security, publication and device evidence, then run the anonymous delivery smoke against the public repository and package.