Prepare repository for open-source launch

[Coooder-Crypto]

What changed

• finish the English and Chinese open-source launch documentation and release checklist
• harden secret scanning for Apple development team identifiers and include the MIT license in the npm artifact
• reduce Dependabot noise by grouping monthly minor and patch updates
• add the static project brief, launch deck, metadata, sitemap, robots, and llms.txt
• export the website and pitch as static artifacts and document their security boundary
• update the Local Preview documentation and package metadata for vitalmcp@0.5.3

Why

Prepare main as a reviewable, reproducible public source tree with explicit privacy, support, security, packaging, and rollback boundaries.

Validation

• npm ci
• npm run typecheck
• npm run test:local — 87 passed
• npm run test:ios — 23 passed
• npm run build
• npm run audit:oss — full tree and Git history, 0 findings
• production dependency audits for vitalmcp, website, and pitch — 0 vulnerabilities
• npm run pack:check --workspace vitalmcp — 120 intended files including LICENSE
• npm run release:npm-preflight -- --local
• isolated public install: vitalmcp@0.5.3 --version

Known boundary

The static-site build toolchain currently reports four development-only advisories inherited through Next.js. The exported sites have no production dependencies; the exception and upgrade condition are documented in SECURITY.md.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vital-agent-sync-www	Ready	Preview	Aug 2, 2026 5:26am