oss-readiness-audit

# OSS Readiness Audit ## Overview A pre-publish checklist for a repo that is about to become public on GitHub. Run every check below, gather the evidence with the given commands, then produce the report in the template at the end. ## Prerequisites - `git` plus standard Unix shell tools (`grep`, `find`, `du`) — nothing language-specific; the checks work the same on Swift, Node, Python, Rust, or Go projects. - Read access to the full project tree, including dotfiles. **Golden rule: fix every BLOCKER before the first commit, not after.** Once a commit lands, its content lives in `.git` history forever — even if a later commit deletes it, anyone who clones the repo can still recover the old blob. A `.gitignore` added after the fact does not retroactively remove already-tracked files, and history rewrites (`git filter-repo`, BFG, `reset --hard` + fresh init) are only cheap and safe while the repo has never been pushed. So: run this audit, fix blockers, THEN `git init` / first commit, THEN push. If the repo already has commits and/or has already been pushed, say so explicitly in the report — the remediation for a blocker changes from "fix before committing" to "history surgery required, and rotate any leaked secret immediately." --- ## How to use 1. Confirm the project root directory with the user if it's ambiguous. 2. Go through items 1–10 in order. For each: run the commands, note pass/fail, and collect the evidence (file paths, byte counts, match counts) you'll n...