docs: streamline repository documentation

.github/workflows/security.yml

@@ -18,8 +18,8 @@ name: Security (OSS-CLI)
 #     is PSScriptAnalyzer (added below) — codeiq-equivalent of `p/java`.
 #   - jscpd format set to `powershell`, with generated release and authoritative
 #     development sources scanned separately to exclude intentional parity.
-#   - Added `psscriptanalyzer` job — language lint per
-#     `shared/runbooks/engineering-standards.md` (PowerShell variant).
+#   - Added `psscriptanalyzer` job — language lint per the coding standards
+#     in `CONTRIBUTING.md`.
 on:
   push:
     branches: [main]

CHANGELOG.md

@@ -40,14 +40,14 @@ First tagged release. Establishes the OpenSSF Best Practices `passing` baseline
   - `.github/dependabot.yml` — weekly grouped GitHub Actions updates.
   - `SECURITY.md` — private vulnerability disclosure policy, supported versions, and scope.
   - `.bestpractices.json` — OpenSSF Best Practices self-assessment (project [12647](https://www.bestpractices.dev/en/projects/12647)).
-  - `CLAUDE.md` — agent / contributor brief: build, test, run, conventions, OpenSSF Scorecard baseline + target.
-  - `shared/runbooks/engineering-standards.md` — PowerShell variant of the company canonical engineering-standards runbook.
+  - Contributor brief covering build, test, run, conventions, and the OpenSSF Scorecard baseline + target.
+  - PowerShell engineering standards — quality gates, code style, and CVE policy.
   - `scripts/setup-git-signed.sh` — one-shot signed-commit setup (SSH / OpenPGP / x509).
   - Branch protection on `main` — required signed commits, linear history, force-push and deletion blocked, eight required CI status checks.
   - Repo-level Dependabot security updates enabled.
 - Canonical-schema rewrite of `.bestpractices.json` so the bestpractices.dev autofill robot can pre-fill the criteria page on board flip ([PR #3](https://github.com/RandomCodeSpace/snipIT/pull/3)).
-- `CHANGELOG.md` (this file) and `docs/README.md` index — addresses the `release_notes` and `documentation_basics` gaps surfaced by the bestpractices.dev autofill audit ([PR #4](https://github.com/RandomCodeSpace/snipIT/pull/4) / [#5](https://github.com/RandomCodeSpace/snipIT/pull/5)).
-- `CONTRIBUTING.md` at repo root — conventional contribution-process entry point: §Reporting (Issues + SECURITY.md), §Development workflow, §What every PR must pass (8-row CI gate matrix with local commands), §Coding standards delegating to `shared/runbooks/engineering-standards.md` ([PR #7](https://github.com/RandomCodeSpace/snipIT/pull/7)).
+- `CHANGELOG.md` (this file) — addresses the `release_notes` and `documentation_basics` gaps surfaced by the bestpractices.dev autofill audit ([PR #4](https://github.com/RandomCodeSpace/snipIT/pull/4) / [#5](https://github.com/RandomCodeSpace/snipIT/pull/5)).
+- `CONTRIBUTING.md` at repo root — conventional contribution-process entry point: §Reporting (Issues + SECURITY.md), §Development workflow, §What every PR must pass (8-row CI gate matrix with local commands), §Coding standards ([PR #7](https://github.com/RandomCodeSpace/snipIT/pull/7)).
 
 ### Changed
 - `.github/workflows/test.yml` — every action SHA-pinned (Scorecard `Pinned-Dependencies`); top-level `permissions: read-all`; PSScriptAnalyzer moved out into `security.yml` so the SAST/lint signals are co-located with the rest of the security stack.

CONTRIBUTING.md

@@ -33,14 +33,15 @@ CI gates every PR on the following — please run them locally before requesting
 
 ## Coding standards (acceptable contributions)
 
-The full quality bar — quality gates, code style, branch/commit/PR rules, security tooling, performance targets — is codified in [`shared/runbooks/engineering-standards.md`](shared/runbooks/engineering-standards.md), the PowerShell variant of the company-canonical runbook. Treat that file as the single source of truth for what is acceptable in this repo. The most load-bearing rules:
+The quality bar for this repo, in short: every commit on `main` is signed (run `scripts/setup-git-signed.sh` once per worktree) and follows [Conventional Commits](https://www.conventionalcommits.org/); code is PowerShell 7.5+ in `Verb-Noun` style with no PS5.1 fallbacks; new behaviour ships with at least one test where the logic is testable without a desktop session, and UI-only paths are called out in the PR; and the eight CI gates in the table above are hard gates with zero tolerance — a finding is fixed in the same PR or the merge is blocked. The most load-bearing rules:
 
 - **PowerShell 7.5+ only.** No PS5.1 fallbacks, no `Add-Type` shims that only compile on Windows PowerShell.
 - **Functions: `Verb-Noun` PascalCase**, [approved verbs](https://learn.microsoft.com/powershell/scripting/developer/cmdlet/approved-verbs-for-windows-powershell-commands), `[CmdletBinding()]` + `param()` for any function with > 1 parameter.
-- **Pure-logic functions go in the `Core` region** of `SnipIT.ps1` so the headless test suite picks them up via `-CoreOnly`.
+- **`src/` and `xaml/` are the authoritative sources; `SnipIT.ps1` is generated.** Never edit `SnipIT.ps1` directly — change the source, then run `pwsh -NoProfile -File ./Build-SnipIT.ps1` and commit the source change and regenerated distribution together. CI rebuilds and rejects a stale `SnipIT.ps1`.
+- **Pure-logic functions go in `src/00-Core.ps1`** so the headless test suite picks them up via `-CoreOnly`; `-CoreOnly` must stay usable on Linux without loading WPF or other Windows-only assemblies.
 - **Preview-window event handlers are one-line wrappers** around named closures captured at window-creation time (e.g. `$beginPan`, `$pickColor`, `$handleMouseDown`) — keeps the test harness able to drive every code path through the closures via `-TestAction`.
 - **Tests are zero-dependency** (no Pester). Follow the assertion pattern in `Test-SnipIT.ps1`.
-- **Single-file deliverable is a headline product feature.** Do not propose splitting `SnipIT.ps1` into modules without an explicit board reversal.
+- **The single-file distribution is a headline product feature.** `SnipIT.ps1` must stay portable: no runtime lookup of `src/`, `xaml/`, the builder, repository paths, external modules, or network resources.
 
 ## What you'll need
 
@@ -61,7 +62,6 @@ For larger changes (new region in `SnipIT.ps1`, new top-level function group, ne
 ## Documentation
 
 - Update [`CHANGELOG.md`](CHANGELOG.md) `[Unreleased]` section with an entry under **Added** / **Changed** / **Fixed** / **Security** as appropriate.
-- If your PR changes how to build/test/run, conventions, gotchas, or introduces a new dependency, also update [`CLAUDE.md`](CLAUDE.md). It is the agent / contributor brief read at session start.
-- Long-form docs go under [`docs/`](docs/README.md).
+- If your PR changes how to build/test/run, conventions, or introduces a new dependency, also update [`README.md`](README.md) — it is the documentation entry point.
 
 Thanks again — the project is small, the test suite is fast, and your PR will get a reply quickly.