[benjoox]

code-viz's public installation path lacked automated validation, contribution policies and a versioned launch example. This prepares the first release with a reproducible offline demo, clearer privacy limits and an enforced PR/CI workflow.

The builder now validates model shapes before following references, checks real paths before reading files, rejects malformed scenarios and strips supplied node excerpts. Generated pages use system fonts and safely parse embedded JSON. Regression tests cover invalid references, line ranges, traversal, symlinks, redaction and HTML escaping.

Adds Node 22/24 CI on Linux/macOS/Windows, synchronized plugin versions, community policies, issue/PR templates, maintainer release instructions, a social preview and draft LinkedIn copy. Main-branch rules and private security reporting are enabled in repository settings.

Validation:

• 31 local regression tests and bundled example pass.
• Claude Code validates and installs the plugin in an isolated configuration.
• skills 1.7.0 installs into a temporary project for the four documented agents.
• Chromium interaction checks pass at desktop and mobile widths, with no external requests or JavaScript errors.
• Gitleaks history and working-tree scans find no secrets; GitHub reports no secret alerts.

Remaining promotion inputs: the two video files and icon provenance from the author. End-to-end generation in each agent is not yet verified. See docs/verification.md for exact scope. Existing docs roadmap PR #1 is independent and remains untouched.