[argahv]

Makes NotchFlow ready for outside contributors.

What's in it

• LICENSE: MIT (owner-approved). The repo was public without a license, so nobody could legally reuse or contribute to it.
• CONTRIBUTING.md: requirements, build, tests, a five-minute architecture tour, the generated Xcode project rule, conventions, accessibility and security expectations, branch and PR flow, how to propose features, the Debug channel, and a path for beginners. Now also: how to run a Debug build with its own data folder and settings (so a test run never touches your real shelf or history), and installing the Metal Toolchain to compile the shader locally on Xcode 26+.
• CODE_OF_CONDUCT.md: Contributor Covenant 2.1 (CC BY 4.0, attributed). Private reports go through GitHub private reporting.
• SECURITY.md: GitHub private vulnerability reporting, scope, response goals and rules for contributors. No invented email addresses.
• Issue forms: bug report, feature request, performance regression, accessibility issue and contributor onboarding. Blank issues are off, and the config links Q&A, Ideas and private security reporting.
• PR template: tests, project regeneration, accessibility and motion, privacy.
• README: license and CI badges, an explicit contributor invitation, an honest Status with Known limitations and a Roadmap, plus Contributing and License sections. Now also:
  • a link to a 29-second demo (docs/media/demo.mp4, 3.2 MB) recorded from the real app with demo projects;
  • a note that release 0.1.0 predates the portal, Notch Actions, Screenshots, Heartbeat, Living Split Island, Time Travel and Sound Island. Remove it once 0.2.0 ships.
• docs/community/maintainer-replies.md: reply templates and a triage table.
• CI: adds a Debug xcodebuild step next to the universal Release build.

The demo video

A real-time ScreenCaptureKit recording of NotchFlow's own window only (no wallpaper, menu bar or other apps), composited over a neutral backdrop like the README captures. The app ran as an isolated Debug build (com.argahv.notchflow.demo, throwaway data folder), driven through the Debug channel and the real event bridge and PermissionRequest hook. Captions and a "Real app · demo data" label are burned in.

Verification

On CI (macos-15): Python bridge tests, project-diff check, swift test, Debug build, universal Release build and the Metal shader compile.

Locally (macOS 27.0, Xcode 27.1, Swift 6.4), on this branch:

Check	Result
swift test	110 tests, 0 failures
python3 -I Tests/test_bridge.py	24 tests, OK
python3 Scripts/generate_project.py + diff	No changes
Debug xcodebuild	Succeeded (Swift 6 concurrency warnings only)
bash Scripts/build.sh (Release)	Succeeded, universal (x86_64 + arm64)
metal -c Resources/LiquidGlass.metal	Not run locally: Xcode 27 needs the separate Metal Toolchain download (documented in CONTRIBUTING). Passes on CI.
Doc links (42 Markdown/YAML files)	No broken relative links or anchors; all 24 external URLs return 200
Issue forms	All parse; fields, ids and labels well formed
History scan (all 361 blobs on every ref)	No real secrets. Hits are test fixtures (fake keys, AKIAIOSFODNN7EXAMPLE), placeholder paths (/Users/someone) and git@github.com. No deleted files in history. Images carry only pixel-dimension EXIF. No proprietary source or assets.
bash Scripts/release.sh check	Signing identity, notarization profile and gh all ready

Repository settings already changed

• Discussions enabled: Announcements, General, Ideas, Polls, Q&A, Show and tell. The Q&A and Ideas links in the docs and issue config now resolve.
• Topics added: macos, macos-app, swift, swiftui, appkit, notch, dynamic-island, claude-code, codex, developer-tools, github-actions, open-source.

Still needs the owner (security settings)

Settings › Code security (https://github.com/argahv/notchflow/settings/security_analysis):

• Private vulnerability reporting: currently off. SECURITY.md and the Code of Conduct send people there.
• Secret scanning and push protection: currently off.

---

Generated by Claude Code