docs: add usage and developer documentation

Add user and developer documentation plus Pagenary docsite publishing support. Includes Getting Started, Developer Guide, API and MCP references, Pagenary tenant metadata, npm scripts for sync/build/check/serve, and validation coverage for the generated docsite. Closes #102
2026-07-20 12:59:53 -04:00
1 parent 7b1d12a07c
commit 0c35a833b9
@@ -0,0 +1,74 @@
+---
+title: "Release Checklist"
+summary: "Release gates and verification steps."
+description: "Release gates and verification steps."
+audience: ["maintainer"]
+category: "release"
+status: "current"
+source: "T3MP3ST repository"
+sourcePath: "docs/RELEASE_CHECKLIST.md"
+updated: "2026-07-20"
+---
+# Release Checklist
+
+A repeatable, artifact-first checklist for cutting a T3MP3ST release. The guiding rule is the
+same as the project itself: **every headline number re-derives from committed artifacts** — so a
+release isn't cut until the deterministic gates and the local smoke path are green.
+
+## 1. Deterministic gates (must all pass)
+
+```bash
+npm ci
+npm run typecheck            # tsc — 0 errors
+npm run build                # tsc build
+npm run lint                 # 0 errors (warnings OK)
+npm test                     # unit + integration suite
+npm run verify-claims        # re-derives every headline number from committed artifacts
+npm audit                    # expect 0 vulnerabilities
+npm run test:no-fitting      # anti-benchmark-fitting guard
+npm run test:no-self-fitting
+npm run test:no-phantom-tools
+npm run test:gate
+npm run prompt:audit
+```
+
+## 2. Local API smoke (loopback only)
+
+```bash
+T3MP3ST_PORT=<free-port> npm run server &                 # start on an isolated port
+T3MP3ST_PORT=<free-port> npm run smoke                    # health + endpoint smoke
+T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run exploit:smoke
+T3MP3ST_API_URL=http://127.0.0.1:<free-port> npm run field:drill
+npm run arsenal:smoke                                     # self-contained, 125 checks
+```
+
+Stop any listeners you started when done.
+
+## 3. Optional — live checks (network + keys)
+
+```bash
+npm run smoke -- --live       # exercises a live LLM (needs a provider key or a local agent)
+npm run arsenal:doctor        # reports which optional external tools are installed
+```
+
+## 4. Arsenal prerequisites (optional external tools)
+
+The bash-only path needs **no** external tools. Specialist operators can use standard offensive
+tooling if present on `PATH`; `npm run arsenal:doctor` reports what's installed. Missing tools
+degrade gracefully — they never fail the core run.
+
+## 5. ⚠️ Scope & safety
+
+- **Never run live scans or exploitation against a target without an explicit authorization /
+  scope receipt.** The default posture is owned / local / synthetic targets only.
+- The server binds `127.0.0.1` by default. If you set `T3MP3ST_HOST` to a non-loopback address,
+  it prints an **EXPOSURE WARNING** — the API executes commands and has **no built-in auth**. Put
+  a Bearer-token reverse proxy in front of it before any LAN / internet exposure.
+
+## 6. Publish
+
+- Verify `repository.url` in `package.json` points at this repo. To retarget it:
+  ```bash
+  npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"
+  ```
+- Tag the release only after Sections 1–2 are green.