Doberman-Core / Tickets / #402 docs: rewrite README for voice, add release SBOM

#402 docs: rewrite README for voice, add release SBOM

Status: closed

Owner: nobody

Labels: None

Updated: 2026-08-18

Created: 2026-08-18

Creator: Anonymous

Private: No

Originally created by: fu351

Summary

Second no-ai-slop pass on README.md: removes every remaining em dash (133 → 0), replacing each with a plain sentence, colon, or parenthetical depending on what reads clearest. Builds on an earlier pass (not in this PR's history) that removed colon-reveal and binary-contrast phrasing. No factual or technical claim changed — verified line-by-line against the prior version.
Adds a CycloneDX SBOM to every release: pip-audit resolves the dependency set from pyproject.toml, the publish workflow generates dist/sbom.json (non-blocking — a disclosed CVE in a transitive dependency shouldn't silently gate a release nobody's reviewed) and attaches it to the GitHub Release.
Documents the SBOM in RELEASING.md (how it's built, how to regenerate locally) and SECURITY.md (how to use it to check a disclosed CVE against what you're running), with a one-line pointer from the README's License section.
New sbom extra in pyproject.toml (pip install -e ".[sbom]") for local regeneration.

[x] python scripts/check_markdown_links.py — all internal links/anchors resolve (25 files checked)
[x] .github/workflows/publish.yml parses as valid YAML
[x] pyproject.toml parses, sbom extra resolves
[x] Ran pip-audit -f cyclonedx-json -o sbom.json . against this repo locally: valid CycloneDX 1.4 output, 48 components resolved, no known vulnerabilities
[ ] First real release will confirm the GitHub Actions gh release upload step attaches the asset correctly (can't be tested pre-merge; continue-on-error + a hashFiles guard mean a failure here degrades to "no SBOM asset" rather than a broken release)

🤖 Generated with Claude Code