Export bran-dev 3feeba3 public snapshot

[1wgrumph]

What changed

• Add machine-readable grounded, miss, and partial-unanchored query outcomes with matched and unmatched term coverage.
• Add deterministic multi-bundle query ranking and opt-in local evidence summarize, propose, replay, and clear workflows.
• Adopt additive OKF v0.2 repository metadata while retaining selectable v0.1 compatibility.
• Add public community-health files and structured issue templates.
• Substitute a pinned public-only repository policy during export so private classifications never enter the public snapshot.
• Export reviewed bran-dev source commit 3feeba3ab30f0504a601ffbb732f98801e25c5e8 as public commit 35f577845a428e0788a1b60b58aebd939bf96220.

Why

BRAN could return plausible generic rankings for an unmatched named component, could query only one policy-bearing bundle, discarded deterministic coverage evidence, and had not completed repository-side OKF v0.2 adoption. The first export attempt also proved that copying the internal native policy verbatim disclosed private path classifications. This snapshot preserves deterministic offline ranking while making query coverage explicit and keeps the private-to-public boundary fail closed with a reviewed SHA-256-pinned public policy.

Validation

• bran check <source> bran-strict — PASS with the verified pinned BRAN 0.1.0 runtime.
• python3 tools/ci/public_export.py — PASS; malformed, unsupported-version, escaped-private-path, private-.bran-path, missing-template, and one-byte policy mutations fail closed.
• python3 tools/ci/public_export.py check --public-dir <snapshot> — PASS; source 3feeba3, 131 files.
• bran check <snapshot> bran-strict — PASS for okf-v0.1, okf-v0.2, and bran-strict outcomes.
• python3 tools/ci/public_boundary_check.py — PASS.
• ./tools/ci/check.sh --export — PASS in source and committed snapshot.
• ./tools/ci/check.sh --fast — PASS; 52 CLI tests, 278 core tests, TUI and release/export gates.
• ./tools/ci/check.sh --full — PASS in source and committed snapshot, including conformance, security, performance, and sealed-release self-tests.
• ./tools/cutover/publish-hygiene.sh — PASS.
• Gitleaks pre-push scan — one known synthetic DLP fixture already present on public main; no credential or new finding.
• Hosted checks on 35f577845a428e0788a1b60b58aebd939bf96220 — PASS: required fast, CodeQL actions, CodeQL Python, and CodeQL Rust.
• Owner review of the exact exported diff and separate merge authorization — complete.
• Repository merge settings — merge commits enabled; squash disabled. Organization policy requires rebase to remain enabled, while BRAN’s export contract still requires merge commits for export PRs.

Residual risk

no known gap

Merge does not authorize tagging, release creation, or package publication.