From d667717a9f7a53957aec816cfb45ee7984f1b872 Mon Sep 17 00:00:00 2001
From: Amir Bredy <amirbredy@microsoft.com>
Date: Sun, 26 Jul 2026 18:23:08 -0700
Subject: [PATCH 1/4] chore(release): prepare v0.3.94

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 25cded33-fbe8-4f98-90a4-491b16c499ba
---
 .github/ISSUE_TEMPLATE/bug.yml             |   2 +-
 .github/workflows/release-mac.yml          |   4 +-
 AGENTS.md                                  |  38 +++----
 CHANGELOG.md                               |  30 +++++-
 INSTALL.md                                 |  19 ++--
 README.md                                  |  35 ++-----
 SECURITY.md                                |   6 +-
 apps/desktop/PACKAGING.md                  |   2 +-
 apps/desktop/build/release-notes-author.md | 111 +++++++++++----------
 apps/desktop/package.json                  |   2 +-
 docs/src/changelog.md                      |  30 ++++--
 docs/src/introduction.md                   |  12 +--
 docs/src/operations/ci.md                  |  21 ++--
 docs/src/quick-start/install-run.md        |  18 ++--
 package-lock.json                          |   6 +-
 package.json                               |   2 +-
 scripts/release-metadata.test.mjs          |   4 +-
 scripts/ship-mac.ps1                       |   6 +-
 18 files changed, 193 insertions(+), 155 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
index 06c3138..3ffd357 100644
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -15,7 +15,7 @@ body:
     attributes:
       label: ConfigForge version
       description: Include the tag, package version, or commit SHA.
-      placeholder: v0.3.93
+      placeholder: v0.3.94
     validations:
       required: true
 
diff --git a/.github/workflows/release-mac.yml b/.github/workflows/release-mac.yml
index dbef4ab..6a01aa8 100644
--- a/.github/workflows/release-mac.yml
+++ b/.github/workflows/release-mac.yml
@@ -11,7 +11,7 @@ name: Release (macOS author)
 #
 # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`;
 # the checkout step below switches to and verifies the supplied immutable mac tag.
-# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.93-author.2`
+# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.94-author.1`
 # The protected main copy of the public packaging guard checks the tagged tree
 # before npm install or electron-builder runs.
 #
@@ -143,7 +143,7 @@ jobs:
           ) > SHA256SUMS-macos-author.txt
           cat SHA256SUMS-macos-author.txt
 
-      # Attach to the existing draft release (e.g. mac-v0.3.93-author.2).
+      # Attach to the existing draft release (e.g. mac-v0.3.94-author.1).
       # `--clobber` overwrites if a re-run uploads the same filename.
       - name: Upload artifacts to draft release
         env:
diff --git a/AGENTS.md b/AGENTS.md
index 6855582..22d768c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,22 +15,18 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references were verified on 2026-07-25:
+The following release references were verified on 2026-07-26:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.93` | Full Windows/Linux line. Latest tag and package version are `v0.3.93` and `0.3.93`; PR [#76](https://github.com/Azure/ConfigForge/pull/76) adds nested value keyboard editing and PR [#82](https://github.com/Azure/ConfigForge/pull/82) repairs the standalone Windows Server 2025 audits. |
-| `mac-author-build` | `c4ce196` (PR [#84](https://github.com/Azure/ConfigForge/pull/84)) | Current author-only macOS head and target of annotated tag `mac-v0.3.93-author.2`. The matching GitHub release exists with five verified assets, but it is a draft and is unpublished. |
+| `main` | `v0.3.94` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#86](https://github.com/Azure/ConfigForge/pull/86) patches dev-only `brace-expansion`; PRs [#88](https://github.com/Azure/ConfigForge/pull/88) and [#91](https://github.com/Azure/ConfigForge/pull/91) establish the public packaging and policy surface; PR [#89](https://github.com/Azure/ConfigForge/pull/89) refreshes nine synthetic-content screenshots. |
+| `mac-author-build` | `mac-v0.3.94-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
-use `0.3.93-author.2`. The annotated `mac-v0.3.93-author.2` tag resolves to
-`c4ce196574f1d3fdf878d4c5856f64539f6dec7a`, which is also the current macOS
-branch head. The matching GitHub release is intentionally a draft and must
-remain unpublished unless a maintainer separately approves publication.
-Workflow run
-[#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
-completed successfully and verified all five assets. The package versions on
-`main` are `0.3.93`; do not copy macOS package metadata to `main`.
+use `0.3.94-author.1`. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release remains a draft and
+unpublished. The Full-edition package versions are `0.3.94`; do not copy
+macOS package metadata to `main`.
 
 ### Current feature inventory
 
@@ -120,13 +116,12 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The existing `0.3.93-author.2` draft release contains exactly these verified
-  assets:
+- The `0.3.94-author.1` release contract expects exactly these asset names:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -142,7 +137,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.93-author.2
+    -f release_tag=mac-v0.3.94-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -456,13 +451,18 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   [#30176765724](https://github.com/Azure/ConfigForge/actions/runs/30176765724)
   passed the install, production audit, build, SBOM, checksum, and upload
   gates and verified the five expected assets.
-- Current annotated tag `mac-v0.3.93-author.2` and `mac-author-build` both
-  resolve to merge `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. PR check run
+- The prior annotated tag `mac-v0.3.93-author.2` resolved to merge
+  `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. PR check run
   [#30186333208](https://github.com/Azure/ConfigForge/actions/runs/30186333208)
   passed, and tag-pinned workflow run
   [#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
   passed the install, production audit, build, SBOM, checksum, and upload
-  gates. Both macOS releases remain drafts and are unpublished.
+  gates. The prior author.1 and author.2 releases remain drafts and
+  unpublished.
+- The current macOS Author tagged source is `mac-v0.3.94-author.1`, with an
+  unpublished draft release. Use current GitHub checks and release metadata
+  as the authority for build and asset status rather than recording a merge
+  SHA or workflow run here.
 
 ---
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac33c70..54891a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,31 @@
 # Changelog
 
-## [Unreleased]
+## [0.3.94] - 2026-07-26
+
+### Changed
+
+- Exclude CIS benchmark source data from public installers; Benchmark Mapping
+  and CIS Diff continue to use user-supplied benchmark files.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- Clarify that ConfigForge sends no product telemetry, update checks contact
+  GitHub Releases, and the separately installed `oscfg` CLI may send required
+  diagnostics under its own policy.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- Publish canonical MIT licensing plus clear community ownership,
+  contribution, best-effort support, and private vulnerability-reporting
+  guidance, with structured issue and pull-request templates.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88),
+  [#91](https://github.com/Azure/ConfigForge/pull/91))
+- Refresh nine README screenshots with reviewed synthetic Industry Benchmark
+  content; no licensed CIS benchmark data or screenshot tooling is added.
+  ([#89](https://github.com/Azure/ConfigForge/pull/89))
 
 ### Security
 
-- **Updated dev-only `brace-expansion` 5.x to 5.0.8.** This addresses
-  GHSA-mh99-v99m-4gvg / CVE-2026-14257 and resolves Dependabot alert #53.
+- Update dev-only `brace-expansion` 5.x to 5.0.8 to address
+  GHSA-mh99-v99m-4gvg / CVE-2026-14257 and resolve Dependabot alert #53; this
+  dependency is not bundled with the desktop app.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
 
 ## [0.3.93] - 2026-07-25
 
@@ -42,8 +62,8 @@
 
 ## [0.3.93-author.2] - 2026-07-25 (draft, unpublished)
 
-> Annotated tag `mac-v0.3.93-author.2` and the current
-> `mac-author-build` head resolve to
+> Annotated tag `mac-v0.3.93-author.2` resolved to the then-current
+> `mac-author-build` head at
 > `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The matching GitHub release
 > contains five verified assets but remains a draft and is unpublished.
 > Workflow run
diff --git a/INSTALL.md b/INSTALL.md
index d633930..ec8f11d 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -8,10 +8,11 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with tag `mac-v0.3.93-author.2`; its GitHub release
-exists with five verified assets but is intentionally a draft and is not
-published. The Full-edition package version on `main` is `0.3.93`.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -127,13 +128,11 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The `mac-v0.3.93-author.2` tag and matching GitHub release exist. The five
-verified assets are attached to that release, but it remains a draft and is
-not available from the public
+The current macOS Author tagged source is `mac-v0.3.94-author.1`. Its matching
+GitHub release is a draft and is not available from the public
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-page until a maintainer publishes it. Maintainers with draft access can test
-the assets now. Other users can build the tagged source by following the
-instructions in the
+page until a maintainer publishes it. Users can build the tagged source by
+following the instructions in the
 [Azure/ConfigForge repository](https://github.com/Azure/ConfigForge).
 
 The app is unsigned and not notarized. Copy **ConfigForge Author.app** to
diff --git a/README.md b/README.md
index 6cd45f9..c650d76 100644
--- a/README.md
+++ b/README.md
@@ -6,27 +6,11 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with tag `mac-v0.3.93-author.2`; its GitHub release
-exists with five verified assets but is intentionally a draft and is not
-published. The tag resolves to the current `mac-author-build` head at
-`c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The Full-edition package version
-on `main` is `0.3.93`.
-PR [#75](https://github.com/Azure/ConfigForge/pull/75) restored macOS
-authoring parity; PR [#76](https://github.com/Azure/ConfigForge/pull/76) is
-merged on `main`, and PR
-[#77](https://github.com/Azure/ConfigForge/pull/77) ports that navigation
-series to `mac-author-build`. PR
-[#79](https://github.com/Azure/ConfigForge/pull/79) finalizes the current
-documentation and immutable-tag release tooling; PR
-[#80](https://github.com/Azure/ConfigForge/pull/80) merges the tagged release
-branch. PR [#83](https://github.com/Azure/ConfigForge/pull/83) ports the
-standalone Windows Server 2025 audit repairs to the macOS line, and PR
-[#84](https://github.com/Azure/ConfigForge/pull/84) prepares the current
-author.2 release.
-Tag-pinned workflow run
-[#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
-completed successfully. The release remains unpublished.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 ## What it looks like
 
@@ -187,7 +171,8 @@ is not a universal binary.
 - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting.
 - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.).
 - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS
-  Author line is the draft, unpublished `0.3.93-author.2` release.
+  Author tagged source is `mac-v0.3.94-author.1`; its matching release is a
+  draft and unpublished.
 - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for
   Quick Start, User Guide, Architecture, API Reference, and Operations. No
   Azure-hosted Pages URL is documented until its public destination is
@@ -213,9 +198,11 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.93-author.2** (current macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. |
+| **0.3.94** (current Windows/Linux tagged source; draft unpublished) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 |
+| **0.3.94-author.1** (current macOS tagged source; draft unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations |
+| **0.3.93-author.2** (prior macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. |
 | **0.3.93-author.1** (prior macOS draft, unpublished) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77; PR #79 finalized documentation and immutable-tag release tooling, and PR #80 merged the tagged release branch. Workflow run #30176765724 verified all five assets. |
-| **0.3.93** (latest tagged Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
+| **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
 | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities |
 | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values |
 | **0.3.90** | Prevents Baseline Detail footer collisions and keeps long multi-value Visual rows inside their table columns |
diff --git a/SECURITY.md b/SECURITY.md
index ea51e50..11b5064 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,12 +2,12 @@
 
 ## Supported versions
 
-Security fixes are evaluated for the current tagged release lines.
+Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.93` | Supported |
-| macOS Author edition | `mac-v0.3.93-author.2` | Supported tagged source; release remains a draft |
+| Full edition for Windows and Linux | `v0.3.94` | Supported tagged source; release remains a draft |
+| macOS Author edition | `mac-v0.3.94-author.1` | Supported tagged source; release remains a draft |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope
diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md
index 0efbac9..0d8e958 100644
--- a/apps/desktop/PACKAGING.md
+++ b/apps/desktop/PACKAGING.md
@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.93:** the release pipeline generates a
+> **Current through v0.3.94:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and
diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md
index f950fc1..62e7272 100644
--- a/apps/desktop/build/release-notes-author.md
+++ b/apps/desktop/build/release-notes-author.md
@@ -1,37 +1,51 @@
-# ConfigForge Author 0.3.93-author.2 - macOS
-
-> **Release state: draft and unpublished.** Annotated tag
-> `mac-v0.3.93-author.2` and the current `mac-author-build` head resolve to
-> `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The matching GitHub release
-> exists and contains five verified assets. Workflow run
-> [#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
-> completed successfully. The release must remain a draft unless a maintainer
-> separately approves publication. PR
-> [#83](https://github.com/Azure/ConfigForge/pull/83) ports the reviewed
-> Windows Server 2025 baseline repairs to `mac-author-build`, and PR
-> [#84](https://github.com/Azure/ConfigForge/pull/84) prepares the immutable
-> author.2 tag and package metadata.
-
-This release carries forward the authoring parity and nested multi-value
-keyboard editing from author.1. It also repairs the standalone Windows Server
-2025 baselines and the matching analysis identities. It remains author-only:
-device deployment, audit, enforcement, revert, elevation, OSConfig CLI health,
-and device audit-results storage are not included.
-
-## Windows Server 2025 baseline repairs
-
-- Replace failing array-valued Policy CSP settings with supported Registry,
-  AccountPolicy, AuditPolicy, and UserRightsAssignment providers.
-- Keep ten supported residual CSP settings in each standalone profile.
-- Correct the Domain Controller, Member Server, and Workgroup Member resource
-  counts to 321, 320, and 296.
-- Remove Source links from the three corrected baselines because the local
-  manifests now differ materially from their upstream files.
-- Resolve Increase scheduling priority, password complexity, and guest account
-  status in Benchmark Mapping without bundling licensed CIS data.
-- Use `properties.name`, with legacy `properties.policy` fallback, to keep
-  User Rights Assignment and Account Policy settings distinct in analysis and
-  Matrix Diff.
+# ConfigForge Author 0.3.94-author.1 - macOS
+
+> **Release state: draft and unpublished.**
+> `mac-v0.3.94-author.1` is the current macOS Author tagged source. The
+> matching GitHub release remains a draft until a maintainer approves
+> publication. Current GitHub checks and release metadata are the authority
+> for build and asset status.
+
+This release improves public-source readiness, refreshes shared documentation
+screenshots with synthetic benchmark content, and updates one dev-only
+dependency. It remains author-only: device deployment, device audit,
+enforcement, revert, elevation, OSConfig CLI health, and audit-results storage
+are not included.
+
+## Security update
+
+- Update dev-only `brace-expansion` 5.x from 5.0.7 to 5.0.8 for
+  [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg)
+  and CVE-2026-14257.
+- Preserve the exact public npm registry URL and integrity metadata reviewed
+  in PR [#86](https://github.com/Azure/ConfigForge/pull/86).
+- Keep every other macOS dependency and version stream unchanged. The updated
+  package is used by build and test tooling and is not bundled in the app.
+
+## Public-source readiness
+
+- Align licensing, privacy, security reporting, best-effort support,
+  contribution templates, repository ownership, and release guidance through
+  PRs [#90](https://github.com/Azure/ConfigForge/pull/90),
+  [#92](https://github.com/Azure/ConfigForge/pull/92), and
+  [#93](https://github.com/Azure/ConfigForge/pull/93).
+- Run a dependency-free public-package guard before packaging. The guard
+  rejects licensed CIS assets, unsafe CIS builder filters, and non-public npm
+  registry URLs.
+- Keep maintainer, branch, and release guidance in existing documentation.
+  This release does not add a standalone governance file.
+
+## Synthetic documentation screenshots
+
+- Port the exact nine reviewed screenshot PNGs from PR
+  [#94](https://github.com/Azure/ConfigForge/pull/94).
+- Use synthetic **Industry Benchmark** content in Benchmark Mapping and CIS
+  Diff examples.
+- Commit no CIS benchmark data, generated benchmark catalog, or screenshot
+  tooling.
+
+The screenshots are shared documentation assets. They do not change the
+macOS Author capability set.
 
 ## Authoring parity
 
@@ -63,14 +77,11 @@ macOS author line:
 - Invalid drafts retain focus and do not mutate the manifest.
 - Shift+Enter remains a newline for structured nested values.
 
-The author.1 preparation tree passed 1,598 Vitest tests in 117 files, 79
-focused Manifest Editor tests, both isolated Loop Playwright scenarios, lint
-with zero errors, full and author-flavor desktop builds, locale review with
-zero placeholder/glossary/plural issues, and a clean production audit. The
-author.2 preparation passed PR check run
-[#30186333208](https://github.com/Azure/ConfigForge/actions/runs/30186333208).
-The tag-pinned macOS workflow also passed the install, production audit, build,
-SBOM, checksum, and upload gates and verified all five release assets.
+Dependency-free local validation covers package and lockfile JSON, the
+public-package guard and its Node.js tests, documentation references,
+forbidden files, public registry URLs, and Git whitespace checks. GitHub CI is
+the authority for npm-backed lint, Vitest, build, audit, Playwright, and
+release-asset status.
 
 ## Included authoring capabilities
 
@@ -116,23 +127,23 @@ If that command reports a permission error, use:
 sudo xattr -rd com.apple.quarantine "/Applications/ConfigForge Author.app"
 ```
 
-## Verified draft release assets
+## Draft release asset contract
 
-The draft release contains exactly these five assets:
+The release workflow is configured to upload exactly:
 
-1. `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
-Verify the DMG, blockmap, and update metadata against the SHA-256 manifest.
+Use the draft GitHub release and current workflow checks to confirm actual
+upload and verification status.
 
 ## Contributors
 
-Historical implementation attribution for PRs #75 through #77, release
-documentation/tooling in PRs #79 and #80, and author.2 repairs in PRs #83 and
-#84: @ABMFST and Copilot.
+PRs #86, #90, #92, #93, and #94 were contributed by
+[@ABMFST](https://github.com/ABMFST) with Copilot collaboration.
 
 ## Reporting issues
 
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index a06a252..37e152e 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.93",
+  "version": "0.3.94",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index 0ce6d7a..2bfff3a 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -4,10 +4,28 @@ A concise release history for ConfigForge. Newer entries use their release
 tags and state publication status explicitly; older entries summarize the
 foundational work by theme.
 
-## Unreleased
-
-- **Security:** Updated dev-only `brace-expansion` 5.x to 5.0.8 for
-  GHSA-mh99-v99m-4gvg / CVE-2026-14257, resolving Dependabot alert #53.
+## v0.3.94 — 2026-07-26
+
+- **Public packaging:** Exclude CIS benchmark source data from public
+  installers while keeping Benchmark Mapping and CIS Diff available for
+  user-supplied benchmark files.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- **Privacy:** Clarify that ConfigForge sends no product telemetry, update
+  checks contact GitHub Releases, and separately installed `oscfg` may send
+  required diagnostics under its own policy.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- **Project policy:** Publish canonical MIT licensing, community ownership,
+  contribution, best-effort support, and private security-reporting guidance
+  with structured issue and pull-request templates.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88),
+  [#91](https://github.com/Azure/ConfigForge/pull/91))
+- **Documentation:** Refresh nine README screenshots with reviewed synthetic
+  Industry Benchmark content while adding no licensed CIS benchmark data or
+  screenshot tooling. ([#89](https://github.com/Azure/ConfigForge/pull/89))
+- **Security:** Update dev-only `brace-expansion` 5.x to 5.0.8 for
+  GHSA-mh99-v99m-4gvg / CVE-2026-14257, resolving Dependabot alert #53; this
+  dependency is not bundled with the desktop app.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
 
 ## v0.3.93 — 2026-07-25
 
@@ -32,8 +50,8 @@ foundational work by theme.
 
 ## macOS Author mac-v0.3.93-author.2 — 2026-07-25 (draft, unpublished)
 
-Annotated tag `mac-v0.3.93-author.2` and the current `mac-author-build` head
-resolve to `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The matching GitHub
+Annotated tag `mac-v0.3.93-author.2` resolved to the then-current
+`mac-author-build` head at `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The matching GitHub
 release contains five verified assets but remains a draft and is unpublished.
 Workflow run
 [#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
diff --git a/docs/src/introduction.md b/docs/src/introduction.md
index 5f6875f..8ad2684 100644
--- a/docs/src/introduction.md
+++ b/docs/src/introduction.md
@@ -21,13 +21,11 @@ application** with two editions:
   and elevation methods under `system`) are intentionally omitted. Authors
   deploy later from the Full edition on Windows or Linux.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with annotated tag
-`mac-v0.3.93-author.2`. The tag resolves to the current
-`mac-author-build` head at
-`c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. Its GitHub release exists with
-five verified assets but remains a draft and is unpublished. The package
-version on `main` is `0.3.93`.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 If you've ever maintained a security baseline by editing GPO templates, exporting Defender for Endpoint settings to a spreadsheet, or copy-pasting between half a dozen runbooks - this app is for you.
 
diff --git a/docs/src/operations/ci.md b/docs/src/operations/ci.md
index b60698a..872c602 100644
--- a/docs/src/operations/ci.md
+++ b/docs/src/operations/ci.md
@@ -13,7 +13,7 @@ ConfigForge uses GitHub Actions from `.github/workflows/`. The product is an Ele
 
 The Win/Linux Release workflow intentionally ignores hyphen-suffix tags
 (`!v*-*`). macOS Author releases use separate tags such as
-`mac-v0.3.93-author.2`; dispatch the protected `main` workflow definition
+`mac-v0.3.94-author.1`; dispatch the protected `main` workflow definition
 manually and let its checkout step select the immutable macOS tag.
 
 ## What `pr-check.yml` runs
@@ -32,9 +32,12 @@ files; main PR #76 then passed its full suite plus 32 focused nested-navigation
 tests. Mac port PR #77 passed 79 focused tests and two isolated Playwright
 scenarios. The final `0.3.93-author.1` preparation tree passed 1,598 Vitest
 tests in 117 files, and its tag-pinned packaging run completed successfully.
-The current `0.3.93-author.2` preparation passed PR check run
+The prior `0.3.93-author.2` preparation passed PR check run
 [#30186333208](https://github.com/Azure/ConfigForge/actions/runs/30186333208),
 and its tag-pinned packaging run also completed successfully.
+The current macOS Author tagged source is `mac-v0.3.94-author.1`, with an
+unpublished draft release. Use its current GitHub checks and release metadata
+as the authority rather than pinning a workflow run in this document.
 
 Caching covers npm, Electron binaries, electron-builder, and Playwright browser downloads. Concurrency cancels stale PR runs on the same branch.
 
@@ -68,7 +71,7 @@ the immutable macOS tag:
 gh workflow run "Release (macOS author)" \
   --repo Azure/ConfigForge \
   --ref main \
-  -f release_tag=mac-v0.3.93-author.2
+  -f release_tag=mac-v0.3.94-author.1
 ```
 
 The target draft release and tag must already exist. The workflow loads its
@@ -76,19 +79,21 @@ definition from `main`, checks out `release_tag`, verifies that
 `HEAD` resolves to the tag, checks that tagged tree with the dependency-free
 public-asset guard from protected `main`, then builds with
 `electron-builder.author.yml`.
-It uploads exactly these assets:
+The `mac-v0.3.94-author.1` release contract expects exactly these assets:
 
-1. `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
 The workflow refuses a published release and never publishes automatically.
-For `mac-v0.3.93-author.2`, workflow run
+For the prior `mac-v0.3.93-author.2` release, workflow run
 [#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
 passed every gate and verified these five assets. The matching GitHub release
-exists but remains a draft and is unpublished.
+remains a draft and is unpublished. For `mac-v0.3.94-author.1`, use the
+current GitHub checks and draft release as the authority for actual build and
+asset status.
 
 ## Linux runner notes
 
diff --git a/docs/src/quick-start/install-run.md b/docs/src/quick-start/install-run.md
index 76d81a0..da6ef42 100644
--- a/docs/src/quick-start/install-run.md
+++ b/docs/src/quick-start/install-run.md
@@ -8,11 +8,12 @@ Benchmark Mapping, history, rationale, and Audit Pack export while omitting
 device operations. The native `oscfg` CLI is **not bundled** and is **not
 required** for authoring in either edition.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with annotated tag
-`mac-v0.3.93-author.2`. Its GitHub release exists with five verified assets
-but remains a draft and is unpublished. Public downloads are unavailable
-until a maintainer publishes it. The package version on `main` is `0.3.93`.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. Public downloads remain unavailable until a maintainer publishes
+the releases. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 ## Prerequisites
 
@@ -30,10 +31,9 @@ cd ConfigForge
 ```
 
 > **Note:** `main` is the active Windows/Linux Full-edition line. On an Apple
-> Silicon Mac (M1 or later), maintainers with draft-release access can use the
-> verified package; other users can build the `mac-v0.3.93-author.2` tag from
-> source while the release remains unpublished. Intel Macs and universal
-> binaries are not supported.
+> Silicon Mac (M1 or later), users can build the
+> `mac-v0.3.94-author.1` tagged source while the matching release remains
+> unpublished. Intel Macs and universal binaries are not supported.
 > macOS release builds are unsigned by design. Clear quarantine after
 > copying the app into Applications:
 >
diff --git a/package-lock.json b/package-lock.json
index 16b5080..e9dbc51 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "configforge",
-  "version": "0.3.93",
+  "version": "0.3.94",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "configforge",
-      "version": "0.3.93",
+      "version": "0.3.94",
       "license": "MIT",
       "workspaces": [
         "apps/*",
@@ -33,7 +33,7 @@
     },
     "apps/desktop": {
       "name": "@configforge/desktop",
-      "version": "0.3.93",
+      "version": "0.3.94",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-components": "^9.73.8",
diff --git a/package.json b/package.json
index f75d2d6..1911fd1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "configforge",
-  "version": "0.3.93",
+  "version": "0.3.94",
   "private": true,
   "license": "MIT",
   "description": "ConfigForge \u2014 Cross-platform Electron desktop app for OSConfig security baseline authoring",
diff --git a/scripts/release-metadata.test.mjs b/scripts/release-metadata.test.mjs
index c283917..4695799 100644
--- a/scripts/release-metadata.test.mjs
+++ b/scripts/release-metadata.test.mjs
@@ -196,8 +196,8 @@ describe('public release metadata', () => {
     expect(contributing).toContain('creates immutable release tags and draft');
     expect(support).toContain('The current repository maintainer is');
     expect(readme).toContain('for ownership, active-branch, review, release, and cherry-pick guidance');
-    expect(security).toContain('v0.3.93');
-    expect(security).toContain('mac-v0.3.93-author.2');
+    expect(security).toContain('v0.3.94');
+    expect(security).toContain('mac-v0.3.94-author.1');
     expect(security).toContain('Microsoft Security Response Center');
     expect(security).toContain('Microsoft OSConfig project');
     expect(support).toContain('best-effort basis');
diff --git a/scripts/ship-mac.ps1 b/scripts/ship-mac.ps1
index f35f192..d89285c 100644
--- a/scripts/ship-mac.ps1
+++ b/scripts/ship-mac.ps1
@@ -21,7 +21,7 @@
     because we forgot step 1 on an earlier author release and had to retry).
 
 .PARAMETER Tag
-    The release tag, e.g. "mac-v0.3.93-author.2". Must already exist as a
+    The release tag, e.g. "mac-v0.3.94-author.1". Must already exist as a
     git tag on the mac-author-build branch and be pushed to origin.
 
 .PARAMETER ReleaseTitle
@@ -35,10 +35,10 @@
     Optional path to a release-notes file. Cannot be combined with -Notes.
 
 .EXAMPLE
-    .\scripts\ship-mac.ps1 -Tag mac-v0.3.93-author.2
+    .\scripts\ship-mac.ps1 -Tag mac-v0.3.94-author.1
 
 .EXAMPLE
-    .\scripts\ship-mac.ps1 -Tag mac-v0.3.93-author.2 -NotesFile .\apps\desktop\build\release-notes-author.md
+    .\scripts\ship-mac.ps1 -Tag mac-v0.3.94-author.1 -NotesFile .\apps\desktop\build\release-notes-author.md
 #>
 
 [CmdletBinding()]

From ce7a178cbaf98451a4b6474958b1bac41a764f2d Mon Sep 17 00:00:00 2001
From: Amir Bredy <amirbredy@microsoft.com>
Date: Sun, 26 Jul 2026 19:19:15 -0700
Subject: [PATCH 2/4] docs(release): add mac v0.3.94 notes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b
---
 CHANGELOG.md          | 16 ++++++++++++++++
 docs/src/changelog.md | 29 +++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 54891a7..4f82e19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,22 @@
   dependency is not bundled with the desktop app.
   ([#86](https://github.com/Azure/ConfigForge/pull/86))
 
+## macOS Author mac-v0.3.94-author.1 - 2026-07-26 (draft, unpublished)
+
+- Align public licensing, privacy, security, support, contribution, packaging,
+  and ownership guidance while preserving the author-only capability boundary.
+  ([#90](https://github.com/Azure/ConfigForge/pull/90),
+  [#92](https://github.com/Azure/ConfigForge/pull/92),
+  [#93](https://github.com/Azure/ConfigForge/pull/93))
+- Refresh the same nine synthetic-content documentation screenshots used by
+  the Full edition without adding CIS data or screenshot tooling.
+  ([#94](https://github.com/Azure/ConfigForge/pull/94))
+- Update dev-only `brace-expansion` 5.x to 5.0.8 with the reviewed public npm
+  registry metadata. The dependency is not bundled with the application.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
+- Keep device deployment, audit, enforcement, revert, elevation, health, and
+  audit-results storage excluded from the macOS Author edition.
+
 ## [0.3.93] - 2026-07-25
 
 ### Added
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index 2bfff3a..b41d206 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -27,6 +27,35 @@ foundational work by theme.
   dependency is not bundled with the desktop app.
   ([#86](https://github.com/Azure/ConfigForge/pull/86))
 
+## [0.3.94-author.1] - 2026-07-26 (draft, unpublished)
+
+> `mac-v0.3.94-author.1` is the current macOS Author tagged source. Its
+> matching GitHub release remains an unpublished draft. The author-only
+> capability boundary is unchanged.
+
+### Changed
+
+- Align public licensing, privacy, security, support, contribution, packaging,
+  and ownership guidance while preserving the author-only capability boundary.
+  ([#90](https://github.com/Azure/ConfigForge/pull/90),
+  [#92](https://github.com/Azure/ConfigForge/pull/92),
+  [#93](https://github.com/Azure/ConfigForge/pull/93))
+- Refresh the same nine synthetic-content documentation screenshots used by
+  the Full edition without adding CIS data or screenshot tooling.
+  ([#94](https://github.com/Azure/ConfigForge/pull/94))
+
+### Security
+
+- Update dev-only `brace-expansion` 5.x to 5.0.8 with the reviewed public npm
+  registry URL and integrity metadata. The dependency is not bundled with the
+  macOS Author application.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
+
+### Unchanged
+
+- Device deployment, audit, enforcement, revert, elevation, health, and
+  audit-results storage remain excluded from the macOS Author edition.
+
 ## v0.3.93 — 2026-07-25
 
 - Add nested multi-value keyboard navigation: Enter saves and moves down,

From 11368fb38b6049437920fb9107da5dd960443f01 Mon Sep 17 00:00:00 2001
From: Amir Bredy <amirbredy@microsoft.com>
Date: Sun, 26 Jul 2026 19:29:00 -0700
Subject: [PATCH 3/4] docs(release): align mac changelog heading

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b
---
 docs/src/changelog.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index b41d206..dd16ec2 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -27,7 +27,7 @@ foundational work by theme.
   dependency is not bundled with the desktop app.
   ([#86](https://github.com/Azure/ConfigForge/pull/86))
 
-## [0.3.94-author.1] - 2026-07-26 (draft, unpublished)
+## macOS Author mac-v0.3.94-author.1 — 2026-07-26 (draft, unpublished)
 
 > `mac-v0.3.94-author.1` is the current macOS Author tagged source. Its
 > matching GitHub release remains an unpublished draft. The author-only

From d2216cbe34a6cb39744842ae646b802c5c0295f3 Mon Sep 17 00:00:00 2001
From: Amir Bredy <amirbredy@microsoft.com>
Date: Sun, 26 Jul 2026 19:54:50 -0700
Subject: [PATCH 4/4] docs(release): state v0.3.94 publication status

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0836ff7c-06f5-4530-97fb-d69522abc79b
---
 CHANGELOG.md          | 3 +++
 docs/src/changelog.md | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f82e19..09764f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## [0.3.94] - 2026-07-26
 
+> `v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub
+> release remains a draft and is unpublished.
+
 ### Changed
 
 - Exclude CIS benchmark source data from public installers; Benchmark Mapping
diff --git a/docs/src/changelog.md b/docs/src/changelog.md
index dd16ec2..8da80ea 100644
--- a/docs/src/changelog.md
+++ b/docs/src/changelog.md
@@ -6,6 +6,10 @@ foundational work by theme.
 
 ## v0.3.94 — 2026-07-26
 
+`v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub
+release remains a draft and is unpublished; this entry does not indicate
+publication.
+
 - **Public packaging:** Exclude CIS benchmark source data from public
   installers while keeping Benchmark Mapping and CIS Diff available for
   user-supplied benchmark files.