chore: remove OSS audit from public docs and CI

.github/workflows/ci.yml

@@ -22,12 +22,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends zsh jq shellcheck
 
-      - name: Run OSS audit
-        shell: bash
-        env:
-          OSS_AUDIT_FORBIDDEN_REGEX: ${{ vars.OSS_AUDIT_FORBIDDEN_REGEX }}
-        run: scripts/oss-audit.sh
-
       - name: Validate shell syntax
         shell: bash
         run: |

.gitignore

@@ -1,6 +1,5 @@
 # Configuración local (paths, tokens, datos personales)
 local/env.zsh
-.oss-audit-denylist.local
 
 # macOS
 .DS_Store

CHANGELOG.md

@@ -5,7 +5,7 @@
 - Initial OSS-safe `cortex-dots` snapshot.
 - Generalized private paths and navigation defaults.
 - Removed custom font binary and private brand assets.
-- Added MIT license, security policy, third-party notices, release checklist, and OSS audit script.
+- Added MIT license, security policy, third-party notices, release checklist, and automated installer tests.
 
 ## 0.1.1 - 2026-07-04
 
@@ -17,11 +17,8 @@
 
 - `scripts/test-install.sh` — automated installer tests (copy, symlink, stale-opposite scenarios).
 - `scripts/check-agent-state.sh` — agent-state validator for release checklist.
-- `.oss-audit-denylist.local` — untracked personal denylist for OSS audit (one regex per line).
-- `OSS_AUDIT_FORBIDDEN_REGEX` CI variable support — configure repo-level denylist without committing.
+- Supply chain security rules — external tools must be pinned to specific versions, 15+ days old.
 
 ### Changed
 
-- OSS audit script — externalized forbidden identifiers to env var + local denylist; no longer hardcodes private terms.
-- CI — added installer integration tests step; passes `OSS_AUDIT_FORBIDDEN_REGEX` from repo vars.
-- `.gitignore` — added `.oss-audit-denylist.local`.
+- CI — added installer integration tests step.

CONTRIBUTING.md

@@ -28,9 +28,28 @@ All changes to `main` require maintainer review. This is especially important fo
 - Do not commit secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
 - Put local/private values in `~/.config/cortex-dots/local/env.zsh`.
 - Keep examples generic and placeholder-based.
-- Run `scripts/oss-audit.sh` before opening a PR.
 - Run the validation commands listed in `README.md` when touching scripts or config formats.
 
+## Supply Chain Security
+
+Any external tool, CLI, or dependency installed by `install.sh` or referenced in scripts must be pinned to a specific version. Do not use `latest`, `^ SemVer` ranges, or unpinned references in installation commands. Versions must be at least 15 days old before adoption — supply chain attacks typically target newly published releases.
+
+```bash
+# Good — pinned version, 15+ days old
+curl -fsSL https://starship.rs/install.sh | sh -s -- -b "$HOME/.local/bin" -y --commit abc123
+
+# Good — pinned package manager version
+npm install -g some-cli@2.4.1
+
+# Bad — no version pinning
+curl -fsSL https://example.com/install | bash
+
+# Bad — latest tag
+npm install -g some-cli@latest
+```
+
+For GitHub Actions in workflows, always use explicit commit SHAs (`@commit-sha`) or pinned minor versions (`@v4`). Avoid `${{ github.sha }}` or floating tags in production workflows.
+
 ## Pull Request Expectations
 
 Every PR should include:

README.md

@@ -118,22 +118,9 @@ Transparency depends on your Linux compositor/window manager. Shaders are
 opt-in in `ghostty/config`; uncomment one `custom-shader` line only after
 confirming your GPU/driver handles it well.
 
-## OSS Audit
-
-Run before publishing or packaging:
-
-```bash
-scripts/oss-audit.sh
-```
-
-The audit scans tracked files only and fails on configured private identifiers, private paths, and email-shaped strings.
-Set `OSS_AUDIT_FORBIDDEN_REGEX` or create an untracked `.oss-audit-denylist.local` file with one regex per line to add private denylist terms locally.
-For CI, configure the repository variable `OSS_AUDIT_FORBIDDEN_REGEX` with private denylist terms instead of committing them.
-
 ## Validation
 
 ```bash
-scripts/oss-audit.sh
 scripts/test-install.sh
 scripts/test-install.sh --symlink
 scripts/test-install.sh --seed-stale-opposite