docs: address PR review feedback from Zahnentferner

- brand/Brand.md: logo is a 4D hypercube (tesseract) projection, not an octahedron.
- agent.md: "vendored" -> "vendor".
- Contributors.md: drop the leftover TODO row.
- SECURITY.md: Supported Versions now reflects the tag-triggered release workflow (SemVer vX.Y.Z tags, pyproject.toml version) instead of claiming no releases exist.

Also updates docs/BestPracticesChecklist.md's Change Control section to Met now that tagged SemVer releases with auto-generated release notes exist. Score: 39/49 (80%).

Author: SIDDHANTCOOKIE

Contributors.md

@@ -13,4 +13,3 @@ are made under the terms of the [Developer Certificate of Origin](DCO.md).
 | -------------------------------- | ------------------ | ------------------ | ---------------------------- |
 | Bruno Woltzenlogel Paleo         | @Zahnentferner     | @b.wp              | zahnentferner@gmail.com      |
 | Siddhant                         | @siddhant          | @siddhantcookie     | siddhantkk27@gmail.com       |
-| TODO                             | TODO               | TODO               | TODO                         |

SECURITY.md

@@ -2,7 +2,13 @@
 
 ## Supported Versions
 
-MiniChain does not yet have tagged releases or a formal versioning scheme. Security fixes are applied to the latest commit on `main`, which is the only version supported.
+MiniChain is released via tagged versions (`vX.Y.Z`, [SemVer](https://semver.org)), built and published automatically by [.github/workflows/release.yml](.github/workflows/release.yml) whenever a matching tag is pushed. While the project is pre-1.0 (currently `0.1.0-beta`), only the latest tagged release and `main` receive security fixes — older tags are not backported to.
+
+| Version         | Supported          |
+| ---------------- | -------------------- |
+| Latest tagged release | ✅ |
+| `main` (unreleased) | ✅ |
+| Older tagged releases | ❌ |
 
 ## Reporting a Vulnerability
 
@@ -36,7 +42,7 @@ Given MiniChain's goals — education, research, and innovation on a minimal blo
 - P2P protocol issues that allow a peer to crash, partition, or deny service to a node (see `minichain/p2p.py`).
 - JSON-RPC issues that allow unauthorized access to node data or funds (see `minichain/rpc.py`).
 
-Out of scope: issues in vendored third-party binaries (`bore_bin/`, `bore.zip`) should be reported upstream to their respective projects.
+Out of scope: issues in vendor third-party binaries (`bore_bin/`, `bore.zip`) should be reported upstream to their respective projects.
 
 ## Questions
 

agent.md

@@ -27,7 +27,7 @@ Python 3.10+, no web framework. Core libs: `pynacl` (Ed25519 signing), `trie` (M
 ## Boundaries
 
 - Never modify `genesis.json` or files under a node's `--datadir` (persisted chain/state data) as part of a code change.
-- `bore_bin/` and `bore.zip` are vendored binaries — do not edit or regenerate them by hand.
+- `bore_bin/` and `bore.zip` are vendor binaries — do not edit or regenerate them by hand.
 - Don't hand-edit the coverage badge/table in `README.md`; it's generated by CI.
 
 ## Git Workflow

brand/Brand.md

@@ -4,7 +4,7 @@ MiniChain is a minimal, fully functional blockchain implemented in Python, built
 
 ## Logo
 
-MiniChain's mark is an octahedron-style wireframe: eight triangular edges radiating from a central point, each vertex marked with a glowing node. It's meant to evoke a network graph — nodes connected by edges — rather than a literal chain, which fits a project about distributed state rather than links in a chain.
+MiniChain's mark is a 4D hypercube (tesseract) projected onto 2 dimensions: eight overlapping edge-paths radiating from a central point, each vertex marked with a glowing node. It's meant to evoke a network graph — nodes connected by edges — rather than a literal chain, which fits a project about distributed state rather than links in a chain.
 
 - [`logo.svg`](logo.svg) — the MiniChain mark, 330×330, transparent background. Use this as the primary logo wherever MiniChain is referenced on its own.
 - [`org-logo.svg`](org-logo.svg) — the Stability Nexus organization mark, 500×500. Use alongside the MiniChain logo when representing the org/project pairing (as in the [README](../README.md) header), never as a substitute for it.
@@ -13,7 +13,7 @@ MiniChain's mark is an octahedron-style wireframe: eight triangular edges radiat
 
 - Keep clear space around the logo equal to at least the radius of one vertex node.
 - Do not recolor the gradient — it is the identifying feature of the mark.
-- Do not stretch or skew; the mark is designed as a regular octahedron and should scale uniformly.
+- Do not stretch or skew; the projection's proportions are fixed and should scale uniformly.
 - Minimum display size: 32px, below which the vertex nodes become illegible.
 
 ## Favicons and Icons

docs/BestPracticesChecklist.md

@@ -28,12 +28,12 @@
 | Category           | Met | Total | Status |
 |--------------------|-----|-------|--------|
 | Basics             | 8   | 8     | 🟢     |
-| Change Control     | 3   | 6     | 🟡     |
+| Change Control     | 6   | 6     | 🟢     |
 | Reporting          | 6   | 8     | 🟡     |
 | Quality            | 7   | 11     | 🟡     |
 | Security           | 9   | 9     | 🟢     |
 | Analysis           | 3   | 7     | 🔴     |
-| **Total**          | **36** | **49** | **73%** |
+| **Total**          | **39** | **49** | **80%** |
 ---
 
 ## 🏗️ Basics
@@ -77,19 +77,19 @@
 
 ### Version Numbering
 
-- [ ] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0).
-  - *Evidence URL:* None — no tagged releases exist yet (`git tag` is empty).
+- [x] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0).
+  - *Evidence URL:* [pyproject.toml](../pyproject.toml) (`version = "0.1.0-beta"`), released via `vX.Y.Z` git tags per [.github/workflows/release.yml](../.github/workflows/release.yml).
 
-- [ ] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)*
-  - *Note:* No versioning scheme is in use yet; no `__version__`/package version found in the repo.
+- [x] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)*
+  - *Note:* Tags match `v[0-9]+.[0-9]+.[0-9]+*` (see [.github/workflows/release.yml](../.github/workflows/release.yml) trigger), SemVer-style.
 
-- [ ] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)*
-  - *Evidence URL:* None — repository has no tags.
+- [x] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)*
+  - *Evidence URL:* [.github/workflows/release.yml](../.github/workflows/release.yml) — release builds are tag-triggered.
 
 ### Release Notes
 
 - [x] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable.
-  - *Evidence URL:* `[x]` N/A — *Justification: project has not cut any releases yet; it is developed via continuous commits to `main`. Revisit once the first tagged release is planned.*
+  - *Evidence URL:* [.github/workflows/release.yml](../.github/workflows/release.yml) — `generate_release_notes: true` on the GitHub Release step.
 
 - [x] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release.
   - *Evidence URL:* `[x]` N/A — *Justification: no releases exist yet, and no publicly known CVEs affect the project.*
@@ -255,7 +255,7 @@
 - For `dynamic_analysis`: consider adversarial input testing as a form of dynamic analysis.
 
 ### MiniChain-Specific Notes
-- Biggest open gaps found by this pass: no linter in CI (blocks all three `warnings_*` items), and no static/dynamic analysis tooling (blocks all of Analysis except the N/A items). Tagging a first release would also unlock the Change Control items. [SECURITY.md](../SECURITY.md) was added, closing the `vulnerability_report_process`/`vulnerability_report_private` gaps.
+- Biggest open gaps found by this pass: no linter in CI (blocks all three `warnings_*` items), and no static/dynamic analysis tooling (blocks all of Analysis except the N/A items). [SECURITY.md](../SECURITY.md) was added, closing the `vulnerability_report_process`/`vulnerability_report_private` gaps, and the tag-triggered [release workflow](../.github/workflows/release.yml) closes the Change Control items.
 - `report_responses` / `enhancement_responses` need a manual pass over GitHub Issues history — not derivable from the repo contents.
 
 ---