Professionalize the repository and cut v1.0.0

Splits the detection engine out of the UI, puts a test suite and CI behind
it, adds the community-health files the project was missing, and regenerates
the README figures from a script instead of by hand.

Engine/UI split
- detector.js: the heuristics, evidence and scoring, as pure functions with
  no DOM, storage or network. A guarded CommonJS footer means Node can
  require() it while the browser keeps loading a plain script, so there is
  still no build step.
- script.js is now only the UI layer. aggregate() no longer reaches into the
  DOM through a default argument; readThresholds() reads the inputs and the
  engine's normaliser stays pure.

Tests (217 assertions, zero dependencies, Node's built-in runner)
- Every heuristic twice: a fixture it must fire on and one it must stay
  quiet on. A registered heuristic with no fixture pair fails the build.
- Scoring arithmetic, verdict band edges, threshold normalisation, the
  shared string helpers, and degenerate input.
- The gallery checked against the live engine, including the
  expectedSignals self-test that examples.js has always advertised and
  nothing ever ran.
- The repository itself: version consistency across package.json, the
  masthead and the changelog; docs links resolving; no orphaned or missing
  screenshot; no third-party origin in the markup.

Bugs the tests found
- Threshold normalisation clamped to 0..100 before ordering mixed below ai,
  so ordering could push a value back out of range: Mixed>=100 with AI>=0
  gave { mixed: -1, ai: 101 }, and with nothing able to reach 101 every
  snippet came back "Mixed signals". Both ends now stay in range.
- A line beginning with * counted as a comment, so an operator continuation
  ("const area = width" / "    * height;") read as a comment and skewed both
  comment-density signals. Block comments are now tracked by scanning for
  delimiters anywhere on the line, including mid-line opens, which is what
  let the * shortcut go. JSDoc bodies are still counted.
- A raw NUL byte in the evidence de-duplication key made script.js register
  as binary to grep, file(1) and most editors.
- Three gallery annotations cited signals the detector does not fire on
  those samples, one of them claiming "30+ lines of code" for a sample with
  21 non-empty lines, below that signal's 25-line gate. Annotations can now
  carry scored:false to describe a tell the engine doesn't score; the card
  renders a "not scored" marker so a reader isn't told otherwise.

Tooling
- scripts/screenshots.mjs regenerates every README figure at a fixed
  viewport with fonts loaded, transitions frozen and localStorage cleared.
- scripts/browser.mjs resolves a Chromium instead of insisting on the exact
  revision Playwright pins, which two scripts that only read colours and
  take pictures do not need.
- CI: the suite on Node 20/22/24 with no install, the WCAG AA contrast
  audit in both themes, and a docs/parse hygiene job.

Docs
- LICENSE, which the README has claimed for a while with no file behind it.
- CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, CHANGELOG, .editorconfig, issue
  and PR templates, Dependabot.
- README rebuilt with the regenerated figures and a "Known limitations"
  section recording two measured calibration gaps: the count-gated signals
  make any large file look generated (this repo's own script.js scores
  40.3%, above six of eight known-generated gallery samples), and nothing
  in the gallery reaches the default 50% AI threshold. Both are documented
  rather than tuned, since changing either moves every verdict.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MTEQELhDNNSBMGL9eyZqFk

Author: claude

.editorconfig

@@ -0,0 +1,27 @@
+# Indentation is a signal this project literally scores, so keeping it
+# consistent is not just tidiness — a stray tab changes what the detector says
+# about its own source.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+# The gallery data is dense and deeply nested; 2 keeps entries readable.
+[examples.js]
+indent_size = 2
+
+[*.{json,yml,yaml}]
+indent_size = 2
+
+[*.md]
+# Two trailing spaces are a hard line break in Markdown.
+trim_trailing_whitespace = false
+
+[LICENSE]
+indent_style = unset
+indent_size = unset

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,67 @@
+name: Bug report
+description: Something in the app is broken — the UI, the editor, the gallery, the keyboard handling
+labels: ['bug']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a wrong *verdict*, use the "False positive or false negative"
+        template instead — those are calibration, not breakage.
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What happens
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Open index.html
+        2. Pick "Over-commented FizzBuzz" from the example picker
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+
+  - type: input
+    id: browser
+    attributes:
+      label: Browser and version
+      placeholder: 'Firefox 141 / Safari 18.2 / Chrome 139'
+    validations:
+      required: true
+
+  - type: dropdown
+    id: theme
+    attributes:
+      label: Theme
+      options:
+        - Light
+        - Dark
+        - Both
+        - Not relevant
+
+  - type: dropdown
+    id: served
+    attributes:
+      label: How were you running it?
+      options:
+        - Opened index.html from the filesystem
+        - Served over http (npm run serve, or another static server)
+        - A deployed copy
+
+  - type: textarea
+    id: console
+    attributes:
+      label: Anything in the browser console
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Gabriel-Dalton/AI-Code-Detector/security/advisories/new
+    about: Report privately via a security advisory, not a public issue. See SECURITY.md.
+  - name: Contributing guide
+    url: https://github.com/Gabriel-Dalton/AI-Code-Detector/blob/main/CONTRIBUTING.md
+    about: How the code is laid out, and what adding a heuristic or a gallery sample involves.

.github/ISSUE_TEMPLATE/false-verdict.yml

@@ -0,0 +1,64 @@
+name: False positive or false negative
+description: The detector got a verdict wrong on a snippet
+title: 'Verdict: '
+labels: ['calibration']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is the most useful report the project can get. The heuristics are
+        published in `detector.js`, so a concrete snippet that fools them is
+        directly actionable.
+
+        Before filing: the detector is calibrated for **snippets, not whole
+        files**. Several signals are gated on absolute counts, so pasting a
+        600-line file will light up signals for reasons unrelated to who wrote
+        it. That's a known limitation already recorded in the README — no need
+        to file it again unless you have a fix in mind.
+
+  - type: dropdown
+    id: direction
+    attributes:
+      label: Which way was it wrong?
+      options:
+        - Human-written code was scored as AI
+        - AI-generated code was scored as human
+        - A specific signal fired when it shouldn't
+        - A specific signal didn't fire when it should
+    validations:
+      required: true
+
+  - type: textarea
+    id: snippet
+    attributes:
+      label: The snippet
+      description: The smallest version that still reproduces it.
+      render: text
+    validations:
+      required: true
+
+  - type: input
+    id: signal
+    attributes:
+      label: Which signal
+      description: The id from the Heuristics tab, e.g. `over_commenting_trivial_ops`. Leave blank if it's about the overall score.
+
+  - type: input
+    id: score
+    attributes:
+      label: Score and verdict shown
+      placeholder: '40.9% — Mixed signals'
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected instead, and why
+    validations:
+      required: true
+
+  - type: input
+    id: provenance
+    attributes:
+      label: Where the code came from
+      description: Helps a lot for the AI-scored-as-human direction — which model, and was it edited afterwards?
+      placeholder: 'Hand-written in 2019 / GPT-4 output, unedited / Copilot completion I then rewrote'

.github/ISSUE_TEMPLATE/new-heuristic.yml

@@ -0,0 +1,69 @@
+name: Propose a heuristic
+description: A tell the detector doesn't look for yet
+title: 'Heuristic: '
+labels: ['heuristic']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        A good heuristic is one that fires on generated code and *stays quiet*
+        on the human equivalent. The second half is the hard part and the part
+        worth thinking about before filing — a signal that fires on everything
+        adds noise to every verdict, since the score is normalised over the sum
+        of all weights.
+
+  - type: input
+    id: name
+    attributes:
+      label: What would you call it
+      placeholder: 'Exhaustive enum switch with an unreachable default'
+    validations:
+      required: true
+
+  - type: textarea
+    id: fires
+    attributes:
+      label: Code it should fire on
+      render: text
+    validations:
+      required: true
+
+  - type: textarea
+    id: quiet
+    attributes:
+      label: Similar code it should NOT fire on
+      description: The same shape, written by a human, without the tell.
+      render: text
+    validations:
+      required: true
+
+  - type: textarea
+    id: why
+    attributes:
+      label: Why this is a tell
+      description: What is it about how models generate code that produces this?
+    validations:
+      required: true
+
+  - type: input
+    id: weight
+    attributes:
+      label: Suggested weight
+      description: Existing weights run 0.4 to 2.0 for AI tells; negative means it's a human signal. Roughly, how strongly does it point?
+      placeholder: '1.2'
+
+  - type: input
+    id: languages
+    attributes:
+      label: Which languages does it apply to
+      placeholder: 'JS/TS only / any C-family / Python'
+
+  - type: checkboxes
+    id: checked
+    attributes:
+      label: Before filing
+      options:
+        - label: I checked the Heuristics tab and this isn't already covered
+          required: true
+        - label: My "should not fire" example is genuinely code a person would write, not a strawman
+          required: true

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+# Only dev tooling is versioned here — the app itself has no runtime
+# dependencies. Monthly is right for two dev packages; weekly would be noise.
+updates:
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: 'deps'
+    groups:
+      dev-tooling:
+        patterns: ['*']
+
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: 'ci'

.github/pull_request_template.md

@@ -0,0 +1,32 @@
+<!--
+Thanks for contributing. Keep this short — the diff is the record. Delete any
+section that doesn't apply rather than filling it with "n/a".
+-->
+
+## What this changes
+
+<!-- One or two sentences. What is different afterwards? -->
+
+## Why
+
+<!-- The problem, not the patch. If it fixes an issue, link it: Fixes #123 -->
+
+## How I know it works
+
+<!--
+For a heuristic change, the useful thing is the snippet: what fires now that
+didn't, or what stopped firing that shouldn't have.
+-->
+
+- [ ] `npm test` passes
+- [ ] `npm run audit:contrast` passes (only needed if CSS or markup changed)
+- [ ] Added or updated a fixture pair for any heuristic I touched
+- [ ] Regenerated the README figures with `npm run screenshots` (only if the UI
+      looks different)
+
+## What I'd expect to break if I got this wrong
+
+<!--
+Genuinely the most useful line in this template. It tells a reviewer where to
+look, and writing it often finds the bug before review does.
+-->

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: CI
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+  workflow_dispatch:
+
+# A new push to the same branch makes the in-flight run obsolete.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 20 is the engines floor, 24 is current. If the suite ever needs a
+        # dependency to run, that is a regression worth noticing here.
+        node: ['20', '22', '24']
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      # Deliberately no `npm ci`. The engine and its tests have zero
+      # dependencies, and running them on a bare checkout is the check that
+      # keeps it that way.
+      - name: Run the test suite
+        run: node --test
+
+  a11y:
+    name: WCAG AA contrast
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - run: npm ci
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      # Polled with curl rather than a wait-for-it package: adding a dependency
+      # to wait for a server is how a zero-dependency project stops being one.
+      - name: Serve the page
+        run: |
+          npm run serve &
+          for _ in $(seq 1 30); do
+            curl -sfo /dev/null http://127.0.0.1:8899/index.html && exit 0
+            sleep 1
+          done
+          echo "static server did not come up on :8899" >&2
+          exit 1
+
+      # Renders the real page in both themes across six interaction states and
+      # exits non-zero on any AA failure.
+      - name: Audit contrast
+        run: npm run audit:contrast
+
+  hygiene:
+    name: repository hygiene
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      # Every source file has to parse as the kind of script index.html loads
+      # it as. Cheap, and it catches a bad merge before the tests do.
+      - name: Check that every script parses
+        run: |
+          for f in detector.js script.js examples.js scripts/*.mjs test/*.mjs; do
+            node --check "$f" || exit 1
+          done
+
+      # Version consistency across package.json, the masthead and the changelog,
+      # plus every relative link in the docs actually resolving.
+      - name: Check the docs
+        run: node --test test/docs.test.mjs